Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 17:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-05_06d0bd5232ae61b8fcf31bb4f7f9590c_ryuk.exe
Resource
win7-20240508-en
General
-
Target
2024-06-05_06d0bd5232ae61b8fcf31bb4f7f9590c_ryuk.exe
-
Size
2.2MB
-
MD5
06d0bd5232ae61b8fcf31bb4f7f9590c
-
SHA1
403c0c0b6a82f5ea3d1b18f9e223194fab0890bc
-
SHA256
e327ba64d2f9a034af21ce47183040b24f9adc0d22a2f8615425aa41b038e47f
-
SHA512
728b7c37bfbff8d5ea927a76c697d8c568cb7dfedbd3fe78654b8fec7593d8873389a72dd3f9e9dae176408a50f87d08a32eb6aed9be1345b859f780fec323cd
-
SSDEEP
24576:tOObVw4TaN1wdkukCba4oXtgLhU3wEdmh58S6J17W8CX32+KJNA80T:tOOh3aN4kuLbegmtGycW+S8
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 4304 alg.exe 3128 DiagnosticsHub.StandardCollector.Service.exe 1884 elevation_service.exe 3016 elevation_service.exe 1528 maintenanceservice.exe 4556 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-05_06d0bd5232ae61b8fcf31bb4f7f9590c_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-05_06d0bd5232ae61b8fcf31bb4f7f9590c_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-05_06d0bd5232ae61b8fcf31bb4f7f9590c_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\7cbb5416b4b1389a.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-05_06d0bd5232ae61b8fcf31bb4f7f9590c_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{28C8484C-303E-4CB2-A704-E3FF47E10F7C}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3128 DiagnosticsHub.StandardCollector.Service.exe 3128 DiagnosticsHub.StandardCollector.Service.exe 3128 DiagnosticsHub.StandardCollector.Service.exe 3128 DiagnosticsHub.StandardCollector.Service.exe 3128 DiagnosticsHub.StandardCollector.Service.exe 3128 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1868 2024-06-05_06d0bd5232ae61b8fcf31bb4f7f9590c_ryuk.exe Token: SeDebugPrivilege 4304 alg.exe Token: SeDebugPrivilege 4304 alg.exe Token: SeDebugPrivilege 4304 alg.exe Token: SeDebugPrivilege 3128 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_06d0bd5232ae61b8fcf31bb4f7f9590c_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_06d0bd5232ae61b8fcf31bb4f7f9590c_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3128
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1884
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3016
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1528
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD57470d40418b3b8395d2857280f032876
SHA133fbdd70e2beaeae9ade431b614f8c087bd5ab78
SHA256be84f4433f9e3fa88895c7569e133954f008ca433bf46f1123a4b953cb9d959f
SHA5127686b7418c6c6d8cedd6bb0556b422b4f3910cf6d7dcf877f251ce9ef65e22d63c0cd16b0a65b798d7da6a643a83bd3120c47f7ddffebd6fa3c759e342168cce
-
Filesize
1.7MB
MD5f566f550ff7907acb45f7c3bdc7df8c1
SHA1e63f810abddd5652e4f62aa7a716861ff8b0e234
SHA25652070cca581ce63a7344d51b250570a1449102a1c3fbf651784325e0cfc5ad37
SHA5122d10857eddba18129cb6e1fa40b2eac644ad008f01aa702cd24ce3682ae17f976c6e28986bf1a45daff5e3c9bf594192d32f966bc74f51638fccb46ed2ffcddc
-
Filesize
2.0MB
MD5ddd8aad7c06bcceb0f42bc8471405a4c
SHA1d0fe50d3108bc0b25286da47c600a84c4af1eae7
SHA256f7838f2d8e54420dbb68c0365e72d7b45ef7c544abe75d7d445ad057110c91b9
SHA5123ddaee2f870d68050ddc10f101c6946d6a132d313d9d507ee7650bec6ee9bf7bd4e053dfe38d240363b753bbd9e9a420e8010c62fd7498ede36bc9e1329c7990
-
Filesize
1.5MB
MD59c26b42d8b24c7c02f2909beb9d4e54e
SHA19db1d7ae96875f0f5d5c36dfa1f8d79dd941c47b
SHA2561577c89c9dd5b8f5c02bd1aa223c6cc56df067f4f3e482c677378850ed56c3a0
SHA512e46e71b8a8a87bf37b30d75ce2b45bf1e59b006b0b5b284c2cdcce11e3a151ff473ac7022321af6594809170edbfc258879291045390bf20269eb1d982cb37f2
-
Filesize
1.2MB
MD5d23d02044074e68f69e0b8c42d719362
SHA16d52f1347fd2f36f87f1fd3cce733e5e5b146731
SHA2565f881703a34fc39b9c97d951d3d54029d30a054cf6d47c667460fff804e8e841
SHA512c96207e09d5c12e006a26334e66c9d5625d5c5a9cd5afc3274166eb4fd18fb67937f2013bac71301b5f195e8865ebb43d45e24136d78801499a16a0b028b96c3
-
Filesize
1.5MB
MD515d0a7e4ff889685902f2b1349bb1f83
SHA156d864568692e701ef1f9f92f28e7a5f5e63ba3c
SHA2563cf42ccb829abdad536974640e5f31f3f13bb9f80fe2ab47987e0867d4ace921
SHA512edacf4325732b2a2f6308dc0ad924db6f472184c60f89413a7e538802c6a934210eae7b82504c7d26d063340bf1171747c198564a5ef605887789233cdc7e2f2
-
Filesize
1.8MB
MD5e6c37b3a6ebb69711fad2ad182a4fb2a
SHA12c250bffce8d1eb6ff2deff23f286142705c5236
SHA256dd35d08a650370a1e4e9cdcdfc904f9acb07935c6adac2742e55d1d7f1c3f0c1
SHA512fcec097236b62d8832dd423d132f7f42c0d3ae5aabe842f83e4504a5ff097056afa701d18d17ff7fdf714711c0263e18d184d44da452bd0eb64b24038af492cf
-
Filesize
4.6MB
MD5425aba3cbb643fda3119d820f9bbf0e8
SHA18f0cc3c13fd619f7a8c8f26aa9c24153c6fe4da9
SHA25664aa082eca5ae839dd18b99c5b2e3b79d6cb1095db8b4adb5da0a74ea2b3c048
SHA51271bed9ae3d634556352c0fd3669b832fa3046f0eb682fc4a94225db35bdaeeb4471962000827c8567bbe3ba17e877339420e3d1b29aef2f0967291d2380bfd54
-
Filesize
1.9MB
MD526b7fb349b61bf0db9ef5a3c69bc3bb8
SHA14fb395fa60648742a2883dcd6ab95c21bee828c1
SHA2560c4ecd029c138543046add802f35c50fb702344e96e5ec414c60dbba474027f7
SHA5125e4aefd88d8fb124214ae3b46b6f7a2a2a9030d38360580136faae4d1789321bd7803f28303588b73ba941025195256754961ef89af771f775d393abc7f8ef76
-
Filesize
24.0MB
MD5e0fb6798331ee67be6adabb5f0c7db27
SHA1a0ed7408911d23765ae8d080eaa93a6b8cf0e499
SHA2568b9ccbd531f24d84dfef923474b5149ffb56154500ff9ce2c9ef1a09cbebdd51
SHA512d06d6fb82afee7f923636a9afa95ddc3270563c29f49478f281637809c76154f49121eeb3aa9d878bdc3873b8beb2cfd6844fe11b665e408e5c81be15468d43c
-
Filesize
2.7MB
MD5f923dc0ed486fc54c4241dffc05162a0
SHA137b6c86d15215549e9a8d36b09069972a0632690
SHA25687bf648639ff50d40b2239ea7d7eb5f97fd823318823f08f884affb6ecbf5842
SHA512fa0d09cabff392b2c8ae6edbed4d205e468ccbd38ca9717e7b93c03c269ff2919e35b578f472b86896fec3d49ef27f2d60e983077b41c1c0560e65bd69369ea2
-
Filesize
1.1MB
MD5a47b7feb610aa4c767cf765bb838f566
SHA18fde262941d22b77f4ed080a5fc5f2638c96e7bd
SHA256f6a4ab6b4cc52d1ce67705f30b49869fa3b7f6d241da27d6fca6f0ae36a6b448
SHA51297aa28c6a53f7d76e1b8ffe1ff2dc49b44fb7710845f2477df011f5fdea50855415071928f1d25e715b387b499d20a502eaff884fb9c1157ed503bfd1d2bd548
-
Filesize
1.7MB
MD5e3caefe8f6d18264f0f40742cdb48671
SHA16e08e5fa0f3ef230ffcf43419e6ba4d90023c517
SHA256ffd94a62990bd979bea560934b14cc821be1625171496d360f6291603e46ffc2
SHA512fac38139e361da2961eb59c1e558622351f33d5a1237220ec3b153e48fa61722eb98856c1e664ed52186733a73fa801db89571d43efd2c9fd338b7bce8df0404
-
Filesize
1.6MB
MD5bed76ec2f24e68c798d8c79fcdc2b615
SHA1f25304fe26c27748e12800c9064a649141f4eb1e
SHA256600f782d7ac82f6e43bcac7fd72fb726de897474621bc948ae30ef111d0fcbbc
SHA5129f0fd7c98bc930f7216e1cb7748e175aaaf27c6ece1c1cacf8fb5a013c48cec408ab098c61ca2cd3cb38434e729f4d47a0f29b15d53fa7412a27facb654bc337
-
Filesize
5.4MB
MD52ad0b9d8159f70b361d810d1bd0125a5
SHA16b06191a545a68a57cc0ebcb3ab15c1cf376e1e0
SHA256015250083506a77ab9e68d4ddc1abd6db1121306fe31cd6ae9511321e9bd4bf6
SHA51285f364d024541734a9519a46983e275e7b2b2ccb695e3f49843549c6da8de461fc2f2cf6ad30509956389e29eb32b735f9cf3ef554ae3e9d051b5281107b4802
-
Filesize
5.4MB
MD5af378d56f045ec6fdf30d39091ad0244
SHA151ff95c000c8421d5434db399f9717e9419ef00e
SHA2568bcd5a919522e8e25dc8ea2d2386d8d59b2fb045b9b9933276571471676959ff
SHA512febb88775f6e2348bdf6bca100465d1beab7cc9ecacbdc8a1b0aaa4e41ff5f901f72360b35394b0352662191c4bb03fa2c76922fc253f5643fa6cfa9298f36c0
-
Filesize
2.0MB
MD562625fed2ad4d47a713bde051ce59b64
SHA1c86792f3e65a86f9a87f4fa6e2f4f1350562b4e0
SHA2561c44124ad1c18de3ab32dcd376173fe7adbb0d889fd93ac1f2a972d2dcb90412
SHA5121641e836352ac55ee938e709b93113c1d6fa5224ee7c19bfa381b90408f8d460f8087ce3e62b895fc4992905dcb36d3b096696fedf80b5b8bb30093bb2955f42
-
Filesize
2.2MB
MD5eebf2714a6801e405866d096ee048ec9
SHA119138a13352879860a57deba216e33ed849c2bc5
SHA256d01dd6daa610c633be5e38c98493e943f8ba3bf86f448e38cee874425da7eee2
SHA512cd7f81f6bc88cd3b0753d8781fbab60e2ee859970302b6b9e2ac89faff79e624cffbf8a70a1eef9150f94eccd2c4b3d9551591f8ebdd7dc39932fe6a7035f79d
-
Filesize
1.8MB
MD5081c081d7722f1d5d47808a938a0d1c5
SHA1479c2e6c6397e3adc284ce546657a32688793610
SHA25644cadad940eaa97907760c51ff76853aaed7234e0723be4b7290dc350f875943
SHA51288d851c889910f444a6fe0c9f9371fcd668b9643947171c5350208db51b449cdc4260d6b20c762b403e5d580dcd00db87b2f6f3fadad35e56ada50da9e802e94
-
Filesize
1.7MB
MD5b25fa94d61de3a187e16b16d5f4743fe
SHA1dd989e14d87625a0956f666425869bae90f0ceda
SHA2568f42cbc9e32aef2cedab44c041e80508df476c4d91a3d61d416b5ddb739eeed9
SHA5120bdb9ed7a7eac82e3e72eb0f4fb746b0a6ae21becf94aa77698f0e40552db80056ebaa3628f0b6140b2992778e5631880de212103087be68f2fae7aafc904f43
-
Filesize
1.5MB
MD5671fdaadc69cdb2ceea8425f29588608
SHA17d87626b52b400162cb1ca3a43b56045782f8035
SHA256893fe18e01763e84d668a656d61cb6f75e0ca9f06aadc776cbf15630f4eab1da
SHA51213d527a9b846550d7e3a44834bea07f52ec01f2e47b643b2d59b2640c7bc9496aaf518a7a54dc55c13ca060e891ccbc407e0e2a24cc766f9ef49f639886e2450
-
Filesize
1.5MB
MD5deeb16c99655bc6f6e44641e55c6cf38
SHA149a9bfc382233bbb7d68901135d733391b73a5e0
SHA2566d062dd3542b3d50ba83c9a63a9e331b165bed03c0a2e1d6430c783c43fe0f85
SHA512afc4c4331deec500874da78b76becb80df62fe4ef82e0acb328177122074779da31ca46c248d94537d560824d1353a12597c76b5b51ff0a88ea6e100e2a567d1
-
Filesize
1.5MB
MD55ea0c6e75b864683f2aa5d10d4387235
SHA1271a5f539e693d86dd95841f31d0b1805010afac
SHA256fad461bea2cb7b44238d794005cc1c410f05a9405e28287d4bbe519de190646d
SHA512d09a405b038f291335871763d26a95889449e0319d742f4c053450c87df4a95ccf3956a6c266128aad4b45c83366ad31e901077af281111f880fb2bd1366cb38
-
Filesize
1.5MB
MD53795677dd16f17a470649426b9fc1724
SHA18e5dac040425bebab6df773cb7b793ba1b4fa1a4
SHA25687c7b2e48db14c4c17a379a853e1a7c0c2fc40450247d611da50bc901f819d51
SHA512b9b43fa40d6ff88ed2de9ac30031a5cd728a93c6c649b3bea57feb8ed19df6a6649ff5bc2e01d452f8fa8d7a583226a58ca9753a543f69a4441359c34e822872
-
Filesize
1.5MB
MD53dc93b9cbe8f40e8fd739237f3ff173f
SHA198061c15838dcd17dbf23c23444837061122530c
SHA2568340ad3f98977af78cd99435bccec2fdd8ef500c7ca519d4042331d4cf7bf613
SHA512b9b2b658c0151fc82d198c6a5b9840784a3a36a8663ea5dc21722013f20c7d4787896dcb992554d4fdb3362c1ed17b406e83a4c0a0112b4f69a2fd25e7d16bb8
-
Filesize
1.5MB
MD561b7f8e95cd0d0e55a3bcc63ebc79630
SHA1d41f8cf9972d61795ad78c7263090b690c87de6c
SHA25632351486639d315b834d0d2616bc45a6431f4af91c36116eac28cee869e670c1
SHA512a456cd4a895f1affe52a2196b800246cd93ed5ba1367310fd59360dc1a8ff1145c4d4c3ecebde6c645d76df8eccf911dccd066dc6a046d19b8026f5e1e953fbd
-
Filesize
1.5MB
MD5af908d8659ca966d86e89e35e345aacc
SHA147e1360b84213d0f48ba496a3bd9df3ff877b8d6
SHA25614caeec8cc9762bec46e10774a53a5edcde891ae50a669efdd25b7a797bca063
SHA512681c9448fd317396e781e40f9493af11a7b5dded3e95410846ae9cf45e484b6d0a707643eace9ea0c26e07675307bc4129ec5663dbcdbadc1acd45242e664c15
-
Filesize
1.8MB
MD5c319620efda7aef61e01e02f6e582b80
SHA1370fb8c7a776fe2771c63b4c76987862d24dd712
SHA2560d4eadcb2696d3df25fbdd60b07d455daba6d81fb812ed5b6a10bd61e8725c85
SHA5126763993188e7aa514260c20def644b712464379591e797a746db3b6c83d3379660df438f286b66fa377b0f8cac35e79ad723280e0e8e9e05970ee2e0ceb2cbea
-
Filesize
1.5MB
MD58287a5bca4832a33aaa78856966ecf32
SHA147654c0f4a19b1084f2d2fcfb81edbc37a0b3dbc
SHA25699f60dad05d2c3c448022aa7b832a05c2ad542db911670cea9be74ce74dd0c14
SHA512336d644c3e229f385e114406b6fa7bd0a093e2d4b248234787a6398d885615743d9b7128d1799e12e463972c916554e11317f073cbda94fbea43be0de4b3ae72
-
Filesize
1.5MB
MD527ba051d84ce52e71f37779c76d22941
SHA14a14084424b1acfdfc805fcfd8289679bf2d0620
SHA256f231a1951736f0b3a373fdedbfbbe0e186f649df3e57daec1985c34c8ea72df4
SHA512fc69e63c4fa2590616ae232e11987413ee980fa582ba666275b9b2c9ccf4ee094f3e973fae7ea2f177a52a8440127f39ae5a28a76ae0df1127cf6001488a192f
-
Filesize
1.7MB
MD5c6a39508dc9b05cea342ce38380dc16d
SHA18d463126ce792de1f2bd84c821587793048e4aa6
SHA256bde72a6eef9c880c5291ee61ed923dbefbea6ca3635bbf6f82963cee30d522c2
SHA51206b2ba2d30b00d9390952c935e2e3abfe79a467c611066a55d78c904b000a0953afab6b0d903b5d21c6143e815b2a4fde1ba9c0d749f844c4820339c26f25d19
-
Filesize
1.5MB
MD5cfab439d06441572cbda17472a63125f
SHA1b07b0d9fe7fc81e382a30e0aa5d652a5c620dd47
SHA25661fceb40878282b7f25711cbeddb4dc68d41b638f8432ed3352287da2f7c70a5
SHA5127aba1be072c63ba914ec48c9f45050ac1bf3ad6f9c93e5d845d70fa9f029c52df0074a088c4f171f8f065d180e5adcef628411bc7b60dcd4b4eac67d34738f02
-
Filesize
1.5MB
MD5fc251deb115620d665226fb0e7c76682
SHA1c04c70dee2779620d19381f1fa13ef313f59821b
SHA256400e40784e93ff9fbc22f5a0336308d769364e661abff6914d0f5cb37d2d4a6c
SHA512c2dc843367578c9bd3d2fdcf44e32c4fdf1495ec6899dc0333ffa30ea02c9337e2a81a2c43dd232783d2183a2f73802eb8c33c8dd0640629a427c8405adb65fc
-
Filesize
1.7MB
MD5c53a8cfc5b08afc2743b6801a1951543
SHA150d4e67937b90bfed5f11a76d34f2c657b7bd04f
SHA256ed36598a4c43479d9ec919c45fcf313a029f7ec4c3d3efd4575f18c322fb6241
SHA512f15c1c616ca81932177fdfb6434e3d6d27c3d602681939a95758c612e9ac10ff37b0056626a4d529787c424b55889e04c1d272dce760db3457eda34402454bc0
-
Filesize
1.8MB
MD5179ae86de8382bd3452efc9bbff09bb9
SHA1427aeb3d46cd4fcd4a63c6840a51236189f8d50a
SHA256541da999cff7e644266b7271774b4db42af5ffe73d65d60409ae70c3ed751776
SHA512789b831bab09225de0c8f527cf287f6c626804d78db375c5567e0b9cc1c16a3f9ccca08ba1c26d08d54b94d69b55619432d7509f080e79a4c6c3f08f76d29a86
-
Filesize
2.0MB
MD59207aa2b70317b5db9db5bafda3c2b9f
SHA197a828bfb34337a37a615f222a9c6ccf9590915e
SHA256580ddc947eacad75d8dcd61fa3a64d17030f3bf345fc0a483cd415e40ad9b509
SHA5129e4ac99eed8b56c61a37916dedc59ae16d1e62fcde7c049ce2c099761f05458c9f1c06abef1cab0cf96dd74d5c3874929050034cbb4fa82400f00e10bc6066e2
-
Filesize
1.5MB
MD5e693fb3d609e57770055ecec57a4f7b5
SHA1936c1faaba5363b3085dc655e0204042cf680a65
SHA256b22d655312af243b846b958d5c1e6ab7808658f81e7a16cdead455eaa853ebab
SHA512ee737f3051d699d9155f79c273352ebc5fb0b3390f26a2e88d128ff441a0c56bfca63475edac0884f6209d8c7c328bd3079d0994553db2679a4802341995ebd4
-
Filesize
1.5MB
MD56a39a736640d1ac4dec7fed4f74f9dda
SHA1a2f9d4e28222c31b1df349fbc6ae9a6a5fd4c5d1
SHA25680469cacb4e1395820b1abf68707e4a29840a389a122ab37ce4658f7aeb86a67
SHA51238c1cc639a747166c17d3fc8e9972a76a4b3b43c72c400a7be28f03005d7dcb36ad9357fb822308d13d392a077fc9cdb5a4b545969f5d01032cf7c842741db6d
-
Filesize
1.5MB
MD5780201cf9b31cdb2b4d055fbf54a84d1
SHA1cce67b69a0c5e72d530728a64e3f6280c1ee5205
SHA256ea3ebaa458bea78211dda1764cbc3092c599b543dabb7f4df915b3c46a6d6611
SHA51253a49a0dd3cdd5c83da61f63893fd438f5a9138da90381ce1518c0a42cd68f71e95626c7a3353419aad4d8068f98f8d06c432c39b37f500eb1be6f22eee65cbb
-
Filesize
1.5MB
MD57e623adc9c9bd872a3fb28d2f0e6ccde
SHA1895b80939c5a5afb9beb1bd0afd8e469fcfceca8
SHA2562214b74a9ceaa4a0eba2d2cef983022386cc116f35f538ea856ed49b16dea908
SHA51213e3e903c695e75e910a673f8b4ecb1a59d28c790edad6c987f03a8dd47a69bc37c4a813b2fa04f24f1ad4d19bdc7708394741b4bd314377e016183f095e4f72
-
Filesize
1.5MB
MD58d6a7137289498fdea9a7da3aef2aac0
SHA1bc2b990c3cf7ca150c445162ed9a82b242972010
SHA2562f7d5f1012eaaa1fac086c6f9b59e741c016eb2d5472f8d2584fbc80169c136f
SHA5125b8a2026f832b73b373040da53a5923344f927ae2f75392a0f7507311370af175d7c75294dd604bf35f1d06112a0396450a2985f6d25fcecca6d2070d5de2950
-
Filesize
1.5MB
MD59808f6e7aa85913715086fd281a4c492
SHA1b0efbfdacf5bd6a36e37a23ecda083c494a8e4ba
SHA2565f00dabd7acda191a19b4c45389e4a54818cd5645d4a86b3a142e4a4ccbfa1c4
SHA512e0198fb577485bf638fb102518063abd9843d22ebf950475a5b30b3796d2a9f07d530fe62dc26ba4ab3e28df31284ce77da39d83ffc9aca21439425a1f8abb1c
-
Filesize
1.5MB
MD5a6a555ae9347023f3d6de2d9628c2445
SHA17afa6af6ec5b15c8c64bf909c58ccddb793bc674
SHA256e6d84d098080016d560c8699262455883847e1dd5a98e6de177dee0cacf73956
SHA5126f3aebc4033e735f50a1849689d4895c90cc8dc7d794a48a3f365faac84729b0f916edbacd84de246fa7e6ec4278bbda6f1e7402e288b46b598f293a7e7de411
-
Filesize
1.5MB
MD59de74183506ef1375ddcdbcc58b0d3c8
SHA17cd99ff06d698695f12da0d583e4cf5d7810d151
SHA256024b2ecfb547cf77a99202fa1317e4a26dcab2184314439065d5ff4be7aed698
SHA51211c93ff3ff0222a0f9d5d983548321b79dc33a4849a0440878602fe6ca8584fc3b89cc623e307ff7b4a2cff71b7b88ab97f890f6f54dea98dded67be961df141
-
Filesize
1.5MB
MD58fd0e8fbd6d21bf242555cf73adabc5f
SHA1299991e2c53fc904650c47076d9f3537c65304e5
SHA2568cb6f77392a62fa952675569431b15579c47f0781e652b8671075f28b09e2432
SHA512aba68f4eb9b8282cac347cd5e5fe573619d55ba0386fb120f9e88b98941ab1032d06dd35f96d4c7b31bb6d64c4c2cea3dce26c1a2a7d05427b2704d796b1fdc2
-
Filesize
1.5MB
MD57328ce5dcf91d88c234f9e0c0b325f3e
SHA1f012a79c14dd3366247ba311dbbd3ca50d50a3ae
SHA25630d21d0d1c54804c26625c3af5f2486ad231c25d0620e6d82c15c8b08c60b7ee
SHA512f69335f620f3d2ba7169c7a897bbcf36ac068a31e6f880d9b62b93e446fd7b25985eb8222ecfe36391b5b1e7f80f0ce948dc5da952d49bbdfd56681afc3da2d7
-
Filesize
1.5MB
MD563c5e64b0fc13490d583b9b887142446
SHA135ddfec10151cd4555968c97ab6ed8aedb56d4ea
SHA256e8b243e38cc8af4aad87a71e7c3eeb57ddef8863837174d484e673f45a818eb3
SHA5125a1b45ab9334cc078ffb84b788f0445dc55b4c9827f71887943d92f38ec7d56beebb457b69d42b26bbc8e87dd3c019c2dc06c76b4b87d31389447ee14a9732e0
-
Filesize
1.5MB
MD54be1c98f1c6d05a36ee2900011ab2ed9
SHA11513fefcbb91e337ed85b4bbbee755c22d4a7c83
SHA2567ed47672f0e073391fbc599dc6376f2329e4392f0bce399200d907fc43bc52a6
SHA512e5c3589b4ee53cf2adf12b7ad15ffb9cf2eac0334560d4998df4535499eb16fd664cf890e7e547de69e31c6f188f4dbac5d96083402a47efc190670809e275ee
-
Filesize
1.5MB
MD55bb9bdd02d522b35441cf40e11e29156
SHA12efec0a1e47978be9722e5050fbaa09508f81404
SHA256290c84bcd77af90f1dc95fd8c59f8cfc8e716f3e037c4075366f53c524118a2d
SHA512535844c6c9aca4aef59d9fa656f00844f81f173fe3be18f727acf7eec4bc7b444956168a6fe8a2571baad3a51dc39f836cc586c449957078405e723761275400
-
Filesize
1.5MB
MD570b93c5557e90c48c0733737199c7742
SHA1f525693729b3ca481d769ce55f6a1c0bbf5ef082
SHA25655b91930e98eb9adf7a8dce098593c733f46c51ae4ae99bb225f1d515d0025c5
SHA512f8726afeb5626219147ba3d3736a621010e27989acba5ad4ca450aa9428d3603f3902b576f078eb6207df047332c5b89a4be57c7252753a6d45fe44200f64c96
-
Filesize
1.5MB
MD531cc0bf18410321abb830b1427d2bb73
SHA1761ce197fb3e61d88b59700122fcd0f6410a89f3
SHA256de2d8c4fded17b858010ae33bf7d2582766b519c04149ecb6a11cdbcd3c0f9a9
SHA5129fbf4eb4538319ae926115d135090ebaa2345b8d5bab4152a536cca6b334cdb256b60111a379b4a1f30a265188caf3a411aa0120a01244c26d4cf5622af0e3d2
-
Filesize
1.5MB
MD568688978a6ca3b1b33d89647d063e473
SHA17df8ed6ba332f93ad0490fa3028b98814192a776
SHA256c66487d287c06ad4b4279488cf249782dd1b5dae41578f3334f80503cb04015c
SHA512b0f73e504b0d519c06acfdd9c0071649417d20ac139143f473f795596633d372e769fd3386aa619e0ce0cae1d03c39fb52c65f3be81da1e27f662d91e3b8ff9c
-
Filesize
1.5MB
MD51beb29e1fab243fcaddff6ea07ffa2c9
SHA1ac0ac63c3dde4d247eabf59afecd03d7444bde7b
SHA25679c42d4b054e6b04bae7c09b352b78d36125b49fe297bee0c40197e579edc51d
SHA5127625a4bcbfb420b41211af9b29a427f9f148f13e551035f35551386872d4f60be6b6ff29f7e3945835fbd426d3d1e48593733ba8a08255362a639ecd3a17ad9f
-
Filesize
1.5MB
MD5c9ba2a1bfab5661ea84c35725a1be483
SHA190cc8350359e1f5388717d8d654c72c6db2bdff4
SHA2567806bdd0af409bdea7be39195c7215429e70fe6adfdb16cfd399429c00ad5139
SHA512ade1afe68b053f3d189eabfadd996917cedb0cdef66be174ca0737db0bd2a795079b03201c86b705507be5526ab8a0735c732dde75dca3eca0cbb6c70809bbce
-
Filesize
1.5MB
MD56d7b032ac17cd408b11df45e7c1ffcb1
SHA135ebd6ad6478f1975064a13139b2fe81dfe18bbf
SHA25633391e1c5e0b81db0b069da319d0ae3eba675aa1cbf43b4e1cf1086a441f72b2
SHA512e5ac2357f02b2198e8059bad6b324bd55b10201ab2a9e224470989abe393459b09d7452ec3572f573db66d0b58dc64d3bf5389e981db74992e1d07cdd8a8b38a
-
Filesize
1.5MB
MD5d3dfc32c5f41a218be9120760c2878c5
SHA1feaccc69874d34e0cf28c908238756039bfdf70d
SHA25642105aa4958d51122c3bc007d0a83ba4e3775c45612cf4c11fe8214b1e64c8c4
SHA5126eb25026d3bf140cfa98c18570a94df7c59dc688512c73c6fdd38b29084ace468bf8f5ba4c3c71650d27c19c37b507a1f0bf5e09ee5f4604c7908d8e90d7180e
-
Filesize
1.5MB
MD5298d5e6779ca949f6b057924df7ae21e
SHA1e4e7621e530822a1626cd5b3418c3353107bcbe2
SHA2562fcd47b0dd02792d06ffb61c5bd3d22f166b22da5050b8667372f9bf25d871d5
SHA5124a65a5c8da1717dd5e106b2dfa856975182142c7aacb0aa2e706022858dad7a990b0c39c237593d142ec2cb7cb445b801365474076368931b76cf72115988a0d
-
Filesize
1.5MB
MD5f80149d22f893db7c8c2c2b33d8883cd
SHA1b74447431966d56d47ede03fe774fabbcd0da58d
SHA256f730a189bfe6ca8243d449acfa6e5e880f705702140662fab78ce1b26f64e992
SHA512761b6e36d947f0b7e3e01beb6c50fe641dfec9a3a286e93b5357b50ffc5758ce7f05f8b72ffc5568b0514633e0410bc903e62da80382e300f42dcafa7e9b6455
-
Filesize
1.5MB
MD5d2aa035c7fd65d54fa0df8dc35ef3bf3
SHA1ce884a3d77b44eb017d07bf54f4ff9f0f2ee90e0
SHA2561e42db7847f70232e7e02a32dfcb9577a6d25133b34b994c79b1eb5f85ae86bd
SHA512ea01d8814ecc96a5e8bb3829035d3942c5d09a459748d315b7e49edccdbb9badc72115cfe4a03d308853a0e58c9d35841e8e083b17351c60ae7fa1810845ef3f
-
Filesize
1.6MB
MD5cc761f2e24f33b06b62db03fe9546616
SHA13f132898f3f6724610e059a47f9c5b9e8ca2ac5c
SHA256f062fb53f05f9af92ce25cbc7a864b09d786788dfc52e0c51ed02637a74f7669
SHA5129f09759c2e4f3ae09f484eba2c0a8999d8aed3e273515db275e8e57f2bd07bf97aeb346aa8df8e073b9ab0e8ffe7c539e5eb8e03840bbdf6ad3366030918278c
-
Filesize
1.6MB
MD5511cfd4ae44c0d2cae6bb9ffc911b831
SHA12789aa5187cccd5ce46adfd62e25d421ecce4677
SHA256073eec685459b97b0bb29b9e1018674cf76602b829f1a280e8fc4c4fb8087352
SHA5124be3b3301fdc716ed60757a20488bca6e033ec74c63cce7fb7c848780dead0c5d26b6b153879f83f69d6e01d518e6095af706ec3f33a46d576043bf4d6764069
-
Filesize
1.6MB
MD522b07b858b5f3322d2c0cf580545da02
SHA1cd27ef6f5e5775f95c0f65a733b28f4e4dfb2976
SHA25691dcde71a6966186a4a3c65c19a24de52633ee51e5fdf63e0af6488c2c5f039e
SHA512a81088b133226e2c854d93c9cf4ec050c62e04bfc17f1de83d4152d509d48843a8909d74882571e42a0bd1801a556b98eb65803d169bd20c706ea69e74335bcf
-
Filesize
1.3MB
MD51c651a9f9f45731afa468d126e0ea627
SHA1cac1c5693fbab7e6c5c25fa95a756cec28fe9924
SHA25601989a9b5909f30f59ad0e0856d0162a6003e1114fb3e509e1fb0c7e4beddf2a
SHA5122bc294a49afb8e8fa1b43def9b01a66bec2010eaa05558f16cd2a0d205b9aea5b6e439366e3db4b46cfc46c364f9446703dbf3a0b0a05db4d858f3cef8f398df