Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 13:29
Static task
static1
General
-
Target
2024-05-24_d221a9c3c2673ade0513f74372e8e9a5_ryuk.exe
-
Size
1.9MB
-
MD5
d221a9c3c2673ade0513f74372e8e9a5
-
SHA1
0e8b099f218c4b813494ce8d38199fedf712a5d2
-
SHA256
a93786b8c97dec7b647982c46aaea11c23c92a61acdac97f36d39090a780739a
-
SHA512
7910097d2da74e16e970ed002b225003629299f32747a417b77f2c15ed48e6d05c4aa1f978c76a5aa94b2006f67d9b51e75e84ef9fa928a5357e7c3d8b81142f
-
SSDEEP
24576:s78r8FfC3332nUnCdAaKuSRnOO23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:s/fQ337CGa6R2yjl24ToynwN/Fo
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEpid process 1672 alg.exe 4420 DiagnosticsHub.StandardCollector.Service.exe 1612 elevation_service.exe 4976 elevation_service.exe 4588 maintenanceservice.exe 4868 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 9 IoCs
Processes:
2024-05-24_d221a9c3c2673ade0513f74372e8e9a5_ryuk.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription ioc process File opened for modification C:\Windows\System32\alg.exe 2024-05-24_d221a9c3c2673ade0513f74372e8e9a5_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-24_d221a9c3c2673ade0513f74372e8e9a5_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\929541f58beeeac9.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-24_d221a9c3c2673ade0513f74372e8e9a5_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-24_d221a9c3c2673ade0513f74372e8e9a5_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exedescription ioc process File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93484\javaw.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{F3190C87-06A4-407A-A58A-3F71181B4541}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exepid process 4420 DiagnosticsHub.StandardCollector.Service.exe 4420 DiagnosticsHub.StandardCollector.Service.exe 4420 DiagnosticsHub.StandardCollector.Service.exe 4420 DiagnosticsHub.StandardCollector.Service.exe 4420 DiagnosticsHub.StandardCollector.Service.exe 4420 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 656 656 -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
2024-05-24_d221a9c3c2673ade0513f74372e8e9a5_ryuk.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription pid process Token: SeTakeOwnershipPrivilege 1152 2024-05-24_d221a9c3c2673ade0513f74372e8e9a5_ryuk.exe Token: SeDebugPrivilege 1672 alg.exe Token: SeDebugPrivilege 1672 alg.exe Token: SeDebugPrivilege 1672 alg.exe Token: SeDebugPrivilege 4420 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_d221a9c3c2673ade0513f74372e8e9a5_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_d221a9c3c2673ade0513f74372e8e9a5_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1672
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1612
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4976
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4588
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5a0594d59d7fc92ca9d5ecdc10eb44135
SHA144c069526debb0f0fd6ca67bacd9f3b39889b4f7
SHA256573f006c40efc10249f53a2f00a661c134e3a2b543f32a357b96353426b1f18a
SHA51242c59371665a7788a2463e8a4408967afd624a9965ae948311f1c251a95255440287af06974e25c41eba147a029e3a143d4b83c2e94c5a588a517c00bd5117c1
-
Filesize
1.4MB
MD5744de1a7463406b2f1d55b4b0e700207
SHA1489a2c34bece84faa6760bf8aedf50121729a81e
SHA25690515ac56c031a0523aab0f5f42c149463383958cd745e0260a1a6a4592de370
SHA512db1c40527b8624882f69d67148620a86d4486df8ad839214749c2b059973e3c34170db62023383d4967c9ad7e45e35729442a0c1be6d0ab33ab50efb77d59d39
-
Filesize
1.7MB
MD5035db706a0407920d7a02dc74447949c
SHA16f488e0122fd9732a1c3efab5b104017ee8abeb5
SHA256115d6e1dfbb2dea643231c3690ef6fa738d3fe8a3143fb9fa2ffe7c245852986
SHA512e275cb7d3e9a02bd8085bf0e30b9f6ab0bd72766536b5efcfddbe9f0985e4f3198ac98dc257ce7aef16aa9e6ca245f96495e0af0bc4c158a24395d6c1a56b859
-
Filesize
1.5MB
MD52fb7a8ce656f365a42c82dfd2afb9c32
SHA177a3e2c8de6923b729bc1a3ac901e1d63b329e32
SHA2561adc7e8efe00389f557661650953a40131ff82615696317c0370aad6becc11c2
SHA5125d52d1781394f79b0fbacf5296a73d4c19084266fb41ef5cad16818debc9a67d2771d2de42dbbc6382383ba07472372f0e14aaff8a445fea781c275d06960fcb
-
Filesize
1.2MB
MD5fdbae9a3d4d376d25a87bf0bc6036f6d
SHA174029956ecbf38991b85147160eebae0f77c13b8
SHA256a08f162e6e5cd5a87cbca30a7b8b579572f1beb5bc70b54052735e0d58f33dda
SHA512c4e89314a3809b1d2d6303d26ddca59053c164bff7ecb8521237019ae089019c36050a5a47531bc48818124e5f56905e5916b9c3ec0d1fb9a1bbc0bcfb484f95
-
Filesize
1.2MB
MD5f747624d1ac5c5748ae92cdb4dd3c13d
SHA13005fa7da0c165e63af135e22558a6bdac490f6a
SHA25624fac5ce21cb7e1bbc6c340d698a7eea67060b86926a49c3bc6219fb79c114d6
SHA512b7b4fbcbafcf579e1b339dcea27ef97fd3a37592697b693f6119d0391baf8c920cd3f0afe257ace1fe2efb2cfa91ed70f5e4dd2733b144044eadf38c1ed9bf56
-
Filesize
1.4MB
MD5299e32be46399e51096937516f1cb813
SHA1caf503763bc566ede5feb835483cff0c22c892fd
SHA2566b647469498b4a43d45b1772d2492e693d455afd83cd10f88acba553da8ddf14
SHA512cc4d18dd15f80de3a05269d80f5502888f977fe59b58568d25f22e28af6e69c040e25b297a47cd5a829f589f54976265533cc8a15a8f05c9c2171455fa4e84ae
-
Filesize
4.6MB
MD5cac258f9294a1a517faf6f11c8dd7dad
SHA19e1edd742ec932869cc86988e34fcd8c5655c1dd
SHA25685a6fe6303ff5cb712aafd09c1a40ce6e24c7c87bd9fcc77fea572d1a56cbe83
SHA512371f74cb9785f2b73aeb0c396b072fca4d34250b704c491164ed0534bd1b8fce3851658f792fe2c24a5dc2096604d4eae3390f8e13016d3e5660f7dfcdd5af58
-
Filesize
1.5MB
MD5667558a4d3dc83b29ab8555279fdd02c
SHA115e65079aa6cc6a059ec2f9a17d6d967d06dfda6
SHA256620a50c0c28abc428d563475670395c4390e7dc8bb0bd6f67a9de0d44f6b5c35
SHA5125b6dd7e97434d9c82d0af1040ba82a5495cbde912f6baa3090211beee537cce199d311d7b8d5d61ab409e34e34d606f82ce63118fd62613bea84c14558ef7e1b
-
Filesize
24.0MB
MD50380422e722a85781429ed268835f37f
SHA1da5bdb0f950a0cebd1eb191ed0086920006730af
SHA25645b127a8f0d53d056f4fac82fd50bc0615bc74f46cf11030f08a15bcec1e74fb
SHA512ad325d0fea8047c346147848ed32bfb0614fbe77cadc7ccd2feeb095f630c9888bdbd9cd72b40cf2a0e17db82dc6126d6b6ff63cda8604cbf465c460d216cdc5
-
Filesize
2.7MB
MD51e1d9bf155ada7a5c8ca2ab3adbfc3a6
SHA17393138df077c80e3e4f6ab84eef42f6e15aa9a5
SHA25654a13596018b8156e958705c61ece464f0e3696b7109560455617415cff0bf84
SHA5124eaedafcf8940935c62179548250e2522a512e59f56b2676c5ddb8f443229290b115957a1915d13a02ea565f7f40a1a7c589bd112f05afe8e3c5d79cfbfbff40
-
Filesize
1.1MB
MD517190aa8312f8b3bf9092d9bbb775c8c
SHA1fe4c889a9d019b9ecc90fc335ab8bf4d0e0a0a24
SHA256f057b7b5b7a080ad315801a9cfe3c45116dae1df8614a03a0dbe0b972471dfa5
SHA5128e940b34ae9f93cc8bf6f8910f6273fd94f1876742de52917d931f33bb170c14e9b05ee712e33af26bc1aafbcb8a6f79b52c030b9c6cb7f4386a182d2e24c909
-
Filesize
1.4MB
MD5235eb29786fac060c62a052adb52c1a4
SHA12eceb079d8b909703ecb1288f555955a8d395696
SHA256093984bc9e4020d338166dec868ab0bd99629b5a883442827dea903e33120c7f
SHA512d29594861d422f29a1eeaf7bf2582b7d6f55d17322b66b9d4bd89cd0ed5c892f09220eed5f9e53f0287552dd2aa4840bde933b08c1279fa9bc53eed512306294
-
Filesize
1.3MB
MD5a6f4a15b99300539e20c031f227e6767
SHA1891f1c35d77ec166c4a2f57301967a1d32da49c6
SHA256f7a81610aa9740cd3386ee9c4dd8d1348297bfb2aecd05d337b99edc88a7bf50
SHA512ffa0e55c24f15c93243e73c9dc04ad86a7f3fa05acb5fdf7d80c3c331fee2847ca822cdc96ffa44bbf75825f31626fa28118c21c1c3719183dca7d8659083908
-
Filesize
5.4MB
MD578941023841505cccea9e947dab75fca
SHA1fc44cac0de4d47fc05fb4851a8b0299218838eec
SHA256d6e673b46875667a703ae88c93440af6ee71ff7aefc42a82c69e398e57633f73
SHA5129b83fb7242e3e955ee2686abfba6f0aace229c61c2fa76767a7ac9fe48714cd6652372866b3574af0c1a5942f5926a2a868ac5d8fb1e378f44ce0855734b9f4e
-
Filesize
5.4MB
MD59cd8cfce03defb756f80cf1d1eb4d821
SHA1841913c72f2677d99b8e5a0c2307cf6f6c8e8104
SHA256dde63ae335096be2a582ab49751b6d5931fc7050088171b5db146bcba98548f6
SHA5125506d157a281c58ced4ac806bd8248b7add92b4cabba12dbf75f0e9c19c5f84092f848777420e31fbba288ed906f96d338b12ac509c59870a48826eabb7a6807
-
Filesize
2.0MB
MD5ab50cc235a003b6237ed9b728dbe6915
SHA19198dafdb25fe708120322f2c9e9644e6cc77a54
SHA25681cc581f08fff1d49addcaeb28868a70f6d1ddcb0a8a783ac04624b8de69cae2
SHA512d8986bb98f60f107b90396a28893725e9ca8fdc81776047fe2c28001c0277a1acbe52ade89c6c555ec11bd07a5f3537c11bd751c8f0476200484b885b6f86b81
-
Filesize
2.2MB
MD50e3d7818b85e2166bb7ac7503ec7f96c
SHA1750f756a817de19fe978eafcbca5bb728acbab60
SHA256eede2475098645fedb3cc5f53084912e43db939af1f6a9a4f250739f2caf9c51
SHA5123af4a7b508cee75101403bc577afb77f9f7ac62a38e77559e931deed83073190a9934a4802efa09c899e34d1e584185e87fe1a45c34cf263271c6a2f0268d432
-
Filesize
1.8MB
MD554a45d02f896824f4ee4dc3212525bd8
SHA1fc113eb22259ef0848d2d79471405257cf910105
SHA256b9cddfad5e434b6ddfb6a5d86a91207cf3ca10ba7939db2111595f4e40e1cd58
SHA5123a456418e0c127ada5e8575185894c4ea486ae6895424c75952689c808a501f375c8448bcef7374dff4f9ada747f19fe06dafc745f9df1a2497abe00e043996f
-
Filesize
1.7MB
MD5e124506695773534cabddc6cb534f406
SHA1fbcd0a2b3566f38a5528c1810c8aef2c7248c981
SHA2566327d63000f0259a92f054036791481b52a5f6827b4178485b082d697d0f1edd
SHA512a0168e246a6b83ddb0f3b5d96ea2baf50e863762bb45aebbed61568aab5253c410483fc7c64a49abde7c78c68ca35694f01fb9775f7d8093130c92cd97c11bae
-
Filesize
1.2MB
MD50463a16e0a5eceb57293ffd6d36b5e4d
SHA10a107e92d67589330ddec32e275fe42acecdf61d
SHA2561d278737522fec6e7fae212191f763cf0cac09aab1b2b6e46def06aa0970f9be
SHA512d849602e041bf824637f45e1c27195653d77f0ff5a85631531c181edf4d4879f2c699ab43a0c04d6aac59cf755099e3f285095d8e53e81e7e0bb114045e6cdd3
-
Filesize
1.2MB
MD551a58acc43dd1ee25c484233949ed4f9
SHA1c1856c48868514f91575108a472349a5b9172421
SHA256065e1e9976beabdf61b30463dfd159384dbbe6b4ddf37478eb8d8b49f18e31ac
SHA5129a1a2b17c381ff59373b0ae3a1da5e37e6a11d57db79e2181285a259f0144ddfc6fdb5a9239d48637a670a15577e6fe3dd7b14472cf27a7bffd73ff440fe3e87
-
Filesize
1.2MB
MD5a3f861513065f39329afb6b209728e8e
SHA1b33f41bdfc6f86b5dd6a85d12c477c2617619617
SHA2565eee66ef7ad60ab924d3ffa038689cff81e255cd676db6bc829bc51993536b85
SHA512ecbb9ee611ae094907b58eabbd7e16f57c3df4313d4527e2f5b556f47c5740564ffdd47a40a3222d3612423410a838a4ce033d7620c1d41dd2e5c10a8147928c
-
Filesize
1.2MB
MD598ceac3d434fb4ba1a3f1233686a598b
SHA1fa84c50966924b9b81e453edaa06e2749964e08c
SHA256afbb2333888062c0b67a0da50463c7e93f79f32134f810ce79b5f9685c0c7d8b
SHA51243a84f9b2a5bb68d34c646bda324f4bf7fbaf5b764bce87f76a0dd928d0637a9a0a4f396766fc437121b56a5d1d2eec77f96e486149975b4211328c871d4da97
-
Filesize
1.2MB
MD5ef541c499cf93bb781ce29ff5cd3df74
SHA129eea4336e6c9b1452ec5271784fa740b7bf396d
SHA25647f7e9188b1a1d0b75d7a06fc3d478f0b902eb6b0eb585c77218311d2d9283f5
SHA51231f6bbd04344369c2884f39ad7c301d633182c158fb828f083bc7222a659940f472b799685d7d80360770598f9e63bff6112eca2851ece9de31a35d39c51bcac
-
Filesize
1.2MB
MD552a70ba0de07ba6d9c41ffb83678a23c
SHA16cbd3eef7ce5a4ea504f757fac14f5215f1c5b17
SHA2560d94c8040c88d840ea31c189ed1051011512cb4656218e4f09406ac5824bae44
SHA5122584f826bc9ee9fbf64d159e94de4a9f08ac0484a2b919add0fe475e4b7141caa48bbebffe62e10270f6b009ce8618bb8b43f3654ce2ad2391d1ba9da0df50ac
-
Filesize
1.2MB
MD55125dbc836c622862026fb5da484f519
SHA16943c22f9227958afb09d72fa5e735316ba11e2f
SHA256c8eb8563119f74f380e6ad7e7ec45b7e19c292831d83fe72808b1c017099713a
SHA5127ce8fca6da27fefa9fdd96d3cead398a52aabb664f17badafcff2b27389e1455ad462862fb2b925bd4b09610180a28819d0ae694c80ab8a435e470e54de68472
-
Filesize
1.4MB
MD53b4d25b88bc94a7fcc238772a9a5586c
SHA1a55e39a887117f41ddca50ffb1eabbbfaabf3f47
SHA25685f6b92d4704d2c8047867d742a97d2f265d128dc3239cc49541ebfb4a00f8c5
SHA5127b14b868c0bb51c6ec4bd1f8269f39175748bec5e954b57ebfba47642f24acd6156f0c6a54eac6dd9bb52dd96f9b591851cfd86384d99c697483139b3102eca9
-
Filesize
1.2MB
MD53629d5766df15974b8ff2add2ebe1161
SHA1964680dbf4db4eb79b2f4df3c06f704587dd93f8
SHA256711af3f0d0750094a4ba25f2724ec422bbb429deb245ef36eea9a8e2b10671b6
SHA512cad41c7a27e2823270fac36fe32f0333eda7ee2baa4e6a0191aea5eb2f9c1dd6b3a42f9a079f40a477a1d84436fb4c7445996bc67312864d749a4b9994d2b4f2
-
Filesize
1.2MB
MD5e1dc3aeae754be3393d5e368e3348d6f
SHA18b378da59e43527d7b4c74a238ad249b7fc5f8c7
SHA256700c6c199d9087e55ab4be1e573ee7e3ac03f25fa9a9aec35bdeb7d547df5f54
SHA512f57c4049fe70b6fb6349d5c56ca25a85852ca635ef14600169622c405329b694b71720344e1457e191ee9a8b91f375b06e0ab02a8cc9b750a91fa1a2e0480952
-
Filesize
1.3MB
MD50a861ccfc2c5397a33ec31b687e6af64
SHA15b5c6fb32ef01ece779ad12f2670cb624e4397d2
SHA256cc833dc5729160f3cebdd1770bed35837c786ca5d7ae7bdad8c0c4b0185a2bd8
SHA512c16c6abafa083e78295debba12df22a95808ed1d31966d3a1fc0ca65889cedd8fc2048fa62133cdc71f0e80cf008877145359501d5929530b97f01c1f07d997d
-
Filesize
1.2MB
MD53cede5eeae5a9cf72485a21d3005ac20
SHA17aa077ab4ca63a34eec874a4fd9224ca155f5cbb
SHA2562c216eaa12dc40a3521b9d07e9176cf10e4c47535fddf2f629e8fd4266947c33
SHA512606356194f070808c8b2801de6d073bcb9e84fb05ed8a45a4657f6e504b8c1d13b4b81120b2a67c1f60000613d2f95b2129e735ed82a83523cb6f7e96125f8cf
-
Filesize
1.2MB
MD53b2deb8f8cd763796f9c1db82e5309c1
SHA11c76d9fda69e9cdcbc1b38c800bb96bb2a3b55aa
SHA256eb6da0b4708b6d870f8b58af74cceb8591c6915f20ab89306b4ab2c3c985f963
SHA51229c47072cf9c3362aa8c3b0d658072998537003a6bffc0918c9ddb6588c9f40dcae4eff5a0f2a4a4b8a8fabfdd22b2e4da6a739cbe39d05fc6d519dc96c7e8ca
-
Filesize
1.3MB
MD57c603e030aae43f34ff08754cac0ed7c
SHA1c28ec613041b2067cddc59a334fb169297d01c63
SHA256879ecadcb67ddc47b6f04954b3b43af52fd50f0a62c8f2c31bfcafacfbc52183
SHA512c92dda3862f88962143fbaba606f1c6ef2cc9344cc111c939cd923e1098ee5d00617cabc35d3714527904ca1882acbe1d23a9daa66475ca14c3d992c44a7ffe2
-
Filesize
1.4MB
MD5b50116fad696c8643d0359281401e5e6
SHA1a0616d52a3f25a2ec81df502a68de4ddf90f92e7
SHA2569a33dbf801115d15b410e9500393417a3ba72624367623cfd23f336f26ad8643
SHA51261776f6352ff42eb46fc6bd44b63f6ed95005ee4fb693fc875e24d404c7dc3f585d8a85eadcf331e50b9991126bcfae6e62602101c3d8656a06d2873680bc4eb
-
Filesize
1.6MB
MD56122f5bfc44df2d33a095815238f7648
SHA1b8a64a049f4cf45fda7c5fbdcc3b64adf550172c
SHA256557663e6c5d91f76b8eb3a31eb20b0d842471259d7d5f7cf96147345a31a3e80
SHA5123f79f4b4743432f62906e5d4737eadf05febeb6ca9f42b7cd22de0bc867c17e8eced4850a02f112d1e915c5ec10a12fb7fb8bb6e8d72f7bb2f3fe0d987d6daa6
-
Filesize
1.2MB
MD578de9bb5838d95688590ca125eb7c73b
SHA1c3c2753208914d457d6a7a6de142c3084875e059
SHA256ad64b51a74086dceda8688e65ef57c8719775472d4605f8e0c98aa7912278fd0
SHA5124cf93149df353afe0da27030629ac04ead9ac57b074d6af4f634d2591f8e24d2f25323a123f8b7186254c89f44eba36ca40c14ebdb7bfd5e8c1747d19c7c29ae
-
Filesize
1.2MB
MD5c04bf0462fd123372e0df19dfe4e3d09
SHA1cf1aa7f59b436e2dcfc55a8990a7362156a7947c
SHA256cfd0ce10095cc3c9759df77ee4b1cc7267e55438d99d740b5d2b643d0b47e890
SHA512a432fd5d3b3986ad57fd8afe8dd886ef3236d27ac75018e1e1056ceef85e0b39b31f7e3c5ba34e099aa83064ad27045aee23d14ce77f3b0685624bc910def2f3
-
Filesize
1.2MB
MD51001cf77ffef5d412f7e305963964d36
SHA1dbbc81b8593624249e2b44c46ae8fced7cf5edc2
SHA2563e72bc1e186829a1bad6afe062828fbde9668b44f62e5a86c2a4a55a751651be
SHA512536ed89213dd28ac44387a9809d1c86a412b64644871c42005521a45fd94034bf1031dd9a84aeb553a2c5fa508f5a05ee5685239bde8b455a63cdddc0bd23625
-
Filesize
1.2MB
MD570cd219d776502e72e0648e4626b5ca1
SHA199e091a632f18fa80aa4437e022c14332cbedb85
SHA256f4a7a76e3144d40ebb50850e0cc23339084161f543e3e142f0fb2824716f28cc
SHA512d44455779904bb5032bb41e861fbdd3e6f01f7ec6c26b0ba05e60afd1a0821816bd89874c513d47234a157ace539505242f6dc8960be711427e01d3d25647db7
-
Filesize
1.2MB
MD5d6f6453c40d22c41578322e942ebb7b6
SHA16a11b349730f850e584a11926ddcc194f91b072a
SHA256b8d0379aac71d290aed6277202afed4542dc84ddf290a9e9125622ad4d116c9b
SHA51222e1783d3afcb1073e032fa193581dd196bd24d38aa99fb918bb25d7428c48e682b039e5bd422e32ac4e031375efa8594e6186ca69cbc1630fc31c16e83ab4ce
-
Filesize
1.2MB
MD56f7ec4ff6c19c0d01e3712fd98e0d7ec
SHA1b4137c8b95d43af1e2666e6fd2bd4c0361432a3e
SHA2565ac21c41ed60ad74ebd1fd2f9f7fa8327c2320131bc225cdf51a92ac6324ac91
SHA5127c21b796cfeb9dedea4ba0f6cf2990e44124b109f40af97ab64c3bd95b79e2d4bcf84a2ec3c4dbe3e1de364584d60979bf6e1cf19312e4015a2ed2883cdf2d33
-
Filesize
1.2MB
MD5cbd26fb80c6d1cee2013033f31a86542
SHA139baaa3f7bfae7ea8b1836d8a9581f6eb47bbd9b
SHA25685ff2f457bf3029fe91b7df60e47ad203786c5760078b8834ec112987a5c9f3e
SHA512dc365037a388d6e04d6267d3c839a94aaa7d6ee98bfee9e3c4bdcb8872bd87d690a3f2d7c4f8eb3f0603bcbf5750a7541492bc8a9360ae3a3dba3bc6d5dbd18c
-
Filesize
1.2MB
MD5189f59694a4208c331ba397aa2bd1bd2
SHA1e37a671a16118f965665eed3a98de203f96126ac
SHA2567224a22fc1d312567ae9d2182533ffe1a73c97d5263f0c9c0a52f9dff68f4ef0
SHA512ff6923c6a28c99b9c06e3486621b08f33a3db66b136fb56fdb5938f9adb887e060672851edbdc78c56c2ea781dcf7dd30b05cc933b8f3cc5ac540b75623eeb88
-
Filesize
1.2MB
MD5de2b4b86533f16da42e1b0b463c6d4dd
SHA1a713f0ac544f21f92619199c9faac401806b1c08
SHA256a9f9f64ec601d714b74f85ae24fcf537dd9ae671309dbab832a41fa7d5a3a582
SHA512c9fc87a30f16de34e42bd9c2a684ece7a112862f6cd852ea5880453ee14a1eb795971af6815463e54f66699f63940e7f009b6e0eceebfec10594411212d1fea7
-
Filesize
1.2MB
MD5ad6a8eed47ec39afd0ad520d16761f86
SHA11cc31b95cb3f347e5d8373a3a602d7f7e19265ce
SHA256b625e93e55736c56cb72ad595f988a8ec9da99d019302478b3fe6f54a10c15bb
SHA5121aad0426789a3b3c858064e3ddd30e74fee75bd0e3e7b4ac6b5f12ded004dfad48015692543f2f956dfea1d413a0d4bb848d6bdc4077219d7016183b35d6cc3d
-
Filesize
1.2MB
MD5d1c212e89c4de52c528eb4a356dfea9a
SHA155597bf3394f8ddb09a35a5d971b063d916ea9cc
SHA256c014f63fbe146f26212424388b98ec585481f4b39aebb9c0366179d40604922d
SHA512ac13ce931928b960d75b34e43d4cb21fdfe8ca4983e5b6b4e57b439a867bfb3c7bbef2fc4034acaad9b7bd75f9dd4d26cc47934100aaa6b3e23f4c659dbf55c0
-
Filesize
1.2MB
MD51c0e163c2f13de544e0d0b58e76bda6f
SHA11d98c837bf5a350503ba1d715dc19eb5874666d3
SHA256dc1331fa05756a41d9282fd592044650f09e58ab1da260971f89c1d5c00f7fb1
SHA51235e844d0b28bff60190bb551d6cf05e4678d6e713810a45c5eb45d5096f88fe2dedf952da1def69857daf45763d84f0e58538215e6be72a5d75c8c987d91a22d
-
Filesize
1.2MB
MD5cda76e64542a0c68d1ec96f7b4c257c3
SHA1beef9b61a84da387a736995968d716efc80074cd
SHA256e65a7c6c7827dbf92687064b14ebc32ba2aa9032b8595c0404197f0214a57dd1
SHA512c8763afe2b3aa43865ea18a58eb2af39e494c0a41df613936495093704e1ca04e12743936470d556e29767744c9bc4380b3fc7ded1d796cfe3f7db4269c1b154
-
Filesize
1.2MB
MD52a51160aeade65d4f66b6d2d043d4952
SHA145a1e24629ca076ca4c719f70687ff33292dcc33
SHA2567ba4c61345dbaf5e274ee4250b7f4007ec4847acc359e77051de54cd76f60516
SHA512e18dbedb83eb64dd82a68f8224738d12de418063151b280bac996631243d54509333de961804f55d20603f1a50b1ac8252336616a4f138022378fcc7a745a210
-
Filesize
1.2MB
MD5f3f733df8d5c37e19de7ec3a8f3a2112
SHA120cbd1fb723144ec84e3d951936a5cd07b878010
SHA256157e440c98f190c78eb8f739d47c0c079da4b702177d78470cca8e75a995d316
SHA5129528d496fe200fe56ae058bfadf41018212faa0111a09456b61cb668ab9864d3e87036874af42421666881e8b8652b71dbf2197f7624d7adc4778c7c263ae87d
-
Filesize
1.2MB
MD50914391415dabb1f6e9f30619d4f991d
SHA1a51731abe3e38de2508a3517e4896ee0d1797cd2
SHA2563bb10fa7c98bfd5bdbd71ef8db8be3539c286470fce533b789bd2a31b11ce8a6
SHA51277910a6205dd5dd34b5bc3ba76619ad7de53dd7a1cf9693b712f2cca2416fcdf0532ee7ba90dd4d10873752f64b0e2533125536a0f725b9681535320904858d2
-
Filesize
1.2MB
MD5522b50f141b4c4419ca367a54d894aef
SHA12a5d0e12ca5b151c9ce283052ffc18bc754e8269
SHA2566f290aa343efc10be2abd235fdbde5d4bdd63eb272e3e3675af5d02fa9769eb8
SHA5129555aea92487e20d82f6b3e32c3aac84f877de72903f97a68f5b39e00258127a0314f14c606e613a08e85e6120ce7040b4646e7703d1fcb324c9cdad52bc04ce
-
Filesize
1.2MB
MD5ebdcc82a954512a2620a1544b030ba0f
SHA1088edd4146a01c4a77a0edbb42b7547d9b8c62ff
SHA25668260116f39b17799b773a7067b850d6873e864da5bf897f88c873225be1f5cf
SHA51276591b207e2a55c2345c93fd7f81a86ff0fc495f007cd9b53b5db585030113ee3ad58b2ec28906d9ba2d854903a4f61cddc6b463cd2ddfa821d73362ffd15e16
-
Filesize
1.2MB
MD55773529d01edff295909bc8b5ef6d0ef
SHA16f202ea0b23130253c3d7e4a6b1ce393ef03d116
SHA256d00a68b4a916f212303f26ec068b3ed9c1d8c049b52e265e1aa277969a3178e8
SHA5126b250d2afa44d69a7196421bac6d57b9fabd9f267141dd262b73510ff6290814b88b78875dd24d6131231edcc9760f58191633065e6f73af950feac0a6e27cfd
-
Filesize
1.2MB
MD5dece6c93eb394c21592185bac93dbf00
SHA13e2d98aa053e0f41574d2b3b1d1139de747c5732
SHA2563676b3fae0af45e25ed64ab7ac28f533afb187ca20fe136f1efea151e1c7af0a
SHA512ff9eb3f209f6bb1e4886499eee8c78a2679aa3372cadf9d1e519d0f444e1c6e21f0bb70c1f8a48dc8a076afa3d4f13aec9332fdb867e189e084737d72bf19331
-
Filesize
1.2MB
MD545a736d23eea021e7c3e018a45fb86cd
SHA165ee4f62690fa2d6e49651dd237d6dc1735de20f
SHA256d6538c459427ef28d170d09d9e6d5862948fcb0968cc385b517ed325afc97c00
SHA512be477fdc637b442bfec23c1743e6408a25cedd31ea2f8dc5a45f54ce6acfca65481d7cb5773cd288079ee29a3d643ff66b0408db9965dd36a26638530a693edd
-
Filesize
1.2MB
MD514ed7f1e8cad6130189e1d51cf63880f
SHA14d799422d079c84560fee2d0863ba72d3604d117
SHA25648a1740e4c6146d81a71ad1dde5faec3a0b446e78a442a98b8ffff54aa6f23ec
SHA512ff0121f24c79b666a839b7b411fd70a8349de8ceb39a359b1835c7fcfde5b4c2d7906bd53de5b3a517bf7e5170211169828aa7b774342212d0e701829d4da904
-
Filesize
1.2MB
MD5304b80856813727f7e02dc975ce3c284
SHA16a8893129d842cf10aa516ade408a5169a2b539a
SHA256ab55a2684f354342f0c14599df61c9871b89cc0ed67500868b42f34811d8274e
SHA512a3cf5308757c20496f341055795239f4bf53bd48db0468cda27600215ca4c27a9885ac2c296561e4a9ab6ed324fde1492b3bc167c1fcd41a2360102302b788cd
-
Filesize
1.3MB
MD5f223a82684105f086d97e949b8bc03b8
SHA1fd1cf8f4484fb93d09e865ff302bf02f83aab6fe
SHA256268275bad2188b46ed07fd510baa82af84af091a5e689d7d1217a286c56c2bfb
SHA5122227b3defb2b63abeac7f1072d299aa04744337c37662ecdb6b4f7e8523c39400b5f2e53f383b6bb74c2f5cfe01d86e37ea14739a9c86968d98436fa074d3c06
-
Filesize
1.3MB
MD5b7eb544534ad0c72801f9764b25b4a01
SHA18fdeceaee70ff082e95c58404e8ae68c9528fc47
SHA256166e1c493d75fb1c506b8d694f5aec9ad765e27b2d25444c52931c9f5b3ee0ee
SHA51226cb782ef4be5c0cb0ddc9131d027b9ecc60b4d58d0a3f99dbe93a0c91c714a4544323bc668df088fe9096058aa487945cea16b1b3cb91cbd2f11df172bd5c6c
-
Filesize
1.3MB
MD52836b38b1e4e37c30dde3c180a92b102
SHA1b86084045d5e37b7aad28f972cb589c710f47089
SHA2568ed16454a75f55289e6f86feb09d9c2ae03564c89d8152f9b7fc6ef3d05125b9
SHA5126dd62e1d1eb2537ce3d60777cf89dd21f2d8b6a44fd16abdeeecd15a0b824366472f3fb70905fa62a2c7fa03f40a26f7877b327608d8961029903268484dddc0
-
Filesize
1.3MB
MD5db7f19b7382bb2132f483129ca896de2
SHA10d5d3561972eddfad7d311a8245d1cd4311657d1
SHA256643f5ab1c6b0b6a61f545df3afd7d7990a53f59fad636ff5f06548c271fddf1d
SHA5120228c1d56b590c4de486734d8adbcfe609f42b7bec9f0b6fecfb2e994adc18a1a4391cc3ea900995967f05ceafca163b7162cd65ad959a7434fb53f4dc41a5b9