Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 17:57
Static task
static1
General
-
Target
2024-06-11_6f1801ec09251cc74e3ab7ea0a466ddd_ryuk.exe
-
Size
1.9MB
-
MD5
6f1801ec09251cc74e3ab7ea0a466ddd
-
SHA1
89259e832b4668ff0fec63c11dbd2cd4cfe8a1fb
-
SHA256
a41d429e69938eeb1519b471dd19fa177950e744707ec9f38c36f45b00600a94
-
SHA512
a4db97d7cf5da0cd07a8a886f1420d219ba2c8ac1cf53e3185ba4d4b9070607526400fe3117e9ca4053a9c620f8b83568e53097ba446d6a6fd416c1ef5ddd696
-
SSDEEP
24576:478r8FfC3F32nUnCdAaKu++nOt6LaRFdGJm0Q3WKVSwdr13Ek0VA:4/fQF37CGaPi6KFdi2Ga9x3Ek0V
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 4064 alg.exe 1312 DiagnosticsHub.StandardCollector.Service.exe 5080 elevation_service.exe 4916 elevation_service.exe 4532 maintenanceservice.exe 1172 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-11_6f1801ec09251cc74e3ab7ea0a466ddd_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\9ebb5e1fb4b1389a.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-11_6f1801ec09251cc74e3ab7ea0a466ddd_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-11_6f1801ec09251cc74e3ab7ea0a466ddd_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-11_6f1801ec09251cc74e3ab7ea0a466ddd_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1312 DiagnosticsHub.StandardCollector.Service.exe 1312 DiagnosticsHub.StandardCollector.Service.exe 1312 DiagnosticsHub.StandardCollector.Service.exe 1312 DiagnosticsHub.StandardCollector.Service.exe 1312 DiagnosticsHub.StandardCollector.Service.exe 1312 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3160 2024-06-11_6f1801ec09251cc74e3ab7ea0a466ddd_ryuk.exe Token: SeDebugPrivilege 4064 alg.exe Token: SeDebugPrivilege 4064 alg.exe Token: SeDebugPrivilege 4064 alg.exe Token: SeDebugPrivilege 1312 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_6f1801ec09251cc74e3ab7ea0a466ddd_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_6f1801ec09251cc74e3ab7ea0a466ddd_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3160
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4064
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5080
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4916
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4532
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1172
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD580ef880061556207bbc3b37e4183a4ca
SHA190057cb3098ac30eecb32dde38d848ea649fddeb
SHA256b83b165589c90df6bf9e37087c5fd6b6e0cab937484e31c30be6597afa6f97c5
SHA512b797166bf0b3c08844c1d11096f64599a1c8c9a30ce183ca6a590f832b935c7765437c23f009d3081baf44226ed9d73ea05417d871255f1e731904603f2de1f8
-
Filesize
1.5MB
MD54ab00e4dc5acdf52d90b47bddedff24f
SHA19c358693038f25ce17661adae8c3aa20b74da8d4
SHA256d241f0884bbb9774169917ead3e62a83854d2788c3ac6a7f7dce39b742a3570e
SHA5125ceed97426eb182a229ad0c8ecf4c6e676e5742336d6e86ad65234b82aae211227e6894563dbaba89b6a99a528d1bb781f56c454f880e939aaa8ae37e5ab7257
-
Filesize
1.8MB
MD583568a10073a4f4b70b83cb86b7aa09f
SHA11ec6eeb6464ac874489e38aa5f6659d4812a1c92
SHA256dbb7b2e8b671e540d77a7f133255d07841159283a278b544b85496202fe47eba
SHA5121ebb93922612b289f1c3c05d6cf94cf306e831ff236808ac19731a7486670ac909c1dc93ff0247d1f95530f5875718d31aaec4f240860dd26613a1b2a0d63099
-
Filesize
1.5MB
MD50f2a44602dde5365b624850aac04d68c
SHA1d9c58e39b0e445906fa5c6aaa99c798329106282
SHA2568f24d23c9ce920258062be638d9156420ca091b9e175b603c9196d91babd2c86
SHA512a47893286bc7ef6fed7423db6d84caf67f21a499876a0ec994b680d1e74d9dc1928d257aef954669cab8c4b1059d03a84e52df84ba8c156d12135406dec9b2e8
-
Filesize
1.2MB
MD5edf1967fc42ebfb0600299721bab5229
SHA108fdd851437db5b03c70374669a69810ce160c13
SHA256b4cb63a39784f3afb13ec194913fda46d0db42ecd336be6e85b316bfca9d9938
SHA51212479bc1dadb9b56300ac18fc519d2382d1edb0eca96ee7aa03d7c709ffafcc6fced53b968344da3b354549c6563db30ef8137d3268dde444e19d9cf2529984c
-
Filesize
1.3MB
MD5e3367dc536e27b9a4e38422f20adcba1
SHA1a8f3164a4908661b09e4abe2a43aa36aa481f41b
SHA25616fb5ff26c1b211fd17b250a80bf5476aa9f9008c75f901d869d219c33cbddf0
SHA512d3d2a9b34bde60bbf34e82ffc55b84fd6144fb5a64a9b98e4af5ccc1fcc3e2f19cde9a59609d2e338d39b61edb5886f7ba4e4dbacaaf0eb5230f53af7ec5d72a
-
Filesize
1.6MB
MD504301fb5dc87cf14ac3a0c4bc8f318fc
SHA10a511b602a40968d68b88fa3987887883380e6d6
SHA2569bc48f59b90a52ba69e0684987d9e6d47c396a52c4b4cb33fc580462752c0d78
SHA512960094ae97de38a6f053b86dcf2c4a50cb4f4c096e1d32a3cf138df4a0942196440e5068242286a3ce9f0e330677e10c062d2607f238ece9992b9a8370bc3428
-
Filesize
4.6MB
MD5539d8de20ecf2024df7c2c4791b50452
SHA185c11853f41b80a4d779ab8cb5a1058d6458eea7
SHA2567aedfd3527a5b0ec48c8bea58302513ff9655566727f42305271f6f7b2984a21
SHA512f4a8937d754286f9f2a078ba907d00d6ec4f96a2a79d9a071e2c4209079faa7ed798256674f962f6e7f05d9cc885915ac9e9c8146fe7fef607c2ef9cd6f80644
-
Filesize
1.6MB
MD5eced7e963c8247dcb1272cde37eb7572
SHA1e26e0478cfacce6c3075be4b5f3bea1c020ed870
SHA256cc2cd9e4dd48a45112b015b56f2d64edf05e1fe5e2666ef57515eb659f253545
SHA512ccab89c4aab1f680bb4e4069dc365f23de9792a50e5defc018e7656746b76271abc6205143cf7f732d7acff77995554fa7f6dc16d4fa09134bca56a7cb302b4b
-
Filesize
24.0MB
MD58f07a8a4c33395cce21b0329d2115981
SHA1f1e9e5aa02cd0a4da01cc9f7f261764e09155aa4
SHA256a49ed22613bc64f43497d08dd6e0ed2f1b1a9e7ef1da7d0be67e45c04ea1cf3a
SHA51288539b87ba9a19e8af8339e2cedfffd6856ddec0ced5a4bcbe27250c31309e984e37e796cfe71573df7e6c7a6767c4063b51ed284f636cd4eb3094601e61d932
-
Filesize
2.7MB
MD52be9a4900364a43f499d84d7e004c7e8
SHA1b023745d0ba95d50895864bef4a253eb3cae1450
SHA25673b4f033c338600ca4467d18b03977f75bd7a4b026deef15e1add157a095cd67
SHA512259355ff134691c96bfc6ff152c982cc830a501134bcb1ba292e039bf3a4a455958ae05d457f5717d04c6057b824c2437c8c04b6aeab94310ba08e9c0c01d9da
-
Filesize
1.1MB
MD5add238a509a2f9ba87ba3719ee8704a3
SHA1bc2e1021dcb8100923cd53e47957e7f9d022e207
SHA25645766a0375a9829537337f6bc73b0c6bfde65bbe87b6c1e732143538bf4bcc93
SHA5120535c868ac7e029fddbbac5a3f01a6c029796febeb44df97ca9f8c5ef82ba563bce9c540d9b451cbdac591bd881d9ee7df611888a33d8a7aa3797f1d2411ec4b
-
Filesize
1.5MB
MD50e84b4a8332e26797c27f66128950685
SHA1398e89c7584490847a02033ae17ea087c118f988
SHA256366af27cebf7775562eb198f13ff6e5eb173ac83e9f73a61934fc6ffebcba2f7
SHA5124078a062de5c5f263c5f73c2cf53ad90e93aa542e4cb1ccb12ccc1518e3f7cd8cff84bc6cadd13ea5bb0625cde49d79d8fdac05c316870c0ecffc19cdd7af115
-
Filesize
1.4MB
MD53dc564e3bcd3595cd171930b995ac5dc
SHA14565bd63078a6ef9f4fb51f00802d5143ee083f8
SHA256edc81747ef696cbf214facc24b2bb2aa8fc27702747dbf1c7268b4660a56c7a3
SHA512604e3016265a0541bd71bb0a8fb57bf061cd62cb24ae45defbab5ef378469c184dfc393f97d3937eacf7519d94216482b8fdc0faf6f52590d1ed14693895e939
-
Filesize
5.4MB
MD5bb85105e8920f2023c022fabb3431868
SHA192c6bb22349ffbd1efe39b134ef7fd79bd6d23c5
SHA25679e38446c90ff82c8d2f53c979b9e9793bdd8081f3e057df95c55b03ea4abd44
SHA5122ea4cdb032ae71a37244efa3c01bc2b7119e32149e3a2d95e6131af491664f9f3b678eca4985b3264c0bb96745504fc9d43eeffa031f6126da6cdc44eda3fb24
-
Filesize
5.4MB
MD56e063133d8c60929583484b98a807f32
SHA1ab74f840e6610d345a33ffc3e1704986d75520d5
SHA256d550adfbc9f08012293102c94081ceba0ba8368478202db5e443913a663427c7
SHA512add82e790567c304fcaad90e8e6fa6e0649d46c295999d3eb9b2580f88674fd5e98955f9190b67b60176b7f752a8f3d4958eb187583c683c3c2163ba50f92885
-
Filesize
2.0MB
MD5e605695db1d04f5bc4ece0abbd0bc13b
SHA122a78848040f4632685ace127a07f4d3d634bc8b
SHA256d35197339b5cfcdf03d5c7f1ee0d8872efc6a2da3dd6a8bf182b8506c0113d0d
SHA512ab78db0628b13d678b308f22725d9a573b06a14cd4685330ba2a8423b0f01ad22fcd41858879e5148b0884ac90a99163f2d99813f088583c160981f8565b1354
-
Filesize
2.2MB
MD57a843d0c49d12afd6bc2b3b7939f216d
SHA15aec723803d0ff3ef9573609fc4a61f724b20a75
SHA25684ed2054801c175e15887ef6d9a111501192965df861a69ecd387132835d2a27
SHA5122d41ed9127542b94c8fc492d05d190a910bc28243c81c4282f6618640501dec7acfbb2e4f0625608422b73affdb05bcffe595f7e8a601cc391a5c9fc3716eac8
-
Filesize
1.8MB
MD58e6611073cc7fea5137b27b5274c2919
SHA15833685ac67ceec5a65ecca2de218a911ba39fed
SHA256f17c6f8d2d06c45c1f7709eee03b8acc1812d2234570b2c4aedc75ba22090c39
SHA5125e863cc6646d2644cf6a0d1360192257296289b53bdd63e4e5f33e833f7576c1ac5fc57a56f064ede54b57b5693ffd346a93e1f496aab375d36f470409985e00
-
Filesize
1.7MB
MD541fb8404981e92401dd5e23222e2ea5f
SHA18232b9e5ae91dd0c4f644445eb2ceb44c815801d
SHA2566e29e8be93ff7a3b41a4a20fa9defc5e7f1f6c1fc13b2e3bc076b32dd0dd6caf
SHA512f5466aafb9a049b0ceaf501c891cbe4d114265b805b9ac0564d5c9647c0cb20fe4ffa49d6c912d623a602cc4e17aec568ff241dcfd6e2ceae60278fa4299b6e7
-
Filesize
1.3MB
MD5a086d630442e91615097e6dc82da3f38
SHA193604d5f34f42b013815cecfdfa0c8378dc8a95a
SHA256519d3791e33cb7aeb7345393a8412a389d1b927099449b9d3bdf48ec18f96226
SHA512740138108c9d4664b05ecd0d45bf0f73e6614848ddbd45a3b93f73dad6ab6e598dc375a46200565ff22b79c5d8355ecbfb62b94c8a2d89436dcc46d78e7b885c
-
Filesize
1.3MB
MD52ca41dfb240ef208ae4d7e22e4ffa7f3
SHA17d6d6d827301d46c8b5268354f902d7650fd9a70
SHA256f54032efd57b521e28ea0f66c8d468ab7a0610bffdf8954d243ec3b665cb8d98
SHA512ae8e51afcd7230d044e8234a2b46e8c01486d127110f81e633e0ffdddf585cebf53e3ec52cdf7e4ec486e9467d0b2487edd27216a6610053983e94907a79dd2d
-
Filesize
1.3MB
MD540d2152233f1e51a635087b28720a94d
SHA1d38147825a145c230f71829e8ec3fce09a3c1c7d
SHA2560ad75bcd10210321da22ea75adb9eb1d9807b67d5b9c73001a3729896d2c2097
SHA512742b19fcc95c2210f9a6f1df1db06d8fd904b5e7baf14a3fa0fc771d22f128f02a9e12ab89d8e9e01425e43a1ee5dd0de49cb723b05ebc68413797e0bfe14a6b
-
Filesize
1.3MB
MD557999b88d7e8717b9b7f70c72e335888
SHA1e0845d8a31b45b6f622259508ffd2496d1e90bb7
SHA2560882f7799065bc99917a5b03d95650f72300148c96e98f700cf6fe0d2aa8d762
SHA512dd45a760642d8bc469544d5b653f0ffac74987862f122faaa2d192e681742f3142ca385d3f95a826519f0f1f619ead48ef7f4bf39cef1ac529d3dd1cdaa0d661
-
Filesize
1.3MB
MD50281e679432084c3d1cab0016ca2c261
SHA1ba628e4583386ff0effea49ac2932ff9f740ae96
SHA256f401f631a4f32479499dc79fc846bf95b5fa076bb3b01a6d32bbd91328b35cf8
SHA51285172d84bce46928b7c65e7c9251cde4b4329a727059ab4e2f5626a98ae18043a5d751beedf2085fa4ddab737ce853f810eb4277cb42385b6cd10a87a8c193f9
-
Filesize
1.3MB
MD5a5e3138ea30aaa7d1c553aab2f4ec6dc
SHA145e57971c9317eb0714403a2f1ec5e6be0357c74
SHA25627d046f14e9f53739a83f150f6376f5549431dfeaa239a210686897e3d04136f
SHA5121f3e53f33f40e1e31aac0a29fd3a75306cb43ba90da9dde3cc8e32f4bb72d8d0177796b9561916a46ff813815442880d33be36395f17eeed9c4fb08aa2b3b0fb
-
Filesize
1.3MB
MD5202130de11cbcfd3248b91748238e791
SHA10768917287aa7f2b6c229efbdacd0264eb12a05b
SHA256967260d4d94da0aa267ef0177eeeb64369ca22167ce3b60f91bce5856f108efd
SHA512137b37cc2034f46cd1dc4d145318da51da2f1a41d83438f8a26c201782b0fab4102a49b02252eabb11add6964bb24e8ef8d15ee5da9970758a002add9d59618f
-
Filesize
1.6MB
MD55acb5563ffc39e12ec26923bdd6a726e
SHA1a45e2223ac15322430f7a68a60ea82f27fc08e3e
SHA2568f1bcfb3f06adfdaf27c74b71422401055a419ae1b2290b9d9481099fd785de6
SHA512e3e9ad8d2c5d04af0265852810376279778da4ad2b1caf849eff79b87a9fac905f36a21a13cc6592e44ba80838a57132d199959cd128aab5198d2a37073f841c
-
Filesize
1.3MB
MD5d310a4f4ac3d71058204f443bbb456f0
SHA1d395c8df308e032f5299ecdbacc40f4da22ce60b
SHA2562b08a7bc970c4946117102b81b74abb49d2705ad7813216b20d101a772140e23
SHA51299002f27d218a9be42f5712e469214c5634394a91f23ac83c4b51c7d6fb7c4f4147e4de3b4fc3afd1ceb749601a0dc30e6c4851944bfcd02e54b50f5fe2013a5
-
Filesize
1.3MB
MD5255a20ae70900ec5c29eb3e03be5e9c0
SHA13e1a624d36c2ec6e351825932bd0d86ea8737246
SHA256a1f7ad8d6d317d204e8ded6b45c4f423be44d6fea233bcffe44255b19ba59e04
SHA51208b936d1e1c7497a1525cf99cb6255b78eb634947abdf15d93425edcd76d90426e0941f1cf1974425f2c3d141fa8a505b1fb8e8e4e0b8decf34899e25c1a50f8
-
Filesize
1.4MB
MD566d37c9ac79686da7b6587fd8a3124e0
SHA115dd0be7398f3cb616d79c879b9ca0f74e817345
SHA256d04394cd5d48e15e3f8fd7c1ddd7c27645a0cbeb604b6dc920e22b47eba48d8a
SHA512a9dd54caeb741f29894b4b6b21647389cdcb73823fe1c045edace6ce5b1f90b06bd8ccbf9e488566c2e74fe553b704e4d1c698775e97a1a12e9088c590e9aeed
-
Filesize
1.3MB
MD55e94a4738abbcb97c8c411475f4099a2
SHA12fc36771f039d2d2dfc7a0431d3fd06a4d225d92
SHA2560ca89fe9ca71923f1c87a38483c1b687c758c338fa350d1da137cc0503b3e2c1
SHA5123cc3e471027ddd3f221d0180df80cab47c25b6a43d5afbb60d6fd0b963a0333927c0d807539f91fb7edcc8dfd63cb18184b06e590ced7eb969d209c7fb2ebfd7
-
Filesize
1.3MB
MD50cc2bf0a61da6db150d63f0755671061
SHA1905272638e89046d4efc66fd9972e3b32efe3a08
SHA256fdedac0111e8b8456ddc35bb46548f394c1c208bef8ea23d6fa8e6d45f72c532
SHA512aca64a710d0a45386ad5925402943a786d935eb3b8e988999c583f3cd9f83a0d2bea34a76b12f5ab5b235ab3adc24494cd1d44f23480d7299e125d10ac9a3969
-
Filesize
1.4MB
MD57f15155544c79a291c51b50ba1886a3f
SHA13714cde2a338d7baef05db4f33ac03867483360c
SHA256d082eae13e3330684744fcda12e633cb730c2dc7c760e0fb7b71afcceb997e22
SHA51266734ca9b32b7842799db7e124c7b9f572f25cdbde8d5741f8c49f29a0c53d328d46e3e9141f5ca0a83542121f1319c89b1aa3d8219eb758d667eb73ddc1b734
-
Filesize
1.6MB
MD5b86dc06c5be2bca378f706c64a33c53d
SHA15638dedb637f56f09f5c917b048b6010e5d4f636
SHA2565dfe001927eb0092481a13ed1338a9074ab832a8257af00f497858665544d160
SHA512587a50160e4a0c84a53e2bc0ba894a41f042d7137b20058d9ba08e9750767f7a7c38cf372fab27d50955e7ccdd340c22b9eaece94301ba88a86411c1326394ba
-
Filesize
1.7MB
MD5ebf30db258d8ec2aa72ffbc7a96b8301
SHA106c00fc4d47412dde6cee82f8375036dbd18e9b2
SHA2568af4c83d7e730b6b61b0f25bfda7f28986c43695236ab9d394fcea2ebd7188f3
SHA512d68110e196b2fd4f0d7917acdd3dba68f14ade552eb4a4343439deeb9abc076947c02cdcb8cf884b91c1d29ef362f778aaf1ef41f432d85c89b03296adff46db
-
Filesize
1.3MB
MD549fc5c1b5ddea84c8801069d0cd4644d
SHA157ed396be3c9f874650ec1f7ecbb58b26de21cfd
SHA256599c78750d581c149c22e994f98d4d5e010cb90e9d37a9632088b7858e6187b9
SHA51276e5b864a724ba9dff6478d28f6fe5e47232a9fbbc351deeb3bf0eb502044f58eb88dee160b7b2d5be8e957e82fba6746c04643460fe3ae5c0c83d087f01abae
-
Filesize
1.3MB
MD5da26f56a340563a2a237eb1aa5f981c5
SHA1f68c1e883e1b2685cc292e603eef9c10a72aa50e
SHA256c92a6ec8f1459c2852ce43d4ec9f22abf660306152de933f8142270a813d4a2a
SHA512f3db492b8cd383851574c88ed1b37cc7a8b1f68e8cffae29f17bd84bfe8e396ec77b5ebf54ebe65ad82dd51f33fc0645ff1ebd3ad0eec168c194101105ca719e
-
Filesize
1.3MB
MD5694b29f1eca7fa7d6e0d52ffdc696dfa
SHA1303e59e89012ff395b68a75f3ed3a9c074b8a82d
SHA2569c42d210e6b30aa1115a48bc01146c5687ca59bdaa8ded4d53856c93b3a85e7e
SHA5120e654adac8012fcf1709a7b79d528a71aa1e9fad01a6d3c38b2ee95ad7ccc1241470915f923a5577b87a3b80ccc682fb44a8488526909d14173647576cb27a6b
-
Filesize
1.3MB
MD567ec61a8c1bee8d3e2743aa113b68f1c
SHA1bbf48ba6da3b29c0c827468c2da75b04b7a77e48
SHA25601989f188382b7412b279fa882f1afff046e4a6a985dbe1ff9c8f6c8ebd9c560
SHA5127f9451e1b4601fa9edf039e36c7f024bc0f5e69ac8ae49440d44c35ac680964320bd29b6407859864c3eb9b8f6cead8ad944656712f4be4c57083435c665d2b3
-
Filesize
1.3MB
MD50bd8fc0f7c5f9538130f630a2f558e39
SHA10b8b8e4b73bc0e9f2c36b96f78720efb36a0d7a5
SHA256654557310fca781d4f014b912bfe4a76c67be72b035e851bf121f847fe2cf744
SHA512edc7db4765acaebe9c7e8200a6c924ac1e91150767bcada1a955d459ead4e3dd9053c14aecb0ace49e216371d5944b9ac2bab9eca5f8ee8bd1354af3558be5c5
-
Filesize
1.3MB
MD5d52add9fa4b93b1d494204fbd5eeef95
SHA10fea18f384694c5747d3500e705f6f88617f24b7
SHA256dbdd2886cf1319e4b2bcf5ed3f0d8496442f4ab7595b5871ee0e54e3f6d94a2c
SHA512af5cf69d881a16f3d483f0dd1c90394f920c1eacd743a762d065d67792dfcbca83b89434ff0e9453f7dd66e89e6f4f0f350fd2f48faf230cc766fe7d40af685b
-
Filesize
1.3MB
MD545c0c495cb0761b10439d9032f050890
SHA10dd1bdc3b7241571602ded2c396591afe6b33bd8
SHA2560d09314a0452863e2967e59d0f904c36363bb591b6914a61bebd3a852637f65d
SHA512661edbab066578713640d29cb4bc06cbb0b401b0ac493b5197b8519812379f1e19be56dbfcab62f452f71dae533845a9628d11ace67b11768c95ccf7a398a2d4
-
Filesize
1.3MB
MD555b0082199e56a6a55497f4716e11679
SHA1701b77f72e3119d95ae874e019b26b081fa719ae
SHA25629bbffc16f6b04908fcb99f0c693686d0ca0484bfd41a695474dd83907479dfe
SHA512622bb41d4278d7cdb1af1ccbecde85f05ff7fa4ef6370455c0e74fe8c87eeac22e2378f841224f4624c30ff76d6427cd5785c40a0b5fac6bbe300ce294c2540d
-
Filesize
1.3MB
MD571c56be3639e4ed7b1d1cef4b9434106
SHA174e6cd60db09f31a8bd27ba45627486aebdc0098
SHA2561b35344c9f52b153c19db1cb0ab3ddd039f4e536299cda159051de6d55a32c52
SHA51250b7b5994d621d963b58b8689fea77b540c3417f0277e4088e23973fd6875df4e8557a7b3c39ae28235f66d0649dc0c5f0c11e85abe81c380509dea71bb41856
-
Filesize
1.3MB
MD5d2aca91191d4fc795e33f5ba016ca941
SHA1707a33c42684a7c907c47af14c45f6a8cae48991
SHA2565a0aca2ab6da875f812eb6e01c95002cf7bbff6827c936f8e674f232ccb250d1
SHA5123f35d0dc0e3179db1dcbf28a7f7347273e1984d05986e421cf834ec26ac2385d8ffb83f62531f67ed857794fa9ff07311b1d732d7f2a081018d345134ca17da1
-
Filesize
1.3MB
MD5dc5999b8b4cfc7cb7d814166bdda055b
SHA1a34235a9d79a8e67eacce9d4ffa5d54026ba54a7
SHA2566cb1a4b3a093938ff83aba2dbfe0d8f7f4e55767ee428e4334f0b057f8110092
SHA512c08b11ef68fe460c7adf619580b97ef44e3abde5f1cfafe98c4ef1bf69d2df769c59936701b99e7862889be9492b06f955b665ddb6e86fb80c9715fa6ec30507
-
Filesize
1.3MB
MD5fd7a14ead89fd27a88944d67732b3088
SHA1cc0b658afd44c918f85a15a9b8de954b3f0f9cf6
SHA256771b87be9ac51a5b7a0ad8b4376bc243e5828f55f092fd447af5171abdc7e904
SHA5127cfb462fa1340676c2a11aa31aa0bd10338b1b55335300830b3e84b0dcbc4c88c689a2c02c339139bf7e59d26529808746989e1d4e19f48f0a557e7e312ccc39
-
Filesize
1.3MB
MD5cfcc126108fb44cffe5f699a40ceffc7
SHA18396f1ddd24771f4c98d9c18c3c3aab7542da7e7
SHA256aef7c92ea4aeefa9021543fcffcd8f678359d8e387f93b421289b5e275e2778b
SHA51267294a37552ded0e98d61d6d0199db3316b1880f72afc1210c30607fb115ea8736e789d1d27c4fb8842184cf57d57bca4eb8af6fdfcaa0fcf925b935e74c0694
-
Filesize
1.3MB
MD5f45eb37ab2670ebdcbdf7fbe774c9935
SHA1633791e152ad87f4a1a62ef554fd61d8a314deaa
SHA256a5dcefae9082bfe6fceef00c7a6a341d627ebd4e8d30b90bccd556667b0179cf
SHA512bd42af11bf04170b836d1a5a645c1f1db77dba24e0b4c697c9e31cb2286afac41bf33db9270aa1fa98e8bb30165245754a969fed083161f083361fb85b6d91d9
-
Filesize
1.3MB
MD558979950a9ff17173dd55e0cf65754dd
SHA1e9789f3b1a355869026d7ffbdef971d34936ccbe
SHA256d4670f7a17bf116337bb00e9088f0a9557dca1f7e7923323b53dc6d7ac40c4be
SHA512978e18249bba8d1691e1b885017942ebc9c96c54e2437e8c3a95a4523efc242752fba85330b698e78c4d76e83686d2da93ad51ff34c2ae309cc3a2a6a3c5bab4
-
Filesize
1.3MB
MD55d9e83159acc6204fbe67f15a99f719b
SHA153eeb535c9f9228e5c4dc82bea05c8c1b0c95561
SHA25658326c410d74da462758df473599fb1b2f74b55070d57788cdf6e22a850e99da
SHA512fb269a58416eaf66dcbd35c0d34d651e9830bd81cccbec93df5d16c9520cd1294b45a03415a4835a29bc4fe2816b638c206e9bfea66464e774b566ee677d3a51
-
Filesize
1.3MB
MD577ee4946ec575be584be8aa6fb2f1366
SHA173c06a33c157fa2b034d8e078a74b9fa3cb3adb3
SHA2562329ff78036a358ca1edb0ce008d141269084894e318c1e33f812f1d8e0f3dd2
SHA5123f4201bdeeeb84898d416f5d7b382352d9f5c04f21a67cbaae871e52bba761dee1413a1b5639addb13b9921d52034d6899fac54a257de0dfb46862900d43b2a6
-
Filesize
1.3MB
MD599efb3758079ba91be3f0983876eb5b6
SHA1d2c364e51de37c732e3f4a614494abb673ae43e3
SHA2561c675818a7f00d5c331c29235501d02ff18b2dab8bf39406425fabcb5b2b0e75
SHA512ddbaf88cdf6e11210886f7d3220503c8d17fadcd5c981814184200d6adb8b5d21d5bf90b5d7b647da0adb72d00918dd39af81aee85f25a1b8ee3a3285fa84b23
-
Filesize
1.3MB
MD56d8c0608eeca36e9a706fd910cee7cc9
SHA19f8ff195ed95c82d9c923ffba237c79de5074b0f
SHA2565b5025dce7a606f23ef836ed301652fe57ae63a926dd64ea9474da930142a9b6
SHA512bea024faf4b271ec3ce1c7c23033d9d2cf79e5d207817c4dec099458237b66e965c221939988a60785f02eb9aa83ecf50abd43cf17153c74e117878572f25085
-
Filesize
1.3MB
MD5dcbf43ccf238274d4c8e3e663f105d6c
SHA1b6f21dc51c8cd698a98d6660d1955e3c73dc6ee0
SHA256001ce77015f11af684a3d7fe4d999f1d64c8bf9dc6718fe49303182830964322
SHA51269de0558fec8163fdf258574e8044663c87564ce4e03d84857842d98b6e60373aab6c17f1dd0fd2913390f7a9b4ab95fc72ad924bd858f3334df858766de9cc6
-
Filesize
1.3MB
MD591f16903b436e01bc783c3e4f950a22e
SHA189bc90408eafa23e0f0137f713ce0d8b15ad967b
SHA2565819b7e23fa95a53b498c67a4c815f026a57048a88d60d135a431d1e7011e69a
SHA51233db8a69413f0722fa2235abe6494e796616fb7dc2d2d82464e70c7f0127c6ff974abc44817cac3d3906171aa6ed03162117c893c1d53752c2ca993de5287fbb
-
Filesize
1.3MB
MD5a905b36104e093d1b545d4059564b8d8
SHA1b60c26c63f59d281d18664c06a4a70b66b96c404
SHA256494b35f8f69a1ea12df583c1a470a356bfe582675c9a21c0d717ed264d8733cf
SHA5124f2ece8ecd5002483002a5ff060a684d7c7cedc91760ef5364c6e16fb9576db259fe8c198452a25e9bc21b19705acbddcb6f94aedf0b25dca01d16ccc97db814
-
Filesize
1.3MB
MD55f3d3baf0b11d72a3bfcae4281687976
SHA1d67e4f673bd1b0c6a896d3f36c1f5c64bd11fd71
SHA25640f83f3ac4e38e1a103c8a619df68bea435741903ac187efd6e9241ac5148135
SHA5128165d55de1ec36e90aefb969d11c885e319855b4e5827f0ffd098b9f7f0aa08321b7357d8db2d311dfd800f5063a140badc460eec03a5c2b223879b236dfa207
-
Filesize
1.4MB
MD5b8170a560ce0163320f9bf9a544a4724
SHA1641c935d905e6335523a5aa1c3b8e52046d9bcab
SHA256ebd93a5d9c775b9ae9cc4377878bb4ec660567e106d31e48a04a7a74426d578d
SHA512d5b648e8df61a8b871ec818954ff543df33601fdccea268457b78e9c77cb29935070a5a7ff8ce3a6e27ed46379cd36dfae7afc9ef2709c277a718947ce2c823c
-
Filesize
1.4MB
MD5a93311c1a74e5e91030a2fe59dee16e5
SHA1829529105765e377c1eda291c19a6302c5b30ac6
SHA256eb474171cdf4edf27be1945491963bd1a790dff6310dac559795562e5529ef41
SHA512ce285807757bf5e3f42d50934c0b05faa87e4abc475bfcf864007bc0a7247a4cb2472cf437c7c9968c6ddcf0d1a6d0913f49d69de01e2f70f6e45271f20dce11
-
Filesize
1.4MB
MD5964a556c5824c8b4c8c8e6a90176a275
SHA149ab9038dffe825298ec0e25e7981e87595e11b6
SHA256079d24f7472eda8c53ef1ab8b5459db7ef09fc0e059b801090785bc02e5b3f0a
SHA512d95c70915be9375dd17e5564f15cc467a6855bbd6525a5d7b6f1a910264b51327e4275d9b3ef01d8d748984c4b31d28f1aa90942a96e3f9a57ef948472f2651c
-
Filesize
1.3MB
MD5a76780fe0fd2e2ce38b96fe703d59a48
SHA16f0bb51a9357d6938e85f8d7af4ee588fc7da9e1
SHA256515fadd2a7a3565b170f9b9be802162816c8b79bd5764d2686eed898f3374f6a
SHA512dab5f5ae18b98e538c1b25c0203be68a8387b3cddcd4fb3c36268aaea63535337776686211b128d17742fdea7c42ffdd8f4ccc19186cdcc562ab8fda99a994f2