Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28-01-2024 22:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-28_1cbaffe154a219a09f8b2f2dc093ab2a_ryuk.exe
Resource
win7-20231215-en
General
-
Target
2024-01-28_1cbaffe154a219a09f8b2f2dc093ab2a_ryuk.exe
-
Size
2.2MB
-
MD5
1cbaffe154a219a09f8b2f2dc093ab2a
-
SHA1
4e40d7eba4741a6afc31d3d01b8c9257d527f4f5
-
SHA256
621d87dbf623c889839f4f8fd3013e31c31310afba9a382155ddb5e5ea6363e3
-
SHA512
3a3b7846292f000dba542b8163de2db7a88bf9b78f2ab6be4592c0c7943a2ed42cb2477db41c52573e7a6af50ff590a356d7cae68810efb5150d0cb6df5b32c3
-
SSDEEP
49152:ZOOh3aN4kuLbegmtGrgDUYmvFur31yAipQCtXxc0H:BU4ku/ct9U7dG1yfpVBlH
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 1692 alg.exe 1272 DiagnosticsHub.StandardCollector.Service.exe 2612 elevation_service.exe 3012 elevation_service.exe 3668 maintenanceservice.exe 2180 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2024-01-28_1cbaffe154a219a09f8b2f2dc093ab2a_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\c80fd44a7c1fafa7.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-01-28_1cbaffe154a219a09f8b2f2dc093ab2a_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-01-28_1cbaffe154a219a09f8b2f2dc093ab2a_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-01-28_1cbaffe154a219a09f8b2f2dc093ab2a_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76828\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_76828\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1272 DiagnosticsHub.StandardCollector.Service.exe 1272 DiagnosticsHub.StandardCollector.Service.exe 1272 DiagnosticsHub.StandardCollector.Service.exe 1272 DiagnosticsHub.StandardCollector.Service.exe 1272 DiagnosticsHub.StandardCollector.Service.exe 1272 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3468 2024-01-28_1cbaffe154a219a09f8b2f2dc093ab2a_ryuk.exe Token: SeDebugPrivilege 1692 alg.exe Token: SeDebugPrivilege 1692 alg.exe Token: SeDebugPrivilege 1692 alg.exe Token: SeDebugPrivilege 1272 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_1cbaffe154a219a09f8b2f2dc093ab2a_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_1cbaffe154a219a09f8b2f2dc093ab2a_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3468
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1272
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2612
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3012
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3668
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD54928734b4a058a4c530cd80de8aec6c4
SHA1fc4b199c2942f5d4a295fbba455dad00eeb32766
SHA256f30f8a54c8224fdd04a57f33a688a2f1ec92144a648bd13eb3d64fedc359c2d3
SHA512361b916aeb81a6d65e1ba70665ddff72be1ddd454edce407da3d471b174f9d71ace558eda1761051ac131545819ec55c9c3982b241000b20aee70525a7f7dc30
-
Filesize
1.6MB
MD51df12f6830aba2d15abc45d538b329d3
SHA10e8ee588ce28a9c964f2ab6bef59870dfa2ef117
SHA2568e431c880721981f3e4735d255ca577144b8890efa39bd179e4426b9e6ec7faa
SHA51218f5d1f6025ccddc183fac7a187e25acb3cafc2e828739a8113215b6b2133851e565278a9e62f67b901497d2ff3722675654e7c2a3d665058e110928f5d9ae44
-
Filesize
1.6MB
MD5bd82c9ac5d1bcebf1336404d0feb041c
SHA162b7f0ce606bb4213fd9ebbf9eee16a8aa171555
SHA25619be9f3ec1bc9f9b7b14963067944e353a4ee40aa0094510f7beb41f1eca6e5d
SHA512a408a1774bb406cfea3cd72afad495161daedb9acb4b75283dea8e02f99fea00472af062d1df9be27412f734765b8222875a059df0f64875d5322659b4e23303
-
Filesize
2.0MB
MD5169cd1f70a1ea993811ca01b85f99547
SHA199c6afb9d52727e856157baa793efd3a8d187419
SHA25665f5a927a7519351964fd590851944948f66d8c949d58d5cf7b95bedbf01ec38
SHA512cba772442d7dbfb04a6e913e6215ed96d9321262f17f31b1e4180a3d88f9480b272254b3aa195e1f41e415737713e66b09b733b0daaadca6a7078954a667ed4a
-
Filesize
1.5MB
MD5998e6328fa15e2ac2a750cd59df06dfc
SHA1de626d998bcd935edf881aa25e79a06caa4fc749
SHA2569a8bc313549b2f6e87572fa4245cc00f417b520a726e5ebd0b3ed343b318864d
SHA512fda7dca61b1a856ba822c3c5377a73a51a1481e9c2ee9cfc3324d70fe23c25227a63abbe4fe2e26062e0b4075e782e5d6ecd9f8eb87f1abd12a5225c5276367c
-
Filesize
1.2MB
MD50eda9e14db092adb9cd16c4ecfbe68a7
SHA10d88c5fd5fb23d6a2c3708e59c7e78bd1e123e08
SHA256b38ec32729be0210b6b699b43407fd985709a64d0eb1b119c96e84c07565859e
SHA512fcb3c0572c66edce49ee72c2425282963dd55c8c9796f810c50148654fc042ff40f8eb039a977ee9ab5f140d058bdf8555705ec6d08f5c5c3090c678a8a0333c
-
Filesize
1.4MB
MD58cf3728fc5b034a88650fb502b3d557e
SHA1996d9d0440f42c919c896927efd48c4db3defba9
SHA256c598325a2bfa2c5900a884424fcef06fa636e7710212d3419641a2890bc1a4ee
SHA512c9350be6ba446eec16e1173d2be10b9aa3b7aca6140d3c44c363156df2e158c498f32eaea32233821f15142fd478251ae3c1793a5ad44db56fedf598a395c96a
-
Filesize
1.7MB
MD5b0486cb870c438d7bb6a55432c0eec6a
SHA1aae05724433a407df7280d4dc8beeab57d94870c
SHA256ddb10a66b191994e1d08fdf449d809cbb6222cc1aeeddce0b8cea4f119746341
SHA512bddf83505acddf9b700e24203966a1b9cc75b81f6cf5845bb1b3333972520974bb9ff1602777b40e4d4675c3ef6e86e2c4981fddfbf4a55a7e95529929174d6e
-
Filesize
4.6MB
MD5862b8c9ee340f7b74c2f128bce0ea159
SHA1aee8280306be138988078ead87f5861016cec790
SHA256c1c24ff758068dd725a8138547941813b1dcb2d4e1da30d9c74b160c82c5da9b
SHA5123fa99e4051c56715d796940de613dd0aee3eaeef68a73f5547fd0665437c5da8b4d47d46229d26f298e858589959dac893229e8e896a1ebbd45aa0fa272b9877
-
Filesize
1.8MB
MD5baa20e52fade0d0ae6bb58638eb50b2d
SHA10ec413b5a2a17e86d4fdaed387508bef452b9bc2
SHA256ffce0600b30a8b994a50038e404fd4f0458b9b041a895a3c7379bf7562ce4763
SHA512897fd45f7d2f65c6ca7e9a926c0c4942ed5aac9aa88c4d93c53a291d19d901379d22a7c228cf40f8bd14b64a20cfe4b3438fa1a85fbb9c7730a21fa4f7f9cfdd
-
Filesize
2.5MB
MD5320f44fb2cb65e585aeee83efff03351
SHA12d1af57b21aa29c8ba14f58940c46b2b334d5846
SHA25601e5ac24afd0f8d71c8677478eb83b36857962e389bb2aca5cfe1796f164e58d
SHA5125c760ea4782500840bf923825b4b64060cf0b140087b6228852d05e7c6337515c2f52933147ff5cdcf990465b6cf1f370cfcc1be04bd9d0a462128fdb77e1a2c
-
Filesize
2.7MB
MD51847abc71b0be193664399ceeba2158b
SHA1aca04834bdb6a3e5cf01634fb5383c3abb719520
SHA25696a82ce35ea0c0a269baba364eb1a633d0342a79257576d65a628d9af4954c53
SHA5126bfb9772f88ecf02f1e24d3b004a10fe9c76652af8fb46c4c5f3cbfecded979279e38ff9b348c2813e372a728cfb1d7081eef5dc6d5259cd31f958b6e941e9aa
-
Filesize
1.1MB
MD5a1b635ca2c9b9a6c2f8ed4fbdf1038b7
SHA121f3cf8d4727107b2b6ca291f59003d1bfeae933
SHA256b7f88798262eeb231acaee01b14cb0e983c25fdd3c135a0118a05226acebc3c5
SHA5122684f4fd1521e8eb3099bb343e2f3ae3584140ffdcf327e7f7ea7674b1ec407738cc8d0b18e3ecd66a86eb35d616156e5c7cd4bbd766129885c0f9726d3423e1
-
Filesize
1.7MB
MD5368ca7c939ecff2405950c22ca4c4af1
SHA1bdc5ca0c7e8ad2dac910ba1d4a6b6624ed231946
SHA256ba952a052ec99724f837fe2ff98a08a05fc30d3175d700cc224c59edb7ed7810
SHA5128d72831fb9637270eb718561da39dd972251a71d592919c2dd94a4f3e13c9593851e8feec8ba1f23c588bb38e70777a24cd9ddbe3cbd8832d83ebce85ac5563f
-
Filesize
1.5MB
MD5bcdd91783b308425ce1c096e09fb9bbb
SHA10819b0d66bbdfe7f5bfb9a490804b8c140d6b516
SHA25622d1943a8001099852ae10c1cf00161df93ca7a6147a0d6b16abacbbf97b1335
SHA5121ec3ee6f4fffc2febc17fbacaacfe34fecc3b5a40e2abb9800ff5bda5668aafedde83984b0ed4714c5f86a530aae872f1b1eb6696aa7d4b3bad4295e400e1c95
-
Filesize
1.4MB
MD56ecf399483b1d926815c57786487a108
SHA159e0859f142e542d822f8a1b86dae2f1fb3490a3
SHA2563db95688c2b76975d3fca3acfe5d7c559779982f2bd763dbcfc00cb9f07722c7
SHA5127c22ffd597c61d8394e5739be59bcb50fe279f7daf4ba82fddd1fe914d3d138fb9675504f38eac7262d3ceb20fc7e6966b4ac1932662b01bcf5e1b9cc5d52eb6
-
Filesize
1.3MB
MD501fd74e64996eafdc178fd2dd1477b04
SHA134804dea2849aa8947e202354da9cc9a2b12da06
SHA25621b41a6ab110a1b215cf6a895fe0fff312b07e24afe5a89646b3d1cce0951dc0
SHA512c7ba38fda33c9054009642bbc32826826e80aa4d11c1eaa1d21d98ca85e1149e26c3a844c22dc72d20e01f8d187e458beeb2870e015edf940cabf0a8a4bf6cb0
-
Filesize
401KB
MD59b557d959ab96abfdacf9ed118861b86
SHA184368096b8a4cefd5d58da0487ef1c0c9c4321f7
SHA256be42afb6f76e7f28b3a13fc84fbc86ddb66cd7d7fd4a081ecf8ddf2181161af2
SHA512153dc34b9dcab7aa3467b7638143d300d83b03f9c0d62c6e865c73c0fca356936aaafbc0377313eb1cced5bd4068c2f61aaaa8f8aa138db68d3486b937673277
-
Filesize
1.2MB
MD572e828571c8d80f8485ec1f42f519bb5
SHA1393aa0b752ec53c895f071061dc2273149acdcb1
SHA256074c2c6c827549ccea0300dc9d8cab582c95af293abd75b46733945ac71112b2
SHA5127198b125dd94165db7213b82f95a6f0cb80fc0ebd38252cf504464ecaf1186ea771b47dfaf9668cf428410ad4b807baa4d0b524149809c61259e4d4da8018737
-
Filesize
1.2MB
MD5702b7566c4216acace0cbc44ec7eb06b
SHA129afdae470fd4b05e3fc900f2dfc973d9e222e98
SHA256e0067a285dc0a79255c22e82ee939c2278e1a212cc776b0eebabc8e267dc590e
SHA51205342d364677b5c7ab1e7a34a9314c0bbb9d499ee9ea252afb43f636bfb9171df84013ebdf39e9152a2229bfebc0a81b9d01467d8b17b75aa8aa7d628fcb71b7
-
Filesize
1.2MB
MD51461b67339221e471ff3a4398979eaff
SHA1ebf4a28176c2e6bbcc93fc3f40d0ac90238c4bc5
SHA2568df185b6737db2fc92a97cddd094fa57c6e6d89a67ab1060785f8a8beb00f858
SHA512a095472a6291ae858ec708a1ab8a2917c1a2c9c7a18180683e4f24d5532880af737fc71e22d563204efcdc69ad0e91773a3625ac0a3a7e858bf577dac05d8cf0
-
Filesize
750KB
MD5bd6f1bc2b2f24ff56c483b1552650c30
SHA17f35edd631ebee03397ae4325b24b5bfb125d134
SHA256068bc5f727714e108f0ca339aa4dc07c8352a74d554c1e4f4808ff1bd6d0d020
SHA512a5c5c95a25bddc91a02f8e6415ae4657a6d9b619c9d1da87ef91c44a4bee9fc4ba67cfb3058d4ca404d30df3a31f7d6f4c66ee844af5448ea01e09ee006b7668
-
Filesize
1.1MB
MD530803b8a5c46da75a09b76f78d61b9d2
SHA1b611b605b1a66f14bca4b41dfc12c357e0c276cb
SHA256c55b50c3e57836f75f894ca62890b4e3be897475be2c56db7649d4e9dabf2cd2
SHA512d26a94a9f14e5ee947eb3d5edb1e05acc32710fc400ee66c76ef55cea1164b69ba380d7a79c12ddc3fe12fd88ce58d748b1cdfa9a9fe17381f791e4c6848f8bf
-
Filesize
1.0MB
MD5b621a95a65d90919ab8d77cd1e003df0
SHA115d0b3a6f432ca5e65d8a01a2e1bbdd74a358bcb
SHA25600ad56bd9385788093ed800cfb9a79d1cef3e098fa4eecbeff7fd780aae423da
SHA51260704217dfdaa5a744f39ff1bbd101a78c4873bf81746b29a6d8f222f9433fa3a9c174e0b825a56cd5e82048d3b30a6798bb01d63c9b52d4f8ce22acfd81dba4
-
Filesize
1.1MB
MD59cfe5d34269acc2d035c0407a782ba3f
SHA1fdb3ce99a7fecfe99807791be6b392093eebed55
SHA256872359030217616f3ae8b6d03806a5dc7cf142e52a35a18147da071da8592b0b
SHA5124bd744b981abae2cb1b6dbee3e48ef188076df42d3ef57cd5310971bc2904d99d96376cf1f16a94494e1cf3930464d7d07055c075061eb991bdabc462a5055b4
-
Filesize
1.3MB
MD5281e444971d3190b1c8488ba5443aa66
SHA1bc5aac740cb0ebc5f6adbc73ce453ee69f442c72
SHA2561849d5d7b5dfa6dfb50f7bbc001fa977ae55ab55104787e0e0067f61bf4aadb5
SHA512f4a8718d3ea37344f77236cb7576dd347177cc1374889cb3c2134a4a9761f47eb10fc25cadec900b1f27edf2d93d11b9adf3cd74d77292b0ec5130dcb3d153f1
-
Filesize
1.0MB
MD5983c53f9499af9a92f06123ff03e40f0
SHA1bf7494d7ed1ffc2a2e8b60c6bdefa9102124c150
SHA2568d55e0cbdf31f055a6cf7cafaecc9788eec5cc167deb8698f48111d826743cd3
SHA5122351d0fcd778c5e584a2bb54f6e6502f366072b582aea8c2c6abec2c5e92285b42c9338737b0101cabf609a5488acd2bc18a1ac7caa8812127c5189a5b2d86cf
-
Filesize
815KB
MD5318cc09de0417f6eb55472f505481d52
SHA1cfb2a65e3bf9ab43d21c5800fabd9355aca7c4ff
SHA256fb8090cb4e70c5922204d536c8b99c4c2233e6793f0404bbdf65b36af7b6b9c9
SHA5121e542a7dabf48028fde934ba50afcdba5907a3033755bce2ad4965fb0a30edbadfd5648d857d0246b50ab6d79489328b589f2ad4b3407ddbfd1d5a51d81a5a05
-
Filesize
773KB
MD5681c892b8526275e09ae71aca9622bb4
SHA13bbf3c8e74febe2194b0f4811e2ef8b50c881c13
SHA256547a65b544dc44536be7640b72b71855762425a8d06cb1111494d1ffd784fc6b
SHA512105bcf3145ea8996694a79854b94e1e60b2aa03618788ff0563676b6993bc2c42b3bd067c960848f385422bb29af8393b09d20f539cd0473e739f9dac8ab37b8
-
Filesize
1.1MB
MD56acbdb8b35cab4a5cdd0c5fdbde67d5f
SHA1d3455a051f30fb6f19bf188fee98456064ca9f53
SHA256c18a022b36168c41d64afd2d4b496f0478fccde187cb6f236e933557d2c83cd2
SHA512fcae99f1e3ebb32456c44082b22001f9574d6b3f43c7625af8ec60cf2ad1f5372c2c5413356f22a3c28395c5ac2ee9d84bd1fa8e4e08213fca5eeb23dfcd0521
-
Filesize
802KB
MD51135654fbf1c50a28c61a1fb82643d3c
SHA1881c4bc3dda901e3c2edf5a19da52b8c2689e30d
SHA256d87f18f9681d561cfb61aba2986fb824fedb16618c805211b42bde564dfaf973
SHA512bd61c1a58ecfd13c1ef37eed9b920a7f614255042cda05a98d0b61bdc33830fe3cddfe14c7ba83f88a9dfa12b34713dd5c3cd71a48550baf3d6370284c010e73
-
Filesize
808KB
MD5663382d75cdfeafd46fe6ec54a3571bf
SHA1f9a31b79f85e1611de0d05b71cc2ff41815289a8
SHA2562efdb72e9410299c8406b63e2d08aebea3eee0a27cab12e3ac1074b0d91e4584
SHA5120920e0b55ac4d5332d09d22875dd26c145dac152399ac5a617f55e17568bc3adfda89ecdf66abbf798a1d021892d9d86fde84ed7001460209c6c9642d38ab601
-
Filesize
439KB
MD5c6f5e383828b8a8a1ad449a65310147a
SHA1cda237bc121d74b9c600f0fbcede0feec0275c45
SHA256925bda3e64506a08bc0814d0cf4cd199c0338a60b6dbf643dbfb1c937e016782
SHA5128ab92078ba4f382c6c481c0f4206d5268ee26ff436cadd01ebe874dab8b1060424a83e97745dcb7316fd8ed18c30b4d220432be58c194c028c90a4e2996a7e9c
-
Filesize
620KB
MD5415cb6b94cfb10c5207487c22bd70bbf
SHA1823e3e56074d5239183c9f816b3a4183678c868e
SHA2560242b9d77f6ea9720040fd87a123b9f123d8d12492783cb29026022e47436dcd
SHA5127f0ff0a93bc26f18c68b74ed0dbb1cb5e7513dab244362eb626467027c21cb3b32983fabe8cdfcc9ff1e646b1d706e20f411f5770205e40e346800a197264873
-
Filesize
661KB
MD5d78a43e789756579b1d3589dafd34666
SHA15d7b688adc903ac65cd719e0f695c3c65ed43730
SHA2567cafc3997643fc6f39426ac39d861fac5d8ba9aa7ef5251bc7874792afbed396
SHA512eb965bf18bda2595752a258405546c6509ad132299da8af8996d05a4a9116b6e0faf93f15bd79564763a0617f4c483e8df6faad3f387ede68f322ae0dba0385f
-
Filesize
804KB
MD5fee8935cd2c9630fdc0c95c76443b55d
SHA12e9006ecb3d0c3d7e4441a7e211f08664c60cdb5
SHA2562b32ae0c2b67920f4b71540021c35c54dc053844adfc074c8d731a8c280a5827
SHA5123549f8f02dc8789ff5ca1dd03aaa0b7c5d234d7ed0aa6184f0790abf6c4594db4fbb2a62158d4e7a4ea0ef26bf17affbd377f9ec007bc6eb836cd59f69c86694
-
Filesize
704KB
MD5731a64a7027ce6eaeacfe1d4f0dfcdc5
SHA105890eaaa615ab37ff539ab8d059a1ac8d5be0cd
SHA256b267ecde984b0402ed4d5f7bf15c09082fac7d7f32f1e62a620b5bbf862005aa
SHA5121a8159bded2f6e61bc98bd3729fe3f0f150785bcf082cbf5bd9cf0e6293114a362b0336566d32da7af3153fad94b51fb0ce10d046703925b005a004b58d7424a
-
Filesize
522KB
MD537871d9807df8bc95cf7ceca1f01cb8e
SHA1b2faee52dff07e5717d3edec1dd00247dc8c957f
SHA256886807c346ce542d40ffceeac1c88f6578588421773545c9b35ff3aa09825e5c
SHA5123ebf6a590d872b2cc7a166f26da5491530511d277c291118f0b7306a156aabf239164d1116feba41a9de6f35a56adfdd56da7eb37055dc6bd5a832b8e52225de
-
Filesize
350KB
MD5c820729e719a8a01ff8f0ec912382d72
SHA1039deaa3c48d03756ab3464ec431b44c8d41e12c
SHA25679de4268852f26b5e500a0749ce9b0ddebfe708cf118b44a28ece408088841a7
SHA512a32052049fb62748360640e5a09350e9b8860df55e4e08f5018d081394a298b2a99ba0cdf680c700dc5f488deaf7a4bca07f5932e025dd7b238e4116211d4bb7
-
Filesize
411KB
MD56cc09f25f86b77f3b856137f3d5c5933
SHA134f939630959210c43fa3c864ad42e5af9cc2b90
SHA25659c5ed64ad6f4e1112bc9c4de692535a4573349ae5b7b9606af43946d6485edf
SHA51247b2da7a3e05db90f17ccc1391dcd377aeebd493c892858d7aa3c5e0044cedc4f8b9544ab379c9ada9d98278d5191bdfd1cd1d9a068474bdc3b5a40a779baa93
-
Filesize
345KB
MD5de4e4d3f81b3430de40da6d812e3e2be
SHA111dc0727702b59f720b9d85e42518476e66ab5f6
SHA256cba541808db6b1dccff2ff05d2db0bed36d7e33844153fcbd35d82e751ca22a8
SHA51292ef8b00dc89cb94df7747304bc28c4162e8edef45244a058ceb4cfa8a039e103dcc2ee9aa641fde3507db15374c9c44796ee5456b196e1b8c4f0f6c74ce603f
-
Filesize
691KB
MD5fbda7de6ac65a82868d4050ec4a068dd
SHA1e00deab18f1b1dbb14ddd4a027e84a93bdf158ff
SHA2562b89ac649ae1679121fbe2c44d4e84588821ee2ad2ba34dd0ed8579ef727dd0a
SHA512c4b41eb67d78f835f4bb675028ac753ac08fd358e6f1cc8415ba63b3a0758d2732ebf2dea9e7c35ba73fb2bd2369f1bd76bc13dd3ea3b594089430f409d15649
-
Filesize
411KB
MD5801c8f02f89c24bcf092cd96ed0cf246
SHA1bbe08201e54c907aff7041a787fab2a4234ea088
SHA2562b86ca5c691542672198af1e9912573618862dc6738ce0c81dfb00008533e993
SHA512ef6586940e23ad062a8ee31c23e0541e5fdb96a3079a43687db6ce1abcc753c56622f170752d1f890701f20be53e1f466ba6049c83b7cc9a2b3fbe77c6ba489a
-
Filesize
360KB
MD54bbb81171b49bdbe0d774d08912fb595
SHA1240f66819ae44d29103864504cd07ce3e8f612dc
SHA2567280929a7f7a437e5d824c7f39062a70c7a72fd1fc46d8505648c78c57711bec
SHA512c1ab02d66d1a1d69c21f364816aa312238f1e422854829eda78a5947e6bf6dd8a9791c0b3c47b43ddc39d03da5ec6f6e685e4dc4aa75a12e2c9a051dfc69beef
-
Filesize
861KB
MD5a42ab37dcd70dab106862c80a4530832
SHA171f1392a014acecbaf653e59a6fcb0f2ba27893c
SHA2568d83f40a329f1a1c7e10bf14d66bffa465da671a0002979d2c1e7164207970fa
SHA51257dcf71269338841d504b06294be98d3e8670cb91801591bc1f2317602adde3b441ceae33e3f800bf5e7696bcb99de5b4234e35392835ec2605bb08688027a79
-
Filesize
553KB
MD50554ccc4f91221a543770d6821d826c7
SHA1f409406326da088b6f5f843e4d8f6f39ee913b1c
SHA256ef91aa946294840e80f0345f24e0052eda2b88b528402de897048e8ffa119a33
SHA512edceec1272723aab86aad1406901efd648695f5a91b579a665ba53a1397097efc8ef004278cbc11786a7cc8667b8eacd5fdc37a1ff5b6ee8f9fd616b100c320b
-
Filesize
434KB
MD52b023e3bfc9cca41edf6179f353e8068
SHA14e644adf9603fe47adc3d258d1cefa1165ee6ac8
SHA25655acc44f11d7ae302a2c3cc65349d86b9b0ee246052ca8893e6cdd586c145867
SHA51257320e7c1d4edb6d2772aff56b1b7dad2b281774c5d2a01cbd0ff8eb84d69fa768dc5ed9a884b5ee7f6cb8fc56153f68b57330258620ebcce5e89e9e6aed3339
-
Filesize
367KB
MD5da8c5a8e7b00141d87ff2ddc1a93a362
SHA18797e0e6d96759c6fcb58ce2662edf5741ae37a4
SHA256714918c2881fec631e966542676171454b39af973548fc8d2e64e4fbf3961759
SHA51248ee16af969af1f5fd22a7479530a077a801ba7959d22292fab2823d2854c35231355c2f1521b6c48021a2bfa4cdf51fa2bd26f14ff13b35e8b06ee2819471f9
-
Filesize
522KB
MD533e9d95d4fc2b44639188c1ebd6f06ee
SHA1f5f269c8680494f332f3a54dfe16890e75b9e6ff
SHA2567b00079f52fae99cb040d68249b86c7cebc80fbdbb04b11d531684d11f70fe84
SHA512ecd1f83de9934e7a53910d3a99fc2e2c7d638c0db691711210682b5a72064bf35916f0d68b9f8269a5e7aac28c96979181edd62e76ee54656aed6573d511e11f
-
Filesize
489KB
MD5a0e0b849b0168b27dcbe667794cfcf82
SHA138efd0016fb3efd5f641c375e7ba2d568a57c469
SHA256d44f9e1c31bd8df66c9bfc476d426142bf5b7c96baa30774f061210e3d8587c6
SHA512fa833aac9fae4cb7f18472dc6757c8bd538e5e88f34af95f3d1d08d5762fafc24b1a7066287586a7bda25a5332b460bcb9ca93e602b87790b3f2bf9626cb26af
-
Filesize
423KB
MD5a19a807e5ce5273f3c65937f04f7ca00
SHA18028f27ad27290dc8874e606d8f683e8c9db4483
SHA256f62c682b6047ce33623634cd314a39fe203b30c3b96f4548dd56ca3878a97bea
SHA5120fd32f9b370e28da409ba398dde1d2c613ad6097a47cd5582cc11b44a0d533dd4fa80901c2a95c5405cb79515932ee0004455503db3a6bdbdccfc322c156bd98
-
Filesize
462KB
MD5b727242cd8f701d7adcffe88aef70464
SHA17d853c36dea999418cdfac9ba3c42a7a393bf6fc
SHA256b3a16fb4bccf9302e0ebb6ec9cdc7f18abf1804a051fa4d729909e0f1152a8b1
SHA512192c10f3ae38e32b4fb5a02328d8fbeca0845e9bdb628c33e4e3d699ecadd31e90411f57a2971b16a6d4635ac0f9360647a6308b05ef595e7897fa65f58952a9
-
Filesize
565KB
MD5a454925171b423d6910ef475437065d3
SHA1d22894a0bcfc7d8cc9fef10746c40798ec648360
SHA256cc6bf09e99b721834673b0cfd24498d78c13f992313fba0a955cbb75c4a77b64
SHA512a1eea13267cb210723e5d62651773970f0cfd847674d8be05c1abb958b41df27943b3bbc459f0415986c434b187ea318bfa3d19b95ae232610b495b2f1386730
-
Filesize
524KB
MD54d33d934226faf0c816a8f19cfc19545
SHA19b6b68ba63e7b2acdffcf6405f0e8aca18b98954
SHA256233ee3fc98cae8ce5bb4339e5be44ec37769bf8b7b273fed92b1942c723824d2
SHA51267a583b1fc2022fb09c24c68bd4ab4f9b96f0f5e1bd16ed20feb2f7f99a1872001fb345dfc034efbbcd21873a8ab93acb023a448738386e2de572fd990c1bada
-
Filesize
316KB
MD565421a1e75e62de398098a934cd96ed0
SHA12417bf2ba4f11c58751512c2cb0b9ad411416b4f
SHA256ac63024754f121cd72448d0d2ad5c79cf73f5fe4b4c4416e24a3ae7b6d8b9d8a
SHA512f9d9f05eefabb58fd7953d4ccacdf12ffdeb169971e47906be299e26ad9e28e4e53e27e674dd526668bcb8c3582e31f8039a41bbfc7d4d682eb67a32314e8774
-
Filesize
373KB
MD5853244248f9c00524ea51e08f21236a4
SHA1f749eaa70fb7ff5e4f107c6f7884f8f7250d99a0
SHA256d7cd123a79c21928fe63db0501cd8e3c2357f5d1754fa5166c36e5cf15209d7e
SHA5124e14621fe59d0e7e31019695739f7d602f5a41ce8f6978636fc278af4ab7a82a8d26ba81839ddb5a9818e4d7f0e6e51093e28dcb594cfd3968c169faee88269c
-
Filesize
445KB
MD547d4303cb5b3cf82b5a30c04bd204c5f
SHA1ded3094596bacced32fd869a8b2d263932b60c7c
SHA256526f780cdf484bd7dde3213e07eb3bed982cf4474b1c93718157729682f1ac08
SHA5129f58311be0995e6f2cd9770247da04c8491f35515434861f415365db50af2caf9c36c83a71851bf07153c93a971a0ecf4e03f13c75fedf0db388b1585dbb9652
-
Filesize
436KB
MD577a76b15a082e3078b3991a23ef847ba
SHA144c27b279302457e4c4c6b55dafad59f639ecab4
SHA256dfe5fa26b60d9e238fd3cff0811f17ac56f95a9ea217fbbd4d54d3a6ed5588b2
SHA512827fced4e1103e00170fc12bb5b7738bc53adbfa3b3a4f754abb89e607269295c5c12aeb75b4658991a4fdb31d8fcd8311713d552f632201908ee37364a2476e
-
Filesize
230KB
MD53fbdf0bca35e20d052f85d33c1aa18b5
SHA1af48af322dd8b0456fded9a40cbe27ddbc5606c3
SHA256ff18df790b1bab249e037f06edf6a841399d18cef0f07dfcfe19ee6646b3cf7a
SHA51201fc2dff43cd44ea33764766358533a997a808b1be68ab9df2b1adccb2cd328b6391ae0aa69a375d336d2b69e01cbd83254ca620a5565ed2f7a7699656484fdb
-
Filesize
1.6MB
MD5bb485e70467396b88b2a85763911d240
SHA126536d45e24f210543ddc1848c2248ca73574adc
SHA256c5444ded644453f241d120e2839a192cbf4154b1bad2e07611da6f37ed63de30
SHA512eccbef0e789b0739bfb310ba8eaa91fc73a35470f61eb060c5eda2ec3124f624aedbc13cab5bfa67513a5ac4224587a18dc987e2f5c2fb8769ce5a02aa02afdb
-
Filesize
1.5MB
MD5bbd66cd9a8d28cc447daa78f00d40876
SHA15cd9839907752d04c2a4afa0deb95b7a5bcd2a80
SHA256a08bed7a413f061bd9c7e15035a7b95762e0a2ed3023b69da768bd8d7fe694df
SHA5126278064af67cf6421c40bbe219fc0cb64083270dc355de57a10926464c84142d163090fcbd1528a840ee9bba71316655375d647df0a66025741abc7fbe74bc14
-
Filesize
1.5MB
MD5d2c6326ea5668b25bdd390eab9b8ebab
SHA177501ae909636a7317e1d0ea087f19fa18328b49
SHA256f93ad8a63b4b4c4e490e3640258aea3c5ceae49c0c795b14d258a162e96da06a
SHA512de0b3fa99672edf4681c29067b71e5127806210de02a7e9f4b8201a9a71a6874eda91f6b223067264d874df0a5213e6af3c43ec653530af709456385871c5f28
-
Filesize
1.3MB
MD5ae8abe526a350a0b92863a18d8876d7a
SHA1bce203a53b937a3ba6a204735a3a17d2d844f9a8
SHA256204bc0a9ec3188c14d0d553abb3312d8073beaef30cf76ecb040712c1b96fc5d
SHA512331c8202bc88753bd14de7bce7712e75a4c04b7c1a65082da05dfc73989d5ec303c85d955c61dd3223d05075557dbe803f950580e2d3adf42cbf91c378b160d9
-
Filesize
5.6MB
MD5e5faacc94f5971773327d7f52614f165
SHA13880e1069fd264299384ac79f8ea27259a172532
SHA256e7cef74a09cca1049e70076459497d05ba15de4ab5c16ae81c453c99095fa734
SHA5125ca1f1b074879d40accfeacdd33e6704b7a31f051c5894a506b44358b08bc353f418f82bb8d3a19fc3b11492dfd74548b17cd3c4f0a80657b430b2b64fc36177