Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 06:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-25_4d33194f16e0135f416095e58cbb5df0_ryuk.exe
Resource
win7-20240611-en
General
-
Target
2024-06-25_4d33194f16e0135f416095e58cbb5df0_ryuk.exe
-
Size
2.2MB
-
MD5
4d33194f16e0135f416095e58cbb5df0
-
SHA1
b4461095703c874bc090d7e85275996f282754b8
-
SHA256
cdbadf8d5974c16249c2fe0a23b5794f49c04eb9c5817f075d5eceb1a9d3537d
-
SHA512
0defbfcb841e7cf682851a32fdff6d9792a796f3ab936b0ab71399efbb4f74fa472c9df1f093354cd231f4bfacd3251d97bd3c75a62f037960926261eda7093e
-
SSDEEP
49152:tOOh3aN4kuLbegmtGlCks7R9L58UqFJjskU:NU4ku/ctUC17DVqFJU
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4268 alg.exe 752 DiagnosticsHub.StandardCollector.Service.exe 3496 fxssvc.exe 3692 elevation_service.exe 1224 elevation_service.exe 2208 maintenanceservice.exe 4552 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-25_4d33194f16e0135f416095e58cbb5df0_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-25_4d33194f16e0135f416095e58cbb5df0_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-25_4d33194f16e0135f416095e58cbb5df0_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-25_4d33194f16e0135f416095e58cbb5df0_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\862d0a93c3136770.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-25_4d33194f16e0135f416095e58cbb5df0_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{372EF552-D8CF-402C-B62E-CA3A4C643A96}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 752 DiagnosticsHub.StandardCollector.Service.exe 752 DiagnosticsHub.StandardCollector.Service.exe 752 DiagnosticsHub.StandardCollector.Service.exe 752 DiagnosticsHub.StandardCollector.Service.exe 752 DiagnosticsHub.StandardCollector.Service.exe 752 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1456 2024-06-25_4d33194f16e0135f416095e58cbb5df0_ryuk.exe Token: SeAuditPrivilege 3496 fxssvc.exe Token: SeDebugPrivilege 4268 alg.exe Token: SeDebugPrivilege 4268 alg.exe Token: SeDebugPrivilege 4268 alg.exe Token: SeDebugPrivilege 752 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-25_4d33194f16e0135f416095e58cbb5df0_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-25_4d33194f16e0135f416095e58cbb5df0_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4268
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:752
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3084
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3692
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1224
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2208
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD54105a6e811eb78e664e84a99aa26670c
SHA1a4f0445e0c4308d710cec1dc0c11ba5220595d34
SHA256e94209504693b38fe8fcc00aeb6c3a8e03d7516c0cf24372f668a7299898d819
SHA512ff7cee58101e495d81b7d7778f8bf9d9fdc830bc00b10c6d43c9ae20f19cdf55ea9038e5cbefd9fcbb79871f2313d5cf59f9fcc0bb707775f74d97529a952717
-
Filesize
1.7MB
MD5268f8dc12d766acb0ff88cc0c437af2d
SHA149f02eb4c3e514773abb94f8517df8f44a38eb04
SHA2569b27eabd262fdd924c4d5f9e773d0e2f31ed1338395730027b54cf1d35b4e61e
SHA5125eb5fb1bbe3a6feac58c176322a53d55254359be0051658f8707f4df6788f5a23b3592ab9ac2a491a8584a4e661d514333bff37758a29254deb6c2cbfc0c209f
-
Filesize
2.0MB
MD546ea3da163ad8f81ef408f6af8b380ba
SHA18088347c6009af79f053e23ffb98c609bccced33
SHA25674464e6490b255329d8a7209d49dd2e53561a9c2fd845d3abc76c27a35b01ff1
SHA5123162eb1afcc9ea628da92a52878fbaf109043acc47234aad5c3b7d5c3df030ac27df4796dc7564d53a59c175981a773b48a4df12779e172d37c3685e3f3f67e5
-
Filesize
1.5MB
MD5ee8db285b2857b59f1a68cef531b57af
SHA15310d98b60084a53a89b15cd3d860ca55e29052a
SHA256e6ee1925a4115987791d309f4ac88b45bbb786e7012748e8d08d9f2b4ecc68af
SHA51266882c44956c0678d42101dc3d35d7cfc4fefdfc960e3f2e2becfe1c38c16f89bb0205cd36a819ceb911194fb4cf1bd50e6c60be24c16943f4815fe84d8d3089
-
Filesize
1.2MB
MD57a9a4655feffb9931951354298869e83
SHA142e5f1892416a3dd903afc5765fd8f5be0ac28bf
SHA2563ce5c6015dcc174c2fa2823aafb6d385936e66ec9fcf2913f19f1e9699f81d58
SHA512870fb33ce0fc868fc4dfd84bb891f933126c34a3acfdfad827e8779e974bba8e48747904e1db01233e287c89ed4fa64ec595fae89d671b64f232e744df23df1d
-
Filesize
1.5MB
MD5f62e3a329a8dfd7a900870f33505e7a3
SHA141389205e7cd6eac79e063b3d0602e52e36aed3c
SHA2562e580b796d3d23660016539d784d333731d765cf15ed0a7b9ec38fe9772c9287
SHA51259e764d9ccbe0268b08a3cfd9ace6e21060b1dd5fecbb907b802b7dc54fffc7747a0e6f3f3599f70aec44919e8049bf6ec16e0731581b540d024915865688ece
-
Filesize
1.7MB
MD59fe6c715427a91c11951fa446c92d9e7
SHA19678f17ddbbd5bd9eb71642b9bf2b08b35ca3845
SHA25679d0e10f1a4e6029819b96a7101e52db4945d8a8cbd32252585c37e8cdbfb56f
SHA5127f6a9f9010bc3aea9849e2b867604cf88c8c8cf0e69f7d8614180d1d4974131a23ca51dd580d9dfe7016f43b191deb4f84581a24e457bd29e6b1c0b8e038cb6d
-
Filesize
4.6MB
MD51a00c89bb1a5f6a3f17359dcd84baf5b
SHA1fc3e9cc5330a4bda7e63414ed0c89c76d2b801eb
SHA25683356ab84e1e7abce68345121d15b8a12775200f691ed682daedae7957cab414
SHA512337bcfb149b0d1351ac5b7bec5ea488dba433d54ab507faeadf6e4e52ff648df049a42c1515a0d028199e0a92b22aee5424c3fcf32494f0b3b68b97cdd4dd702
-
Filesize
1.8MB
MD5678ec3704021e3b87f39d39b2673ca46
SHA1733201564bdfb1007c6dd45df69cc72a9b26f5a7
SHA256e08f4a91a180c4e3bc161b4769b720a3070abd16d26910f1896eeac2deaaba49
SHA5123e2891b89f754425263e20d0771e4883cacb75a4b8976768d73f00c6a2bb29b2e61998f6702f5655c0141199ee32ca00ba61927302d94ccacc43c199ef91093d
-
Filesize
24.0MB
MD5877da37f3cb1887b410dae3f856bd692
SHA101b2f548cf6489569f0c7b12f13c1fb29e06a215
SHA256bcb95f32ffa6d1b5bfb86afa3a2d7e96086a062b0f132387be0619b34e4cb4f1
SHA5121ac663a46efa0e224c7ee818e86492e44433fd9bfad23fd5f80e321b3e02dd5a2dc94f2ef0373eaa8da34f5fe155dad2a2230f1deafd3888ef70072500e79eaa
-
Filesize
2.7MB
MD54961b75d65b71afea57c0d1dcda8096c
SHA1927bfc83c1f35d37148a27843ac493b9ff2951fc
SHA2566688e89af2e1fe5965fa1b9f22dd64fa78b83996c0071a681dfed334782d8afd
SHA5121d596e61ba1254a8fcffceaaf10568927ae8a24816b9b69c43b41fcd1e3580fe0afe2df2e8de9de2944a5c342e06312339f994b65385f6b700e154c963cf9705
-
Filesize
1.1MB
MD5bd9baba9b7f51a68a63218c453d95192
SHA169668cd70e6ccea5b6acc67c987cd174675760bd
SHA256875f070c7d21b85aee883925763af5be729b41603bc093a46b532bfdd419f3a0
SHA512f947c380d237650590fb62c48eb51725d56c41a83bee9df83beb4addaa20cf88188c4dbbae8f99dadaa594875d3294eb0096d81015cd323c8879d55226991d84
-
Filesize
1.7MB
MD57f15268bd02d42878cd3a0815e562336
SHA172a569b75f5139ad770e81d9d1e4213a30090205
SHA256c544e7be689e09e0512c442b4a03d7ef360929324f375029ac7c498d9aacf387
SHA5125066e3fa1abc22c3d4f50638758a580523492f08e3e77dcfae0bca45b1bb5ff24962d0a2087ee0e0b7a34d071c6e9fda7d8a99f50903d9a9496b1c0bb38920ce
-
Filesize
1.5MB
MD547d8c70c00f883ff8926d98581ae33bc
SHA1dcddabf2cdb5aa7473e25a8d23a5a7fac8937798
SHA256b21d248264cff1f1517be6941609a84df88e072d3defeb14d38340d20d8c3860
SHA512f149ff4987d44fee7f48c527c50d52e602b82c4ac45f93ad8f3b89017be48ce138aa80e1dfb5d705346326a95ced121ec9e2c44c67c042fc7a6c4dcdccf58864
-
Filesize
5.4MB
MD5ab286be37de3f9bfb6bb51058460f4f0
SHA12b2029f57195587efddda71bee4becda8526667d
SHA256f8b00df5165c3cb726e292fa2eb9038daf88946ddcb3ca163a8ac7efb5d43fee
SHA51276690ee543308041a447cd38a7f87fba5cb448b07fe83b9ca1520e72f48dec8154138326c18946be428cbcbb4aef607d098a3414b5677ab4668dbfbdc78896e2
-
Filesize
5.4MB
MD58a06580f410330407091e2a3e552f804
SHA1be45a4b866e2aa12bf552d81f753dc7864f8f4b6
SHA256283b3d7448afc3bcdb7d37aee9eacc5f0371b87c8762c627595b9950d6ada536
SHA5123762ab54abfa59daae872781b6400efa2563871a854ed28e3486d54dbcd6e4f6d6f48559f5bc5f98f0a6ace94130c41fe0df68446afa4e6c3fd8d0fb1a7bc610
-
Filesize
2.0MB
MD55c25218a39de81bfd839137ceed09411
SHA148ad9a19658879e6aa1a27c955aa195618431ab1
SHA256fbb7219c68fb59dfc9e16c442984f8210b477d7c7462d66d5d17b98aef362faf
SHA5120eceb64ac2b3253fd4d0af78ee0462ae21fca816236621c01ec573e2c478795081eaab6bfdf15d9a24da071fecac3ac3321463d0505c2ded61c3c20602a22f45
-
Filesize
2.2MB
MD50f5e3fb3f31a8c0c8f72870a4cb6ce2a
SHA1ac622c2cd546700c13d4abf6e2758eaa38819157
SHA256f58d9886b601adbfb398835b3f4c9390a40375926bdd1f5a46e371a3f9b4e4a4
SHA5124e04facbdb570b5a91f0946d0a8922deac632465a3dfbda4bca6c62fba9f50c0fd485258b38e5eec89b56d551c43062f3832370676ec5bafbb258e348260353b
-
Filesize
1.8MB
MD591527cbc6295f5177cf8646cbd473125
SHA13f53335986639f47f717687af585f07850106f09
SHA25626660a080e3060c1015282e3630e6d247b5a1b349ba677e3ef67febd1c0a4570
SHA512b2a11df411fac1ae6bbd1a68d63aa11b09e6c1e81183e773a8142fd2be09d68d48337bad6e4ab1dcae9f51becf5beb03dcb214a58027e830e4f467278e12f322
-
Filesize
1.7MB
MD5cbeeee98011884099fd0c4f806b96a73
SHA1c82a564ce3a0b6ebda48bf1e866490c6ffa1ab70
SHA256c76b415b8bdeb16691193a6ad25dcb0b3642455f0386ba0d9ad327f89e887c33
SHA5128912a887504de87348b6bd618ea8b425193bb15d54ba6ce24d7efc02d55e06c9a1e2343d3768b1a95eac0f6878d2368165a012a81a800df550902d9941833007
-
Filesize
1.5MB
MD559e7b50cad420e8865e4dea2f32ae365
SHA17ecc3b73783ebf614e28d56c366c304270ef09f5
SHA2561b46bece43ee2b5a551be4c00dce4753be7a9246b1eceb01bc6e19479f72205b
SHA51281f2367f40fc0c63a237b3e5fad8560067d0de34ed91a07c24afb5a8f649d8dd5c693683e3a96ac43effc76d08f73ac8fdf6d2e3dfbda07304e9cd7bae8cd491
-
Filesize
1.5MB
MD53cc87a45217c3ea449c07882653ed186
SHA1f7d6100f2ff45198ea648e421157477b8f2a4ce6
SHA256c55f52ed8cbe8d6de39154a317fc879275f0a6222973beedccb1de9a900dd572
SHA512f0eb2446596368640923e3f238793c702ba28c9bb739519ded91ad9caf7cd33ac7af77546ac6f4adda18df72d81c3eef2cbe2e7758449788bd68eb6eabc1ecb8
-
Filesize
1.5MB
MD55c1da9346ff78e1a5f65be73f136981c
SHA137ef426c39f5b066829698fb93375d1d15b3f9ec
SHA256006420867b19d27077dde86563696b340ff7041dfb1b5085f3dbfd7fb3dce1ca
SHA51296676c435741e36aa3f18160b222e81d40b00c4fa76bd79d0cb8f4891449b216ef16e01a5ae7b4051f36444150360d81b19b80a9c0c40c354781c9b58a9b740a
-
Filesize
1.5MB
MD5a82408efb402f916703f9b6b352ca607
SHA1954edcb4ff79b8791361a65e85b87a5a322092a3
SHA256be03fc92339820ee8d0c7bf2c5cbaf08f3a0594caa62bc74559a083aead38533
SHA512707473ccd606af9d1f2d04fd46413444383fca391e2105453cd0085b581218a140b228397bf73b9ef00694b9d6e18755965e7bbb2dc6ddc42f384bf9ea10f7cb
-
Filesize
1.5MB
MD52cdb805bf3addf24aa2a64e853c8f56f
SHA1f62330e21dcdbe51e648088b0384c7b960510abb
SHA25676e93943bff81ebd97e3a36b2041886b926903aaa19695894ab3737fb14889f8
SHA5129651ba0024c228d336da00fcfb902b30420e956c9c301ad9655a885c51881c633771e876ee8efcbc5be4b2b231bfd03c1eac044f219373c8cbb14657a5b127fd
-
Filesize
1.5MB
MD50c5eb27920daae1720b0f90fb70d8dba
SHA1ef6c9ab5eacf0f5d5edfd8cc1fc1e126d6ee5024
SHA25646b25f3b460b887c852c7b897430786a25c6cc1b0c5588004ab1151625f83c91
SHA5124cd0bea19e89080f64a881eed1567bd6f0f45f2de7e5b9b00873233df5bb9a3c599ceafb28862b1f9384bbb92e675df390435dccd09b4a07096f49df8d4f1f8e
-
Filesize
1.5MB
MD55286a24204645a04159e8cbd2862c248
SHA1425a37b27052737d0d9230d216f824958e440e92
SHA256bcfa88e4d6d30b18c6309200d4cb98fcd6d89147677cb58d4c7e0b61a443fc14
SHA5129b4d323edf5a068ff68c86166fdee6f02b38794ae28d8b70b8463f16e68132eef6904655345bee9bf91f61707831e378785a002d7ca480fb72a844d863dd3823
-
Filesize
1.7MB
MD5cbbc2330bd518a2615e7e6e9205221ae
SHA1ff277147f2b256991a0e7362fca2b661aaf4541f
SHA2567723fdd7ee5787a9e469c8f1681a320546cd1dddc3a85d25f642bad290a996d8
SHA512b965dd838578e9c3af1ae801a7fc25e0f8b93dc510ff2b5db83a7fb1e946eb73148b2f2dae15c25be6e43c10055463a3b37cb7894867e66fcd938d51a43e597a
-
Filesize
1.5MB
MD59f286ab47512ac055cfffba1ec658256
SHA1275c05b196497e5e615fedb0efd07e4eaae4d566
SHA2569671c05edcdaef370834b27b5ef570b04f5222232c408bf044a349e89f638f84
SHA51238d24e59325fc530d4a6788ed394cfe1fe0d90fb1991fa007950914b6a85e9985e1c02a0225df52f3baad863dc66edf8cfcc5773eb9defbb7ff87a47d2c083d0
-
Filesize
1.5MB
MD5ba438d2633ecb1c1ad51f24fe37fd44e
SHA1d9c1e675b032709e13e800f2972fcdf713fdf093
SHA2569d35a5085dace091400339d6e7de22b03e47fcc9dc95c9a521ac4dbd43edb007
SHA512500c4e7c025078f862b4dd01c278f576f5768233ae0668ad17ae02fdf1c26335e566536e09b307d5a1a90d40dcd522ec3786cc7addacf079afd792ad5438fe8f
-
Filesize
1.6MB
MD57ad51039efd830c3c8aca502cd7ce896
SHA1bca32e6f08f0cd475bf38652b0eaa4ddfc5860f1
SHA2568716ffe9131e41e9a9a835e7adbbd25bf01387ae0a61d9d60ceccb2a18198075
SHA51264509641249a8315a9b6f08a0ec51f1cfa130ee19c1023c31a0d0338161248ca84ba966a1f33ee63bc1e46ece8f91bd57b5ab3144d7c3b7117597c0639a86ace
-
Filesize
1.5MB
MD59c53ddefb8f87e6c1850dc6b140a2323
SHA18869a4b266d54d4a8310bd31d27c73656305f035
SHA25699551db8f40274e784720e649b6573a7975ab3f777e22576eb83cc80a3b5b1f1
SHA512ee4de86a509827e710b3d0832b05c024cf726d7f2f47873f2f1e0c33378d78bef4b2f5cbf091fa7944badc119cecd452f5443055ba2b6fa47a17a6fa1123a523
-
Filesize
1.5MB
MD5f8bcdc2b22c10bc653f635adf8404176
SHA1cba36d46cab708d8299295b2f12d0647417adef8
SHA25681b07b77ee4a6bbcfb605c9a074b0022a156ee59ffa0c0bed280542dade0e152
SHA512c381649b3eb0a9a8f375cd49e814266d2a48420f6ae8ab3ba38c9b1caa20653b3aa583178fec49689751db47988d1882814cbdb7936ac8b6b02db80618a2294a
-
Filesize
1.6MB
MD5c74285cc2b3e0f3f9ce4a61169fb5dbb
SHA143ea11dcff5da241501d673c75b1ec835ee40b29
SHA2566b9c16dd0567e13376bf624de2898a0a02a31631c641405a70799d0151557466
SHA512b3618f67d0d499e985d28dff40ed965abee5fecb5e4304b400d115e1c4b9f842f0ecb8d3ac68bfdca7387fccff0861673cffb5497a6d607ce1638716dfdb4b18
-
Filesize
1.7MB
MD53b30a166ad1a081cab223457178559cb
SHA17d62f719dbb8f66165801222c0ddf8ed9be6483a
SHA2563670e34e3259d3b1e27b65b8cfc22fab960062a779de308c1c45e01d264d25b5
SHA51263ee652a773e3e3259a88bb1a0f1674a94625271223f26642888f0bdbdb7f5526c482286365c3ac7902e41c2d86baee35fe923e6d13f68a44045d248a857ebb0
-
Filesize
1.9MB
MD5c866f5015dfe7f0433f57b8e68ae3205
SHA14da27122fbe94564676cec67eeba2c1087ebb5e3
SHA25634770880c97b08d10057e2b5d051d6cc6d36039fadcbf555445796690932f233
SHA5127096d0fb17c7f45fa244ccf2cf215c6fd8aa08263021c22285a922afb21f744802e6d7964112ad5ef122313446cdc3ca6cb8566865d6e74fdbff87820f079a29
-
Filesize
1.5MB
MD57eb1eb1ac37c6019521b589e5fad8657
SHA1a80250d0def5f508280b084ba4972dd8d47068cf
SHA2561c5ef6e0a3e33f98709f9622d3752c32d8cc08acbe97d2c0283337cd7021afc8
SHA512d5f82f3c1f7eb337631d9d9ab8d9d1e762712b492793bd017305f9a23f2201349008b0b6e07b0ef5018e0dd45b4dab399a55a582850b1d323b333dc3c5db1db9
-
Filesize
1.5MB
MD5072b8eb91379e65de5dd67855afc2094
SHA13980e0ce9a9ab482319fc9e483909a6add6c254c
SHA256f0b824e731395a34d8706b399a19c5906b5ff9c8ec8b3420d7b56c3d7e6a6b8c
SHA512a1851718bbd2c9b1bc2fe1ccf366453ed79775f286feaf699fe0afa1a023fbbbdd4e119ebcccc1c95970a12badc98f327390a055bedfa685aec560e3cc18214b
-
Filesize
1.5MB
MD5385b8d22dec48abbd68cf92784918c2e
SHA17870e9989d86fa9057e4393ad40805070b3108c9
SHA2567618c21ea20bb61452892ba514784c323b8cbcc5357fb6549f7201fd48209b65
SHA512c5000c977136a2f121089c141b92ec099999083aea214e6d46fe8992ab3b0541f3fe1d2b7afec46edbb8fe8faae55149032dad3ebaa9096f2af74726a9e82a5c
-
Filesize
1.5MB
MD56e7866e18620c9e2d4f861009aa9a5bd
SHA1022b7db44df090dcb79c7202e6a2b147861568d8
SHA256107ee65832afceaf2debf63cac6bc56e0e5ed2e0b511afc9f0e7c5edb051a3ad
SHA512311b86f21f11b83d3fef0c7e06b20f1bef7f62ac1b81e27975d003d52667a3c387a2910b4ecb16191a79732ff0518f880d1e2a0583cab513994b348431e275f2
-
Filesize
1.5MB
MD5c18ec62599a56eaa905913b4eee83f91
SHA192c00ed97592ddf0e212ba51529e5f851b51335b
SHA256dbfcaf9493199699663dd41a4fc50218960ef8656c60cc739e9d0524a27b06a1
SHA512535bfd5db9d381ec7450f932f0c73baeb9209274fe77229a94100f0d50761af77d3bdb75e18aa1930e032fe3d430c5b4b9bd1c3949906a1b20ea07b8dc6c0fe9
-
Filesize
1.5MB
MD5f5a965c42fdb40fe79894cbda835d4a3
SHA170b8156056ffb663e1d6ebf49983ebb973dd1143
SHA256d34e4ec6398d13e2d36fabdf82487643dfe9a90c4f5e55224f9e87036b02f174
SHA512628d9b3761f88f2e7c74bb9abba64b009ba281680d52274c314fd492e2eff94a74d4bfe0e5fd66526adf64af714a67527672567353b38d9d3689b6bd03c85ede
-
Filesize
1.5MB
MD5bdd00fd4a5c35cebd0feada48e4f12a5
SHA1c80a1fe41cd673f0e1467e8609a7679c90ca6805
SHA2563846242baec633d12faee9b78472f15e4bfaf4fce2ee74b51f043d5b6185b42a
SHA512223bf6cdbeade43086997ed9c5d3f3d52f9037bee6f0e47f006106a481cec727f12f80116132ed1b975abfc910a28d9a7c4519745bd9ea0a63a3d358e38a9b84
-
Filesize
1.5MB
MD586d7938d41849a0f1bf97e909c31f238
SHA11b381d7d5c786bd8c14b39de9bc92e4c559b205f
SHA2567fb22c695c498fd1a87d449b8e5ff1515aad41e5ed941402c7fabb1cfc2439c3
SHA5126dac45aa40eacb5fdcd2264c22fc7f57e60bd52b166be4c2a7c442339f811264c56c82f4a8d3d6d8c2ce764e0cc497f4311b58448677898c86845159155c6615
-
Filesize
1.5MB
MD5ede6b0db23bf830bf1f69ba98c96cfd4
SHA18a5420d2466398516c669a12dd079be2872db93f
SHA256b5456b81aee230556c60bf2ebda8dd8759716ebf9923a3cff4fc5f71fc55f717
SHA512b0c7b4a2fb397d1169e5a54d7ebc7f1e37c2c560bd1000b03bbf9e0ebcb349d34b0a6c64dee22ce15d28f26bed074a5f1f06f8cfc8447c1ce75ace249b11b963
-
Filesize
1.5MB
MD555230411d02c3933b63284a3ff5c5a33
SHA11502144d627fb3220e8228b2abe77f0a3650b4b4
SHA256b38bab843209099d3884e7b53c5fbd94da5b8edea0e5480111ba42be00a5bfa0
SHA5127c0394c021e0d8dd6a05f84edca5db1cb71d84f4d0d3bc276bd5b02ec563304eeda5c223182701b1b7c676fbe6c5d4a34b8bf36bdbe78e2dd3c9e7180c7a3393
-
Filesize
1.5MB
MD5c384482053861ef16e0267041b60156f
SHA1975ab2c208dd4a69ccbf53da9eac177705e30f29
SHA2561b25e84de842514bc168c4a9ff535865be4397c7963991b2e29417124f76def7
SHA5122cba320b1afdc7d6f33e21341197da50bb1f2e752e6295a1b02e0f1cdd7a092f7aeab9a2ba016c8c3e5d14fb66ec0cb5bf38ea6fd5d6d5c2db234b0aae2ff940
-
Filesize
1.5MB
MD52b19462607d6037eecbef9b04f8f8e88
SHA1894834fe5a0064b4a21b0363aaa7f3679985f567
SHA2568b3ada23d155d65026b5cf96747b8cc8ee480506801db782a054bcae3993241d
SHA5121c537cb40d8394b0029ad7448caa1d1f3d2564f549918e81d9b3877f9f234bcbdfb55c9892cb3668e0f3956b5985e5cf16836287fe1dca97f9f1d265067c0803
-
Filesize
1.5MB
MD5bdbd8436e262ba9bfa047519a67a75f5
SHA152fe40fa117eafff3b93ac2578697fb6aac8ee23
SHA256e7e8d5abfbfc71536bad638b0fdb19d68b448352a87fedab6e98bd74e83c7d14
SHA512756553ec4aeded4f60ae49e542a55b48e4c287e0aa955e240b6dc70515ec049f9b56d7a4b8e950ffa4a58aa445aa6508ca4ff25d46a75e5fb7d032be20b28c0e
-
Filesize
1.5MB
MD59a897c04fadfeb1df7294d5a6aae40a2
SHA102e1e1932b0eb60f5530efff68fae0ea52bc6b68
SHA256d7bfcc73d034ececc43ff54ada46b32ad9392ea3a35cc72cdf98f0912126e4a3
SHA51205083995a9371fff3d16dac6a6a3462534b929a3d5986a99b14b36666878b4ff135973f9ef12bd0b932553ab15ffac8d04aa851f460a19f5cb7e374660b84c32
-
Filesize
1.5MB
MD592e54e1a940c5a513dba518031a3b381
SHA1d276d340464c0d34b30d69c453a7fe938adc9277
SHA256da0d7b19e8f0d91a67f726813bf01b7d07489a09c6740a5ce710dc7160bbd063
SHA512e6ec8cf388f81abcb59d188ba1ec699df39c149ad6c91bf128c4559822d31b0c94fd1ee8e02f78acd2e0574163f3996021e0f08ed6e4580099194daeb241fca9
-
Filesize
1.5MB
MD560ba31c7d3e047776432f4115fe4850e
SHA199a04ccd6d96f4eab6127178af133ba13211f250
SHA2562d028b3294ffbd695267d5938a20f92f0af5a3596856f9ae82bc17475c929b5c
SHA512606bcf6ae029b13922339164b7a0f7ad88c767a92699be615dce1852cf94219a2b79e1f2d39f52028bf000d4c739a57ca77c0d31411f0a972629a49df322a1f4
-
Filesize
1.5MB
MD57d311577320fc89eefc4b92067c1a79d
SHA1cde1ceb798e06c879e113083d628eed4f90a5a6b
SHA256cfec6344a12d0f47834bd5c2dc9abfacea3af017c693bd198237802c90e70ba3
SHA51244c8099a8fc0e002a4130c4923c6a72ed66b41add0f345ffa73cb6a147b112f7d3f3ae9f655a678f4881009464ab57709c1d4e92c1a9773fa8b85ae211b6d99b
-
Filesize
1.5MB
MD52152bf24018ea126e5a1d5629f463423
SHA18de0af562a388e9d6cab1cbc40bc1ee2f746a422
SHA2560600562a150f1d8061201049fc15088fb657e82b6b711dd29bb67d285da9dd23
SHA512c3a4ff2fb139770659dc49889d64fb8f3f3ba06310803bd3fcd763657576d89db5078f673702fb9d70e372a05b7773d7da1d6ca754f93cd82fe8ee16c984f782
-
Filesize
1.5MB
MD5b910c31395985be4c93999f0c5389a51
SHA17a9ca0853e5a97b849d6b90eb53af21e50eb49f4
SHA256d2beabcdb448decd25b4d5c887e6e85ed594a3e4d6fb7172741239d52df45028
SHA512acabe57b1c60620f2a479af75ff7203649e23d3b65e2bfe1fa56c7f4349f95386164d63d469990caea1e7c34ed115c9210a69976d5ab8626bd780d0ba40c3424
-
Filesize
1.5MB
MD5e9082371c44c0a782c835dcaad7a0a23
SHA1cc448891dc0a380c1851cacd5a5482ec973d91c6
SHA256f7c3fa2d50300b0616f6c095166ba608fe5a62b9ff8802ce66cca2fb131fe1d1
SHA512a4293892b0672c017773d6f4f1a39aef1fae191c6c8578c87580777e8e6c5598e6d4d853b114df95513d46b73850056b9ffc073dd100a64f00e68896d8dbe825
-
Filesize
1.5MB
MD54501efed80e3a4313bf6367bc700064c
SHA19875906211f42a41ca650f213f3a0d5b10267385
SHA256fb9d100216f09cd190875341d96c84decef18db708fa0a890d02e5d9b9760db2
SHA51269f293de71d70b467bb3b42f32a3adc4c298de091f73963e2a2ad7bd27854230e9b36bfec3f6bd0bed96b2fcfaafe4c42ea0b11b78ba087c650b841533500fb5
-
Filesize
1.6MB
MD5195249342e5f2d86862a470ce6918155
SHA1b742bdf58e4a4d6e1f5df60749272f856e24574f
SHA256e9b025c2858237a4cf8ca087144d1247a4d3e68a53c0c9d619a885d72a863d62
SHA51216c81b41ae8573dbd58bd692294217f951f31d0ee59261a3daf8bea48784ccd9249a6edb9ecadd37b90681db54c6b75619cbca871be77ae04013b68eef8203d6
-
Filesize
1.5MB
MD51f30aa1d591795adb83204651d2b9b1b
SHA1629f3f63bab60cabd3eb6f81fc4364b95117fb9d
SHA25689bd5c8fd932f9a96a94a3df9ba1168235fe42278b3872f333c45d41a7cd870e
SHA512d867064f1993367fc7c13cbeb282d1a2197ee6667c075cf527523961cf9b6c36f2c8569ae50ea32a48c67c5c5ebe12a77ce65763fa3d8eedd4071b723cc5397c
-
Filesize
1.2MB
MD5b2c7a19aeb24ddc57de6f0924015b417
SHA1d986f989ebb50f4c3bf558bef251d1fe1666de34
SHA25663909933bea2a75f05646a455a85c1f4890f3d5723c8410200573b9b816d64d6
SHA5125093e9788d23a887faae4efad2756660b4aaa1f3d16196b34667058c8ba457af995142a2b87cc65f0d033c518aed4a087598ef48645884f6349ea1d5b9685560
-
Filesize
1.5MB
MD5a03f43ba55119fbc50ad15fa28dd8cab
SHA146dfcaed1aed38a1f9c77e3d83000f4937cae533
SHA256c1ecd1c0df4e7af51ae72286ceb1a12e5adddc9e1d8f041470396c510be5c9e0
SHA512eaec97b6a2ee81df1b9aec6f4b9ec599beaeda807edaf87b0cf41bf5ba697b4cb8f174218d7d0e78940b9cfdf5bf529fcfa4a985d8afefccc3b46941f2ebf327
-
Filesize
1.3MB
MD5f12ba151e04fe493510f4d9468e21b8f
SHA14f9c83f74efe8f2335d8a63772f0c2dc55063358
SHA25639a11e681a353fd8c7e690c8a56f46854b5d8111a7103d743233e4bacbb1189e
SHA5126746384a4854df2d65a551e42636b6cd7f9c014a50afdcce323f922c753734a47532223bf1b2ca6abd0cbf7f4cbab3e00b958fd23f01de2fa00239356e800a17