Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 05:38
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-13_95bde05cb1bcbc3addf1dd2843a70cbb_ryuk.exe
Resource
win7-20240419-en
General
-
Target
2024-06-13_95bde05cb1bcbc3addf1dd2843a70cbb_ryuk.exe
-
Size
2.2MB
-
MD5
95bde05cb1bcbc3addf1dd2843a70cbb
-
SHA1
28587834d76dcd823de6a13c9eb664bea17bbda6
-
SHA256
cb3a0c328eca83e1488d564893355ee98e80e6f7467577aa2b53f963a4d99260
-
SHA512
ead9b0bff3e481444698cceb1af7a8de5f7543ed413d11d99db256c46b7e780b10376fa4ac11a2378dec42c3f9088fb89eefad2f978766d3a06ae32058c085d3
-
SSDEEP
24576:OOObVw4TaN1wdFukCba4oXtgLhU3wEdmh588N59y2i1mvpA03XumWdNlTlvz:OOOh3aN4FuLbegmtGtNa2i1i3XqZb
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEpid process 3032 alg.exe 3316 DiagnosticsHub.StandardCollector.Service.exe 372 elevation_service.exe 3012 elevation_service.exe 4912 maintenanceservice.exe 396 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 9 IoCs
Processes:
alg.exe2024-06-13_95bde05cb1bcbc3addf1dd2843a70cbb_ryuk.exeDiagnosticsHub.StandardCollector.Service.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\da08f72a293b476c.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-13_95bde05cb1bcbc3addf1dd2843a70cbb_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-13_95bde05cb1bcbc3addf1dd2843a70cbb_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-13_95bde05cb1bcbc3addf1dd2843a70cbb_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-13_95bde05cb1bcbc3addf1dd2843a70cbb_ryuk.exe -
Drops file in Program Files directory 64 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exealg.exedescription ioc process File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\java.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exepid process 3316 DiagnosticsHub.StandardCollector.Service.exe 3316 DiagnosticsHub.StandardCollector.Service.exe 3316 DiagnosticsHub.StandardCollector.Service.exe 3316 DiagnosticsHub.StandardCollector.Service.exe 3316 DiagnosticsHub.StandardCollector.Service.exe 3316 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 656 656 -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
2024-06-13_95bde05cb1bcbc3addf1dd2843a70cbb_ryuk.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription pid process Token: SeTakeOwnershipPrivilege 4712 2024-06-13_95bde05cb1bcbc3addf1dd2843a70cbb_ryuk.exe Token: SeDebugPrivilege 3032 alg.exe Token: SeDebugPrivilege 3032 alg.exe Token: SeDebugPrivilege 3032 alg.exe Token: SeDebugPrivilege 3316 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_95bde05cb1bcbc3addf1dd2843a70cbb_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_95bde05cb1bcbc3addf1dd2843a70cbb_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4712
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3316
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:372
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3012
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4912
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5bed3265501f35d34bf4c990092ec920d
SHA13bf3e71493c1f7ba4a7bb96abfbde5b6d0138898
SHA2566090c66959265c950414366fde56127f03e257165ba4b9f7c21327363e5fc45b
SHA512fda99456ad36c37d532d2072d28ba41026e926ca44986133fa975af70a4b327118b11530ce22f1ee6613a15e72ffd531e4c7aeeb24850b76197755426dfe9f4f
-
Filesize
1.4MB
MD57a35250a997fa744dc79bd584a19891b
SHA1b8525ade26de57deb738068cbd4c9094454839b8
SHA256c5a892ee80211f49696ee4aa5f74148b2b582a7659e3a75c712a4bf9525ab278
SHA512d093c7e5b7d2ca56c163e2e32af12757970197f36a5f72ca071814257156486c288c793f6c62d3c5460e4ed089d6b6818e8953dce1caafa283238beff3e6f389
-
Filesize
1.7MB
MD53ca096585e53df1a5b764b510f6ddef0
SHA1f79870e7633d3c39b684acbb0cbd1e489be6cc04
SHA256c96f5d5f5cc4e54a737618a2a4f9ad74bd7beb1bdf2933991fa327e06cab1dd8
SHA51255dbc8a92682b557455a0eee53c45ec128ba97e8785d828cd62cbe9c6b40ff7b6867ed9763892bf6940ea45cc150b558cb491885c434bbec4472239f14eac902
-
Filesize
1.5MB
MD555804c96078d4dedc5282d09022ba20d
SHA196141d83ae74e1a21b9495cae40953248841f3c2
SHA2569841a20d205d4c5ce5a8a34e64bc842ed972b4ee51afda8e753d9e0f873bf65a
SHA512d9f90674f5d476f46d871d30341aa8b782afe1a473941c556f377e795f8cd1b38bd6bea037a9f2109685f15d7c9af1659de0c28a1cefd49495b48e98531be04d
-
Filesize
1.2MB
MD5cf2a6b7b6c57fa447b4e247793794483
SHA10eb21b7372ac5b2099f2d99f36e1d960fa982140
SHA25691a9b1668ef26c3a007346d00e53ee541faab7882129138e96a1aeaf3680f7ee
SHA5120d0ba99c859907602ffa6bb5371afee320bf981ce20a9e2ae6e944ecc40f2a7a9d9c41193b538ffc928f09e58ee5e2cd628d5a230aad9e6d4b212826d83c0ddb
-
Filesize
1.2MB
MD5bbdb9cfeda5bc1728bc6fcac8714defc
SHA1bd11e53bf656ebc8bf58ab22ebce004e4195c011
SHA256446c31aed7217405b4796fc5f20d0818cc2416c6b0ac2eb7248485f9f6669ea4
SHA512f70bbbbef7baa253a6791956cfa15bf3bf660633dc403483215652181a679f7da11fc8dd5696e284d28a109cf1e7548a45938167a0ea4d2424c6a8d9d3c91e38
-
Filesize
1.4MB
MD5e20d0cad0457dc1145750b0751b8c8be
SHA1b15ff3762086ac36e675b946acb78840cb9d6589
SHA25672919e4ff1fe6d63962040668a102831b6cd9dd3c11ecff6c340080ba22ac6e9
SHA512c26dbd8a35554ccd0b183da7a9b3ad25965c5e38600e836cf74591e08bbec7a443bf169b73549150ac7228ea8345a75d7d409ae88def6233de14b95fc41979a9
-
Filesize
4.6MB
MD569ada8f6d8bae52c6dd7c2301656293e
SHA16bdbe44a7e9e3cf67e2798dcb91c61541c4c2a9c
SHA256dab0547e4162be15d4c5577c594909e6aec1fb76f0fb9d839b5d5bd078b5e365
SHA5120fb4b3a91ed569e13e758d9c10909eeb2dfb5034856664e1102c571d521b7f48b4caef4e358b62e16c5e87c7b0d109f80fa7b212d4d10663915c47e514d75cf7
-
Filesize
1.5MB
MD5fa4e62095294fcd7a6f502bc1a60df85
SHA1c0f25261489828458043d03cd84f04619d615b20
SHA256b2a6cefce83348e9b2539d45e85ddbb26329af2c8ac24e05ec3aee75f52fb572
SHA5123ee3a196247821b5cf1143ec0bd18c751068f73a7ae1c6532c3cf70e7dc7c4ff9c4ddfd044b545748fb923b7f06f7f361cb87fb30bb1863ef765f8d9d66b3b41
-
Filesize
24.0MB
MD576cc958a7d9ea6b64b1e4e7ca053a221
SHA1d13458b4ebcb78c6d7e9b3d63063371289927a08
SHA256a769cafdfc1d969e3af2c468c687851f8156b1331c000e4aa4257491198ac237
SHA512550205c1aaacf7031c450d51d9caa1f8f42adc941ed1d183c19592bc96f4574422ff45412e511ea6fe7deb9770a9d97890da6e18b0b3b0215cc839cc79a89d4a
-
Filesize
2.7MB
MD5e5e52cd61954832c3c9afea5adaef79a
SHA1d76b844a11161dffda4398d90d77112d9b2ea66e
SHA2564b3fc3518423ab2f96f11f02daefa683703c10d5541c26a46495b4dcd566e162
SHA512bc5d9b40ca3fb60e781a5308503c80890729da39021ff4e2ffb7fbdcdabc6e9f619bd2a5620c3f91a8ac1cef1c71ca61f9d802dfdf888c06ef6bc0dcf2b46bd2
-
Filesize
1.1MB
MD5c69535aeb1d8e0946bca52959e9fe18c
SHA197e745aaee05322f2256b97d784aab8af0684412
SHA256562bf9cde1e3b409071792053ccba125e3b0a37d01d88b6fe1ac97665ea268d4
SHA51229782bd3d09f6432bb6662c39d030b160e045ede79be629f944976d018407ec109078690596983d6d56006b1d2a25dc45a236609ea607b385507fb01c0271602
-
Filesize
1.4MB
MD511cacc106af4e64cbd1d64eef05549df
SHA1f38dfb62829eff4d5315d03586af78712ad1ea8f
SHA25679770a734fc02afcb67c6b9ef8564753cc816223e26d2008876d611c1f057d8a
SHA512ad44ffa56eff5a46994348530482f68b574f3783f9aa6c0a31fb64e2c0a6fee297d506732d052a06904f74b3f57f44c06450623b237fd122cb7ac41227208f2f
-
Filesize
1.3MB
MD59b842b45d113344cacd91872eb1719db
SHA1f8338addc6d6e541381f69dad8e36c4b5ae22936
SHA2560245f04f5c2a3ba47fabd03d7176843c5f188741c2f97bbcdc829a58b0389088
SHA51208bfb5c76433832ce955b23e36dc068d688d732aa46b565c21fe470b5bff75e88e56c11493f8fd5dbbfd43697e2d1da44d5c6e267bce70e41b5ec05daaa0a148
-
Filesize
5.4MB
MD56abec6619b206afbdd83c670380ff7c3
SHA1a040ea9e4fe888a572ae24496b5c361efb257086
SHA25627273042cad1078c904a9fb7b594e9b46e79c65eaddbef09fda87762e9abb2ca
SHA5120c3a9742dffa0a409580a3f1a8b32cf75f2880ed01dab6457717f545d3ae993ad63e8c40931d01e4a2e1e150bcf2fe86140ab76872c3fda1939ff7821a133908
-
Filesize
5.4MB
MD547322728cce40608424e035ff098138a
SHA1ed7dd06901e55fa07cc7f21c709aa0dee4c9005b
SHA2562893a8de94ee1fde6d3f2438f448df1032a5512a2886642eca4fab6cf5c78ec9
SHA512eab8cdf8a81bf4bf2b766264f01d5d5a2a171766f71b2ee0861af8f4ae3e93b8d250b40343086c02b18971534f04ef690fe978153999c60809b3cfc89ea8db6f
-
Filesize
2.0MB
MD5e0c4948fe2a14fc90c9970542ca6040e
SHA1cabdc4ab9c2b13ff45d6a8d861a7f1bb7efa0c23
SHA256844c355f87b472f3e877a8dfc211151e479b0e2e0262e03ed57a0e442534a24a
SHA5124cc0e8b2ded2aa235f30812ba7259c8608560882a53030992c06c8af533f72353daf625b51692d45405dd50ba41c00b0072adf90aa45df725d0c69deb7cb58c7
-
Filesize
2.2MB
MD501e1977040ab128a56ae2a5ffcf8c354
SHA1d1fb0f2c6c53ebce17f402c8e83bbc0c2927a24d
SHA256377e925becd02b8a7ffa7f21dbe2c1aa48ced4d0d6ebb667874f75e3eaf52475
SHA51271016d72dc64f2b3d1b8fb3b37311fe33e1087c252dcfe0ea8aac3ebc5e12228743d3a54d639a4dd782a0b8e9d509768a8f1915ae1388ac39487b5b5a31e0cd3
-
Filesize
1.8MB
MD5aa1a3ed85d302cc1292e6fad96584aa0
SHA1f22ce354aac959f1c3552695bd9a0ed1e0c334dc
SHA256cd32c75853ca9a991eb0c73222883b0da42090a577b80428d5d53423dfe3b7f3
SHA512e34a4f1c10adbb32204fc15e84b1deb3af71d6f325280cf2c70c6ba6843198851b33581d98c2f5b902b89646cb378c20b740dcf0a163d2e7e357837b996a4d80
-
Filesize
1.7MB
MD5744439f758d09c45df2c5ddc99888f3b
SHA1716de7940291fc520ec54c44433333f4f3341472
SHA25674c6831b829aac38bd12de259b9d0861168ef8090a25bc6876b654c9a7c583fd
SHA51230fbef1cbc13101b7ad42f0bf20c780b401a69e7ae793daf59bf6ff4d461b2127282b2991c5505b15ddabd479fe06d39a2532c812bddfac399a55553681416ef
-
Filesize
1.2MB
MD574c7a423187df2b32e190cf86c5c5597
SHA18be4d26ffab1b826be353ab9552d6f2d52ac418f
SHA256915a724b86628b0c7a9e70931760a87d89199bec4223c8c9846336f0e0c84699
SHA512b6aec02799a15b3594756552648d2d943d015be9e440d1a6b3de40ffec2f0659af92b5e5d69869252cee899d2e84114285afc7f3e9e72a774d45af76ee0e882b
-
Filesize
1.2MB
MD56775481594cfdd2819019942158d7d21
SHA1abe50800a9c4bb09a855f6ef7b707d3ac5c058aa
SHA256d521fa27e442f8df26fa6b642af6fb719dc71ab9415f8051eb268e0688cb26b3
SHA5126ee082dd716f1de39fa30daac518533e10a580382a79848607444eddbdf6308c9c8fb8b35f3cb6ff85e4f36f8dc83af5cb37db6e4afde09246d01a8dfb2d51fd
-
Filesize
1.2MB
MD57ca211c3a61f2b49d206fb855d93cca0
SHA1985d8b5818de212d8faf36922593ab37b6ccb811
SHA256eaa48189b9d2a8ed8e0a74259155701fdc2e5b26aa72069e9e29a0698a2a6d7c
SHA51222896a60d1b1321110f340cce330deed584be052c49cb653814539aa65fb664862f690e393b5da53d9bdd1625fcda87cee49718f98573dee31b0353aea553ce5
-
Filesize
1.2MB
MD5a8b387418e92b8e2f8a5a9144f3f09ac
SHA13cff61a92773ed1e557d0417aba9c9c494c45b41
SHA256c63a9331c5f9fb058440716753e9673d31f2c0fa35970bd89667c0b4c25ff74c
SHA51227413227932e3f9fdce28a2dc432a4c64d6e6b76dc310d6c366fc78560e471373b985384373e88fdf2f215234bd1c6034eb9054513b5a810506af73c0d0b7069
-
Filesize
1.2MB
MD5545f6a59c313ff278ae9cfd16b8460eb
SHA1efa32f2e2c71a7758da37216c77e106c46a6050e
SHA25617d9c21137c5c4c0a09d242acf966a1b1970280923f759055c4e1491ecb5f564
SHA51248fe72f0963e76a2dba0654cd6c242f446508e102fcf92e2b22a92113c02919e40ef987686e1a6fbe42854afa8e180da01b60d597b0150a0dac458a5e598e595
-
Filesize
1.2MB
MD579cf9b65711e7473fc4d9e9d096924fa
SHA1e1021f053a4772c7a376732bf19d488ebc2c15e5
SHA25619303c0af80e6a34b30335298f4d26313d826a9d950285106dbc2a7975dce93e
SHA512d8fcb31e267cc0a7349730ffde34ab8d5b2cdd973cfcf0e741ddc8b70128c1cc5692b8d1349291bd586d30bf294a070972d461e27828a627c6ec00a086b51c83
-
Filesize
1.2MB
MD573510532488ff910710f73494c1ae5ad
SHA1e047ce4c6f0de6a0749dd592383097c9c55f7dbe
SHA2565b6e94f770304c694fdd639c5ec25a8b80c6e2b025698175ea969ce3a34991f5
SHA5128d4a7794a7ffa306e360038154bad78e4568971e07fc9a70c48bb78568930785ec541350a8318c3bd6f537086e698bef4915f8755c12a49bab13829de46eaabc
-
Filesize
1.4MB
MD5ed27edfc40c0399314825459f381ee1f
SHA1e21753fe67c604f0870eb5d275a166de0925af1c
SHA25673e75a0e00133b1a1c6951711f3bf62c5f00c30b8c037f0f2803c6d04dbbe61d
SHA512c99799b5e8d33aa5d97d22919c6fb9cad25f6898f9289ea6483be16dfd459d8fe5636bec2558efabb06b305932e21b7c266443f83696971022d79fb86a1cb7eb
-
Filesize
1.2MB
MD5fa1f096d7e3205339f467fbafc29146f
SHA1b8ed682cfa6da6edd117a32e22b1662f584bbe3e
SHA256cbf81db3414a9552a2883607a7df5b428de69cf374ed7a0807e97d5eb3487412
SHA51286f924fc42e4ae0840472a5cb21fa05a62099bbf35113e29b5c9fe5867d2b79e092e6621f3fd35ff5f4708119fdadfca2513e491139dfc1b3f67140b882d02a5
-
Filesize
1.2MB
MD572c0d11612faff9ff8c6a4e3dd321853
SHA150b60d71300fb557699cb07826a6c52d64bb8ee1
SHA256710454e941f2bac19ec8ceba709d9af1f5c040ae7c8aa7af49107ede793ee62f
SHA512955e1ac128952e27a129d05b87bf2a0df02d42ed5d165330e0f12b02bdb165900d7ca1337e99e51c32b27264005d5b0cb9dad095b2a43a1cf8f6e566349210d4
-
Filesize
1.3MB
MD5a92691aa454b373d24645b0202a79780
SHA1518c4b36141c582698d7f2897e943a7b5908cfa9
SHA256199d6be86f99c4ec6e765f7fc82c566dde32ed8e12ec4582c0f24a7c36b13c57
SHA51204aaa0002c237f418d91235b4d4e36b47d1f75e11e2dee5f248aa41f6d77bedc4cd4eb23f350ef6b51db9116b99e162319ad7a5605492caf8c8ab8071f8fde3c
-
Filesize
1.2MB
MD5f5f65c4d8ee1b30eb77e1f883b131dbd
SHA1f1925125781febfc533134dad23bd6c0fe9bcdd1
SHA2569127fa903d72e2445c2ed75b1343c5b2bf9d2b8c7000e613c81bb810c051391c
SHA512852dddfc6c235843d6d7cda2e211ad639a809793899a13c14793b7e9d1927bb62c82821f66e32c0f984e486e9878efea39b8e2dbcc835e8119d29d8e0239e2f5
-
Filesize
1.2MB
MD5fa3419118dd533d83418b6aa6be9e206
SHA1553b1c486f3ca70b5bf93d54541b68e01330d6bc
SHA2560221fbe929516e569d4cff86bf5acc1ca7f684cd33b5af5b3f7b29de054be356
SHA51237862525af605e7be31ef73a4087e391be58425dea25bdce36fd0066724dd670d08e0debd9cc66a7e8910a2bcaf1f42dc2602939db577d2f0419d7814193e2df
-
Filesize
1.3MB
MD53f4ee4e0b8b2947027913b8479d71dfc
SHA1b93f435bca270572f335440ca5259c70bbf2baf0
SHA256041dee29a13f8c3eda8a4a28c5c7e0e31668e66390777a73a88086b50b34901e
SHA512b35ab85ee4cbaf4591978f4e3ef77f169cc17dee70fdb71c0c260cee9612042c5c9547d67b3b252f49eac6253a8722309b96c0b0785a8479f814ea07e6fe170f
-
Filesize
1.4MB
MD5b200f8ab641e1bf3ac5b65c35ca1759e
SHA119c588f5385145231dc62c4f8d6526261dc48db1
SHA25676c566fe4bb575c2d1572ff5f78641f50b48bb8f4011895eb2f1883b3441e266
SHA5128d241f25586dfef51147882b719d7ceb32f09dd6caf709e977a29301fa910f8c128f38c5bd70834889f7bb6dfb7fa6b178301cdb399cec7cfd4c49ced540fa11
-
Filesize
1.6MB
MD5c3dfe1dcfce317e5571dd74b383fe77e
SHA11667b464e5fe1635ce4d178b80db54eeeb20d5e2
SHA256d7e91a79dc608432f115c59e61e53ef17ee889090e34d53bd5c6e66e40a8f6c8
SHA51267ec3b5c6f26cb7715cbd9d7cac0d5895ae19cb97857643dc6c898fe70dfc3a92a95c89704ebe1aeb5714b09cfe579b49d975f1a8055106b2a078e9ff231498c
-
Filesize
1.2MB
MD57692b02fe1561ea152b1f138749f7291
SHA176aaff1f7f6c3c1e022edb5f404a38d57e9037c3
SHA256118954981cc10c885f80d523adfc6beaded5de6c47411663c91fb2beeb48cdd3
SHA512b7b70392570ffc6e3180388b5290ae659d204ff120dfccf143a97718a2566986dea522ce4801d5babb7be199d3738dbc5eb7be9bc6ce8085ff6b57784125f054
-
Filesize
1.2MB
MD591196401e9cf88490aba8f41d815d6a7
SHA16ebd876e9ad0bb82b82afbd8ff21580186663a19
SHA256652e4079daeab3a321f82bcb9df0498b59cf035e44d5e0fa51d81e2949b1acb8
SHA512eb3d3530bc11ef48b4fc89d72010bd63ff3d24e20987fd006d5368dc9ec97b2f88b57d0805b51a1f7902c48a1d0aace34bccfc03f799203665d56cd17b6a4f85
-
Filesize
1.2MB
MD5e0617d55d72462abfd6b8a8a644cced5
SHA12f84f22e269f08742cd195f25b2e91f1eb5367ff
SHA256d3b1c47558fcfdf09efdb95e5f34da601f5ccc136b39b6f65c826fd4367f28ed
SHA512b6d148bb385b61495b8b6aa12cc60ef90c3aaaaac1948d3d5bda58592244cf848f77e6cfaa12aadae68e072945502d52b570d0ed8d837948e41918ffdb0dd3a3
-
Filesize
1.2MB
MD5fb7cb775af2ed0227cd15b3253c8d185
SHA1d95d264c55a66a1b479fd501484c258952616127
SHA256493d29397af838a5f74e086022d2db34a777b9ee1d313db3eb1e402a3db71e9a
SHA51257fcf6e1babd515d8e5e19743ce6b983f7e1a2aa7a42a6dbad24716e2c94c7a8be2e1066dcbbd0d6ca00fda223b9b5980984e2860abd8251b4e5596c7f7e2c56
-
Filesize
1.2MB
MD5544b2ef58433b39a3e9eaa65be0b24a9
SHA139e4fdff2b8db5a71cee547a67d144418b984580
SHA25673db0fe6c50f8d23ec0050ddd678d08af3e2082aacf085e9a96fec974444451c
SHA5129f1110d15dae1b89ad1d11b621dda14e5bf27ce0ed4035a98f10475a6fa319595a09d131149c93222cbf0aabf007694e9dd56bf906bd2318eee4c2ae9685c857
-
Filesize
1.2MB
MD577ee4ae962f8c5abd25c3117191a35c4
SHA1189642e7caf5c79f63f8a283d5dc76f8172a61fa
SHA25652264ab52d9630a876cfbfa740268d58d8a22fcddfdae23836cceeaf304e80f7
SHA5129e29058ac6d0842b803835e032665e7baea5740223d95c8e66ce704ee75cccb252f62b5808e26ea94874cd577cd251cff60fdf6a73fa198ebfeaeb285a065a33
-
Filesize
1.2MB
MD56921daf34e3e59c34953417aa35be4a0
SHA1682f7e90246c2231c6730c9b07c77b34bc4d749c
SHA25626fade1ecbcc57b92ddc13fc421e93b8eb90ee261240768209a2aa5cd5e34610
SHA512590aef6619719b157e1628f2dd47f0d45bd4edd37fde31fe7bd109a79ee92a3b3d345198e02733e2c1b2bacec2894c258e1a7c8b109886faa20adf79bcaa17d2
-
Filesize
1.2MB
MD5e08021e975ee28d85c71b3ea43a9e173
SHA1ab7d85520071b81b9780bb2ffcbcc57d94fba19a
SHA256244ca031bccff5adf6b5db86c19e00d2746773fbbca4ce73a277b915055d764e
SHA5126f3bc9359037af9da6bfebf63b0be8f1fcc6b2e194f40baa75bfddbf821b3247212944e9c96ab2a7dcae62c7e8ecbad280cb6194690cb5eb9c7a0556afb1a0fd
-
Filesize
1.2MB
MD5b475a15a1783214633dbe59ad3eb87b9
SHA1301a2bf72e274dd6f2de9f1c192c8d83180d0368
SHA25685fa10c37b7f308a8dd8a1714e6b045fc7291ac98239fcb08f5af66a28969715
SHA51243888aa457c0f7480fd146ef631d07bdc51edc781e69ec4219aaac8f1b9ef27793620b9e99ce3e624c32a04077ebacd9f5f36838e916c0f579f0db30b3ee608a
-
Filesize
1.2MB
MD592fbda936c278d739508e052229fa282
SHA12693b4510cb90af66735a1f507682c4bdb2e5c31
SHA256df76c998ff36320b0f0579a5244df135d8735fe35f13d3e74db75e24722601c7
SHA512363566977692c649ab25081135119a4d742914f316b8639571eef4783fa7bda0d860d85f63c520ed1add8b56d95046416ae7a39af5bcbc76a30a451e94eb7cce
-
Filesize
1.2MB
MD59fa72df5e8f8bac3b00944ab5d03562d
SHA12cc8ad78dc2148fe19e777fb95a06cc00ab110e5
SHA256e9cbea6321493c8fa6c6b0ce6a583d2c1343616e3bdc3fb8ff9dab4041fa4272
SHA512ee9419340588f7c2d3c2070a4805917e3eff1a099ae5a4ad2d0816955eb3ca068d020dc75162cfc43b40af8f404a4238328136f177a4ec468a52479b9f676663
-
Filesize
1.2MB
MD57aa6d701ab128a7f92b1a27da417df3c
SHA11d3e7579a5c2e3dc1902b876c9b5df3d84f4969b
SHA25600e233e053ebc885a54f5f2222af86e94c7e4fd46ae7a499a65b8fb5bc58d7c8
SHA5123f699f96b7828c875f8e1be1e06aeceb9a1a4caea54b01630f6f9a08f3280e7579832211e7157b77eaaeb299bc9a3849e5031e2525bbbd660fc7e5fea2175557
-
Filesize
1.2MB
MD53afd52c23593672b887da8726f22b691
SHA138775085f65caf9b43a266461a211afbcb22a84a
SHA256af1ac8bc979b8616d43222de392366ac52ebc836bbbef6132418bacf6d80655a
SHA512fe52f82901e6e9607872ded3e18655bd4b3db0943116cc04bec8565bbf6d103822f276d4ac39160599aea15ff2702d9feff19a1f0c3ef1577cc243841227bc3a
-
Filesize
1.2MB
MD53f691d1b055b5252a2f8aaa4df945fb4
SHA1605aee963e57a22223ecd798cf20960ad77604e4
SHA256c46a79690e45fdec7fcc7a8304c168487f02120cbcb8ed19a6363ef4fa8cfd5f
SHA512c4a25bd846053b25065c30ebe50c731f4ca19840ab455de508d48351f3a4145e5cc6b8c8b53a434855fb9083378482cf248d7795020f211c649a9e69e825597f
-
Filesize
1.2MB
MD50c80242e34e59a6ed3abc547e4af6eae
SHA1ba17ccf29c13ae675c37b4a477a77b82d8bfec87
SHA256df814d521c44890732d21cabd62cb3ae9f05a6a9a256d15c584f5b3b362b434d
SHA51251471dbef33631b4d6faef4334fae5235c218eb27d776dbb71281add75c920a97216461ce0fb58c4f7a7594a81277cdb7f2eb14288c2f6123faf72036642d81f
-
Filesize
1.2MB
MD5a4af5ff50e813b8b1de2bd678e088f70
SHA15197ad88c1731bbcfef54f3a76462a1562979d24
SHA2565589c259fb0da8154606bbddc87e511a27925f45bd4d894d70c4a81fb7b9432c
SHA5121efc79828d7dd5dbc0f1e3c037258b50a8bd66eb17bb3f0a8020232d5245fe0408ea5f9f5924c2f70640736316de7c60335e7c6fea2310b2a851892f5490d86c
-
Filesize
1.2MB
MD594497e239e9aec416edd606ecb887224
SHA1da000cbeca175dcfb46dab2137a65cfeff2e3c94
SHA25646c861928782c0be1b8d05187d9838b87fb0ec96ca98eb47dfcb57b0ad22f0eb
SHA5124381fb77e1f9e60aa8d012045ed82e9edbbebdc608375d76719c9f3e7eb7c0732835ca23a5399d02fce66f79e71d6923a26ea8779c25e42c7f66cc0f0ac27007
-
Filesize
1.2MB
MD51cc736ebc96b62e43232a932ba83cb3c
SHA1159cd070d5a0342ea33242476418ee1b5a4db5b9
SHA256de539a8696b33697c67c3bd72858b491126b0874b9f98b43995ea2c6340871c9
SHA5126f64fb44731c53cb0fa41602cfe4e18885287b975e0929b00a6a8aa36d5377a3962cc45b129eeea9a742b19a26242b814698bf93bc2137e71c0ca48d999d28ae
-
Filesize
1.2MB
MD58b5fa8a2112a8cd8f459df30035c767e
SHA10cd085bcf807b79d9a8cded8070e9117ab843bf4
SHA256db90d9ad59113cc500ad2cd9dd8c251c66d7b5040eaa36814c13deaf2c984811
SHA512f207138243aa7aab8fcfc16b63e0696b929e1ba5e67cf3817d0a0ae8cef49cd9f049ff462a0183ca53f6e595972865d5a8e44e5ccb53c98374193b8b53b265a7
-
Filesize
1.2MB
MD539e0def206cf6e2b0dc189bfd40b2c20
SHA1af6b703d714305b2f75a910e3566780194e58e6f
SHA256f0c023e0771e07d4ed8bc9269a0b10803ccf6df1564848af8f4a51accebc49e7
SHA512bcf9008a0295dfd6130db5dedd30060d4793db3a67b906f28cf6e9c8914aa830de94f5372b7b55b4efd0a7a2131d39624b66c2fa373e865f2cf8b676a65da2c8
-
Filesize
1.2MB
MD5864807ec485088b86cf4c6d6865e6827
SHA1bc432ab326b73a4068d27b6c2c0501525bd21348
SHA256f9b5d25e5d44f7f1167ef8b0d367bb8d39826ec88598a376908f1b03d251db9e
SHA512c39a15595ed02fb376afd30a38169d741aad133167ba3a162ae996fdb679bdd5ec0623656b414bc5ff2cf06f14c16a01a2c4a01acdfc1b6c55780f5114e8f9f3
-
Filesize
1.2MB
MD5ec42344b443694890f59c62619bd420c
SHA10ba7f189db77b89954d4bc42fefc49b68b93aad2
SHA256541e1f60a3225cf763c83b4787d3595e2f7cb3470817978dcaa459f4a93f57f4
SHA51277cddd957c4420a703e5284600921fdf9909d60a039bf15bf33efce65a77079ba8baf88a9cacdad969ec3105d4bd0f3921b18f3681bbedcf0cd46260ee28d82f
-
Filesize
1.2MB
MD54c806f00b578b8fa820727f7b605df41
SHA137e983d82afb9ce840a033881660e28b9335cfea
SHA2565ce4c256deee2149f00cb23d6d0a9ee7fc099f85c32e2637562b5418fdc53045
SHA5129dba80704117a8ac965a5a17f5f49a0ccab5f7633664b49a1551f1032635849b947d012746981a0e063722a3332f01b98107f0140ed67623c055bcceab4ed719
-
Filesize
1.3MB
MD5ab232709b95b72d61167702a3e9b71bf
SHA14d7c5bab3ac7f408696d4435f17485ad8bb08b42
SHA2569396e6f1c5b7cc681cbb1eae27b67674f37afc38c4bcd0ef5f37f91e2fbf6456
SHA5129d8d805e4b52efaf3c1d3ea299a3290577e9cdf68e6a6ad62d9ea836cfd6e161491197faa37e2ad9fd2d511ebb4985d87ab428e68b43910db6013ae8c02e31ce
-
Filesize
1.3MB
MD565bd75016d4327f16c7053c10da633c9
SHA1568cb93022562dbe8ca6fed654b1b9b890b3689f
SHA2567f42c3954dd20bd8520b0b6d7ed4a9a28695595a46f56fa31082f0aaa9070636
SHA512dc0b57fd087d74116adcc204dc33c0ab2cc917ec403a75885112c6887db65fda069588e7c1b5cee62facbce78eb29de0978030635a9223827b5748c803a0bfb8
-
Filesize
1.3MB
MD5ea5742a420681ad2727d1575e2ac6bcb
SHA121fe69cad45bf3a5710c25c073f5120b1586eb0e
SHA256925a2c049ac3c75e2642198d7dbe0e40fe28b3953c44d75cb19a6d9165987982
SHA5129fc23b8ff1962383bd92ca095a5c9de88f3adb6cd17ce71afbd3b72c3d9a2c500de9feef8363b7aa42ad877c51c922c415a119df4fb5c5721d5796f3c3ee08ea
-
Filesize
1.3MB
MD5cb4970fb8b1f44bbad05da48fc5dd82f
SHA1f39c028000befaabfee2c71939e7572b2518d3f8
SHA2560f8956affabbe92a8649544ef683208dc7985a58dbf54467172a3ff09dea3e4c
SHA512300c88ffbabe31236843380605a433cfb96d4db9ef19c9401c7462a2e4b6097353d689b1b05f0f4c2c2e81f495f175910e63cd9a8430b638945f01ad3bfa8e59