Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14/02/2024, 09:55
General
-
Target
2024-02-14_df95d6461fecc0c0bf66b4228369bdef_ryuk.exe
-
Size
1.1MB
-
MD5
df95d6461fecc0c0bf66b4228369bdef
-
SHA1
08894684ab058ec092a9973190aaafbd7688f849
-
SHA256
56b5887cfcdeaa23fb37327efaefd61980f74fd0b1ac17462394825bdb72fa6a
-
SHA512
2699157c038a88a9090f17f00e8a56d15b0cb04f81abb01b03f1e7b19ae741d8a843a959486b3440321d43d9245904013df1378fb8bf6e522bb1f14259a4891a
-
SSDEEP
24576:xSi1SoCU5qJSr1eWPSCsP0MugC6eTFEaDKLHVebOe2/iJ46P3DELQDq:xS7PLjeTS5e2/RKEm
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 37 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_df95d6461fecc0c0bf66b4228369bdef_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_df95d6461fecc0c0bf66b4228369bdef_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD50e726b16118cca077f4f5f1ab2e8993d
SHA179778ac16085fb9fa219b3287a9a9b93115629e2
SHA256beb1dc0b13c3347fc165f3162c4d2e135c39ecb7835d7ffa01475afb7457cc7f
SHA5123e4ad2c9b0144b0efec9c1d8bdec0bee32fa3b3e78d09d2064695a0cef88657f7c8b3d6a1cf457b5382dca508c8651c0c9a0758225d2d93848943d2250e3fbae
-
Filesize
1.4MB
MD5011beb9622a39a3ccabe18798bddbb48
SHA1a8a6305cceb116b8c7d9ef849f886ae18fb30cd0
SHA2564953735d0d0dc565870be0ba4475a2e5d8c42dddd13fc5e102b6f6f3337cb771
SHA5128e5819d9a243bbc7d2d95f4051a9be8d4a8f3e30ba77466670c92bf555e3330df81466122df288f175c7012a093bb998200c82580f9ac0476132afb2e6380626
-
Filesize
704KB
MD5e8d86345859e90b03fd0d1719d997d94
SHA18832a4cde73a18021539891904505f5371677dbe
SHA2565eca8fa2cd82492d95008cc44094a5f399cb42bd95fdd8a2d766cea28dc262ce
SHA512dcefe62b4a7a43235232bc6aa324e900e4e04de20e1483b3e1e34d3621fb4987a24e677c91dd9e05bb2b51da9d103221cc6408c12a77aa4460d0ee11ef572fd1
-
Filesize
1.7MB
MD561fbb69098e00af0355fce2515cd889e
SHA1987579a052532c684da5ccdd1e76efe183541358
SHA256260b794ee2bf001297d69e78aecbc8b10d9fd250896c2294640592074d85be91
SHA512776785c45810ba6b93d83abc1fbab119f99ca42130148828d56168eea0e0aa0d13d72ea7c7935b4b0c0c2c94d40a63299ca78e74d34aea2687e2ee856cb41190
-
Filesize
1.5MB
MD5b81bc8fa3f4375e413d8b0d708f3ef84
SHA109af4d75f1fae49786c7aa5a3a7fd37704a2bdff
SHA256821557bef25c066a973319acf9f38dc1f7afa4730c2d8b58ff7ecfee5e4ff281
SHA512c2e98e99981d6a5039598583720c5564b0f20ecdf4647c1b76bf0e67a9f1c709e60241238563cf5d7e81676e15186a922614aede62da299c7048a2d0072bac61
-
Filesize
1.2MB
MD5d92276134e64141170373548940a14fd
SHA14f051c9d5fbd45e78cf23ef638701424d8f75e0c
SHA256a87736355c460173d108033ffef82ba4250c7fa5254af2388645e6e46ad20a51
SHA51221ad45ded10f97b9daf6ae75a180364252f06dd52671cc568a7a57265494d24f876ea353969f97e26fbfb33376466b3e7f71e8630f9960d7b259874e9d07da4f
-
Filesize
1.2MB
MD5ea54ea98b06dcd6ce508fe2d5f1178c4
SHA1e40b1a72706ec83e919068f8f0da493cf90e1c74
SHA256f072fa410ea7a30e704c592748f5043301b344e140a79ad577df6aaf78536626
SHA512bf09f5ee3facc819e7fd07ab4f94477fc866de07dd5e0aeb69621fa09a9978b87f2ead1985b9cde397a0bca4ad6b230cb0d090491f4f7d4eb27783cd27cdd148
-
Filesize
1.4MB
MD57271f761493c8c4272a355bedba812d8
SHA184f1526b9854f22f8f9ad40baaee2ff2e40f043a
SHA256f93288a6688fda8102c4739a372272e22f0ee328b310c3574457e597da5e395e
SHA512ffa4b0ec72a0cf01099a3d3c1b3e00d1b10c3be1c57ed9db9fe60d02ef39d4dbd572d685001e4cd54b72e99def000c43669a38af405c35f2cae4dac475114e9c
-
Filesize
4.5MB
MD5c35ef0d06bd01266c8bf212f55859e8a
SHA1a761d92d56a7f3792946c873cb1a26c07b5a69c6
SHA256d1ea88798dbafd4d288837faca8d48364c7181ef8c18829fe9ca5f729cb72dd3
SHA5120ca287a1cbdf24e106f2c6adc9744c720274f7766ae566a59d79094be43f0923dbfac318b21f6858c58d3f152cbe3ba087d06b847c15d265d2474cf75d8892ba
-
Filesize
1.5MB
MD59c261b5bb1668e13ab44b1f2b11714e7
SHA18f72754d00cee4f9246571a84966c773a90eae5f
SHA25626c69fd3886b6e1f8995445b009ffd46a381f2c3155cf245b7fa0a40c87a2a5c
SHA512f57fe459c4bd5b5290e535048efed671fce18cbd807eaf800516f1f899bbf7e88793866b83c0d8007e1e6e885a31a5d2af6eb05b6a09a8956952ef52abe14340
-
Filesize
3.7MB
MD5d63df77fcb60d6ff9f70e60bfd3b1a92
SHA1170a371e3674462f9db665fa1055ce437827008a
SHA256add90de83dbf237ffb64cae5c7b70ee1ea7a3d04dfbbe1ecdfd7be8a5bafc891
SHA51228410df1fcaca2d779ad328f3934998632bbfcdab8dd48045ff34585255e4f2f8c0c119e6d0c0255ed6711f93c311e82d155f392a196ca79108ca6afaece5f88
-
Filesize
256KB
MD5de74b44048a0cf57d9e04702994af167
SHA1ec2d19a0c4e8cb7012245ae7d4bbb4b8e5f77f9f
SHA25611f883118928f6f11bd6a63c8cb9e6cd8b146bc86bc6e8834ddef4db086d205d
SHA512e11aaa18ee80fe762d5b91cb005fa11bdd057848914b66cefc54f7afe57414091589dfb521b63c972b7456a59b8f01c309844f555d0ce93a61b795ba15ae6499
-
Filesize
1.1MB
MD5b68695c233a7a88fdb395950af4cc64a
SHA1b5d72cc9d299079fdff6a774742c4816e3db5041
SHA25678fbabfe664e4753175a78b508511092b8a69f4086d6c11416a357dc8f19540e
SHA5125b0f26bd2dda314f369f36b7f56bff5396f5a2a54e1787db51c619aa53cc3c9a6507728e573aa63714aa80c901f7b722fb2c097175837e399e9bc0565037e69d
-
Filesize
1.4MB
MD5af6177558178b69d8fd978771ea91104
SHA1742656de82778aaefce290126d2848d6c94d1b92
SHA2560ace29274d7f73af03a283d57061587171d882d7ea8f4cc70a2a260f64cc5216
SHA5123ab0647cc0beba0ae6013980b95c63448302bacc9e65d3b1c6e85cce74ec21c4afe67ad5135cd87bca1189a9168bfd70d10e05d068939a53f018e98eeec429dd
-
Filesize
256KB
MD511336dc248a03fd450e0a6797bb10fb4
SHA115becb362fbefadfbb8cceb3960e734c1bfab95f
SHA25690e0d571e7c5329ec1451ac363ecf8aada743bf444fe99c3e0780b698ef4c646
SHA51201e4e0b0ce3d18e337e1d91f4adcab00fb565e1450c27675ec5b283d41008dd8f366416c078ba854227ae16909d7aa5f06dd603f6a5bbe36fc69479d33eae123
-
Filesize
256KB
MD50bf230901c2e6ccea0efb633cf6b75df
SHA146bfa189f8db8bf67ac36359dc0d4042955bb973
SHA2566cd985f832759d10ef642738dae4f83725df1826599894a3031372bf83dbf369
SHA512e6ce1f1c8a61cb73a6f38769d6d6f11b06f3ed2777a6cc8a625866238dd7034a40a73676a9b036ae8b74a46ecd45b60ff2437655cd9111b1addcc47f43781035
-
Filesize
256KB
MD5117cd28c08703bacc8c06edc6b247c86
SHA18c3347a6f31cc9c8a349e4b9c5de4dd9ac33237c
SHA256c24da4b26c9b04cbca920221fd421480b98a71aeb3f9dbaee718c115d6574afe
SHA512407c9d8472e50a168eafd94d61ed13e499bf5b3c815d700de4dc82f87d68806fc190081c44b75ac597e1e0f8f71c0834a406220e51640c1022fb3a04873c4b35
-
Filesize
256KB
MD500c24e1de58a819f9bce46f49cd5a15e
SHA1ae97bb3ac34f7b5e4270fd01c3236e7eb7d4cbcd
SHA256d3f3668d657741ed7614bef229900367be36f2d9939c14827817f583aac93d1e
SHA5126f98ad437514bab36e958f4e42cb0efcb091ed5040f7c8345389f210ef477a14e4a3696a8a24d3e70820832b268fc2e94903a1e610bc007bb5973801c737edce
-
Filesize
2.1MB
MD58797d9ff56fed092387fb6e6df1c94c0
SHA1b171728fc9b64e4b0c4315630cd129c12fc6da21
SHA256d7431a54eeef81d393d963f0966cb2f2c2434d23a39732b907b25f208cda90b0
SHA512b2c08bbba60eff6ec381e3d81bc7989f6e0a87def35d9c3c54e877327206bcb9b7330d187000221e6fc3f407934d2b1f08f4cdfa70602a0319a9d35d9a473125
-
Filesize
256KB
MD55c299fdd93eae0c6618fced4dd0cc81f
SHA1f42c767e366d1e08dc81593d3ac5abbf788b55a1
SHA25642c564051c209e40dde1ac13ee5a2a37baf734f085ecef8f2b6d49fc4e674f76
SHA51264fc4589c0e1ac31a50a6cb665e14833c252e9aad7fc697b8a749be9f3a54f39fa1b0871b84e9c7dce3dee0b7d17e60e46fcba6a12fa516a0a1cf42ba192ad66
-
Filesize
256KB
MD5d681d51289bb8368f5f9023fdfdfe3ea
SHA10ddaafc900b265a31809245095386bafc10fd324
SHA25638d1616329f1f7fb03d93fa614d6c61c3196e4f8d3e1e5de2b2a8267d1e42321
SHA512cdaa9185599d2bad4eddaa1baa14c1ac07632ac5784086b35edb5f7ce5f57295e81142afa0fa447f8cb7370f8d7c9932c8a65f3792cf68437cb64683ead597f2
-
Filesize
1.2MB
MD5d1dc0cadfe5ad86f0f31e7074c0f7a50
SHA15c9121c3f65b99639830effe9ba22acc809bad6e
SHA256340f55acfe71731d8f424074bb701816883e5caea99a780a6b0df7bce9edadc2
SHA51244cc28aab23c8b0957a48f94c81f0fe6fc31a61eedd5ab14d79836e60ea858b87ccb5517148393efea9cbeb40ad225d1294c153d0dba20ded4e6a7371de1a255
-
Filesize
1.2MB
MD5c48a370fae2ded0db730bdcfbfe2f802
SHA1c221d5b861794d23d9ac5a1efc16bddf79b0bc70
SHA2568cf909d51840a4ae53829d4f753740da33e4bd9a3e36b9ee544d51323e9e2572
SHA512ad1247b60d1755de67cdf8ad59b2a28f688888d84ad2af6c6da070136f28db816585a999c8c079ad36dd7a05dc39efd0f20ec6605fdb7561ead953dd2200f73e
-
Filesize
1.2MB
MD5c81688c252f2932d87b266fe19f87588
SHA1619c5d16cc5fdcaa86700d5a17db4d08b07178c1
SHA256c5abb378cefe0187e7b588797e5be0c5e85f840b38d2b124bc268a08ae57ff5b
SHA5129db39eee77bf1392b8c9eaf58442e8d2f878d98783e8c75cf2c0b8416792ef88db40caffe053d18e2ad22336b3665c949e53c741d213c1e6578a72fa7f91e289
-
Filesize
1.2MB
MD5fb0c04a59c4c71854c310eadc7405c9d
SHA1759efb0c55bf7e3344419f033920eca84810eb8e
SHA256da9ba76ac7877b604405945c546b2d3a7d06cd5395e26986e536dd5052d80161
SHA5124d976289aee760242552ec769969d544febdb0fd696e6bb2f542d4fab6c6c7548d4f0aaaecd1bac78f08d34bb2f40035ea8a79af5a05d3a22470487737b0f27a
-
Filesize
1.2MB
MD5fec7d33c5129548160faee6ebe5ca595
SHA1169aa40bf98afdefdac28893086d4b7a934a0523
SHA2564e325a6db6afcbab39337ff67c26117c15cc9b749f37d27311eec5ec4ced05c0
SHA5120ba6ee2469644e466729d85e044308681afee9cca3112fae7f2547cc48967c4024ab6b2f9f5b64b2b9681f2862816b3e34914b732c799834dee6254fd685cc26
-
Filesize
1.2MB
MD5bf01941330b2c607ec24083d879aff5c
SHA11301abd38dd09bda660a6a5aaee43e2da9bf8dea
SHA256161c281aa5cb448589549cab9abf08d8166562f969ca4a688a31abc1dac6b444
SHA5126157eb7699f15113d07375d5e9924c89f5d37776f79ad1f1104716f8d43ad220719397730e2c5bc5012e2efa3e3d20206a761def67829d32432c0ec95d914ae8
-
Filesize
1.2MB
MD591b1bd73865fef52cb4b40738750d9e6
SHA11b1c230dee71a4249767f29341e170a32b504a6e
SHA256bc8d765b380f18019b0ed2fdf41223bf0bac9c4e50e279269f1f6a84f640b338
SHA512356fc071b00a544874afd8893266dd887310332abaf3486bfddf5294ca3ab650611e83850af2e773f29140726f44ef2a0e8074de728850a148fd61af7e2f264c
-
Filesize
1.5MB
MD5023577f98dc42d2d159141ee7c543e44
SHA10d7fbe2a21423a23469c79c44c8dd719a27668bf
SHA256b0c59d0131fc6f853f2717d8b861a8198610e514d635c0d3dace91ea1763fdb7
SHA512584f69434f22fc2156d00bcd0517603cd35e6e9a83e241a50e32025edaf44b6d241321c870d7357b504704dd3f36e482025046b8c160187adc5f8e0cc8789446
-
Filesize
1.2MB
MD507e16c12da101f8f492a2e195ec3bd66
SHA1985e19602b34863a2e09acacd66a89cf3a6dec1c
SHA256423b0d28fcd183e2e58dcad444fd0f6f7149c36b50e7d7b19fd097fa622230f8
SHA51247a2e39f28b738d253c34b94ecc2472bc1ae9af5370ec26974a1f44e21344318f511f788e0dea47764070548b332545aa0734b615657b8e4f91846a6811c986f
-
Filesize
1.2MB
MD57c4f50a429f88d502d14e023ea70f12a
SHA1a159c5c1caae9d007b589c6bb6add4c943aaaab4
SHA2567013e18add5082d1512796848c49fca201dffe4c5b6e4207fcd43bd45a60f6e5
SHA512cc10c9169fec80aa57ff88f0f832a0f05ec669113dd840a260426733cd555f52b339e3654a39565df844ef632d7bb24605b7e9aeb08a6e38a0ae52eb4a05c9fd
-
Filesize
1.3MB
MD5a64c1a4634e964a067c0cb811c570e4d
SHA1d297cbbb6015d00be33ddc9bfca7814788ce165f
SHA256ce672b0a61d4030ee82573c8a04566558225e1cbd1d98845e75e3d69094245e5
SHA512ad61f18601b2d306f3a9a1ab04a728ab9bce948b004fe3f9a7cdf2bf084af06a07de19c7d9defecde9bb558a125bd2fd7fea19ddf6b573e5db32c531099b4142
-
Filesize
1.2MB
MD502e1f92db5755ddf8ce46d8d49abe7db
SHA1549b79f0400a430c531c5d52c04c290e4d76d261
SHA2562533cd9b9c3bac20adbe1657008541403860ccf71d9062fb53f09f3e3518fde8
SHA51225216985b2b5ec13f8a8f1fa57d393923f54fdd5dd0e105ba2c58af02448a221df0417742f5dc1cdc4d470a1c37beea0517e06a91e761629f2c2352a91400610
-
Filesize
1.2MB
MD587b408f7cc657baeb5c2ed0a3de70264
SHA1895daa458223ae1f257fe53ebe48a8a301c89502
SHA256cc14d6803cdaab393ae604c4105f25e25023864c6b4062524196e9cfdacdd686
SHA512c7e94c1a7bcd9c3acf3a052142faf143dd081863c79976cb05e6e0697b3ccbf2bc46be61ff3c4298aa1a8b6f49a62f779d2c5fc84638316d8461bc4882d73e30
-
Filesize
1.3MB
MD54d1724ea01f49e121e15dec29306e957
SHA1aba0b5686c693254cfc0eecc86684ef137a12e66
SHA256a8658aff245ab4991f9a4b0cfa74b0dbfe1e8b3e070d531572e6c55c7d69d37d
SHA5125b4f11626ae10baa8094c024daee002ecfe02bc2fb62626e833607c9e1f11fd09bcaf32b9c58a5c6672235d3146bb31619f9de58b8311ee386365413e8a58d29
-
Filesize
1.5MB
MD5d79ba820e5e99c2f054118a84705a77f
SHA1424b2795eb9317fd1e3282ee603bd9c6570b4341
SHA256bc4bf1d5e5db49f81f20a77d28713c7d82a283fae637c4419ab699d57fe621a2
SHA51205339818126ce11ded1763df1343afcd49026770ec419afc347d8a86f6ad6de7d583a8978efbd1dc94acef4addf875fec4e61e62fada60224167ef86007f2643
-
Filesize
1.6MB
MD5420273c44b6119f94540a0a5f546f3aa
SHA10bdbcc7d133c0e4b24f8352634e35ec1dcb6d105
SHA256191322ea1ab055f61365b4c17a3f6bab2173cefaf495a8919033ae35179a3611
SHA5126a1680d4ce3d2845fdeca0d950eadda771a62b9b37c33fe248b25284afb4dde0684c52ca85bcee54e5aaf84d7ea77aedf1c48e7dc19a32ab7f00374e613e7d8d
-
Filesize
1.5MB
MD5a54d059885400417f94d56c16b078684
SHA1b664dab8951abe8289cb239ee3a9909446798ce4
SHA2563b9097659276c32e6c30d0e0cee5238364d7b3ffc9f57b96b28e970e2ef66bb3
SHA512c5ab9cb6fe050494c0b6254640375b7057c46e1cd744faaa37f510f26ee8c41ab94fb6dcdee95546061453ce3e45bae8d918b5547e6705cc47e4f456d482e40a
-
Filesize
256KB
MD5a6338c32709c7739b81aa403e6383ce0
SHA1098a6ef92a4c377c087fb0aea6eb426cd5cd3643
SHA256c2f03833a3f89e05db90afa70a7c1d77aef42df898b64401e861d99cdd6438d5
SHA512477965c7589d6d4488d10bbbf04b1187d4c71d3ad41b6054e7e6019b9b91c8f80e8ef8bf9f955dedfcc755074961b9854282de746dd4346c79d4d8f9df006bd2
-
Filesize
1.2MB
MD52dca44b3cb48ae5cf22e31974ef2cea6
SHA1911b902f8364cf90a678089780f15fcd35227654
SHA256ca19226e8ee78f546592b7d741992eb04de9b74f163cb5f1897f3545f3ecec7f
SHA51283e7f4c6d83aa215d7878c62f71222ffcad76373b2480100683305da130b7de3bbc08e4bcc0b51ae700f05d0cc49d6cac56e3dac0ffc44a9be9dc6c37b602adc
-
Filesize
1.7MB
MD5bf1319d379a9bcbe384ff407aea4e65e
SHA1016144ba6a56a25dcef754213312eee57cb13b8b
SHA256498c8b11134748b2297847da529cd08ec6b39492c6fec104c61d0679510f602c
SHA5120989b83ec22986acf1c682149d28d383033751636d92a7fda945531d658948c289479a26ea62c87622eb44f36bfc7e65cd9d280173626dda318370b6250e44e8
-
Filesize
1.3MB
MD52224fb5a7384048711e0cd76ed0f76af
SHA1a7d7ef7311cff0fc17947a97fac0faaac63447c3
SHA2564dd48e811907ee86e86b56fc00eb3573408fa7482e5fbdef32f38a59556e0954
SHA512cbf882d96e5fd4e96fd387d0d19faf4a259cfa9d71951a38384800cf720186f1d7b9095c259bb73f9f7194c448d351517c180614f1c508a9aabc8f48c17c0ceb
-
Filesize
1.2MB
MD594cc1bb822a619a2d2cc42c1eb8b9bed
SHA1f5d3618ad9810ede50fb851e89babac551dd646e
SHA2568ad8db3193ccd25d89ce1ef16a2bd74bb23f3dc2db677990ee718deb63c2280d
SHA512ef411c6608d2be5ee29c9efe4fddb74c04ece7653bd34e6ffd92d4f429ea2167b0a1f4a6d043e6f9a4fd113b7bd63d20d145db83b555f957707f0fb851467ab4
-
Filesize
1.2MB
MD5bd3e5792ad8780dd6d9b4d241dc46acb
SHA1ba43712c5785fd60ab6ab7a345d264f449fee40f
SHA256efc5f4ee59f5c703ce5f6568467e464b56a32e01f9e0bb3767527374eea0b078
SHA512a6f241f47aa6486325b2e78e9861e942a070a6cd805b15c88c7480a7471dce413ea8fb6a6a73b0f40a5e78b7d1bb14627f1ee55f930c35ec4de4bcab39b41349
-
Filesize
1.5MB
MD565f75474c03340d1e29b5a81355800fb
SHA1fe9f8d1cd50a72d62357ed61ce8d5513d11f2584
SHA2568e13613717fc0f7b8fcde42c9e32350b3fc8fac50233f2ce6ab22263b24450d5
SHA5122c841985a9bb317b0c5fe4172774844d938d7a331dd8d77aaba9fca6aab089db68cc6db35909505870981a109c4facf5564120d601212b9fc75cac40099b9e92
-
Filesize
1.3MB
MD5398e03f9e3f173fc9c4fb457d4403d95
SHA1a3d30b1c511f8b63513eb73105ce07da095ce597
SHA2563fbd4fd1850ac7e441087f71b4be2089a35a56ba043abeb39ed8661849615612
SHA512c7519d28ba0ce4530a6edd56c7830979b64589f81e8d188ad1a454f6174fe0eb8f73279ec0f11b5fc98da492b09584abf0df618915903eaa7c4214dfe28f929a
-
Filesize
1.4MB
MD566030a84ae1ad0646e1c9c36e828fba6
SHA18604193284668f03316789b4d4e1aaf4b36ff5e7
SHA256ec21da22927d9a1a4384f0d42c9e0d6b5040eec770bf03968125d217cd601204
SHA512b6fe1fe9142e38d0d5f0061ce45b278ef3a46128282bf7a6ff8ba31ef74fe9d0da49c65b3d66dd86bf5f8df814f79e4ed21a020ed0aec507137c2c3a43bf9ce7
-
Filesize
1.8MB
MD51854216b3f5a96b22638f0c933520b0b
SHA1e0ded8c1f349d0968f8a025f457573931919d481
SHA256d6b6d4e5426ccb5ea56a2d5e8d3d94ac9f847985ffbffbe0d60c8c1a22ae4722
SHA512c580943e64188e68cb5acfc1ba298a006235c36a4d7cd9040480466bd93b532739337c050081fd3d012df1c563b34da082edcff2f13aaf8137b7f9c29722b792
-
Filesize
1.4MB
MD51b00c8c1dafdf185253f26892be17c5d
SHA1e548a685ef59d2caa221d8542caf2e6e678bc5e0
SHA25662883356902289dd65d2af5d435bb2b887cadd2115db895b2039f96d6a885f8f
SHA512bcbfcdd68ca4018d4bf08280226963ea96c2ae933ab405a265ff5802d9c5ca67b02bbbbc3b714eff89e3878e67aa243cea056a98590187620fb06454436377e5
-
Filesize
1.5MB
MD5b56597e0d0a629aa89ccf9f50f06a8bb
SHA1a8bf8061e35df02a80d17604eb9653e25477dcc9
SHA256f807e0aca4839652bca450c32f0ebb490aea459000f12ab7a72787275ff31cd6
SHA51272eacea477c6e7f18d54c16d002edde76bd5867989e0ed5ae2e4290db15bf12ba4b55defdfb82647821c1727e4c43be5ff362e9e075599c6920041b495dcce1c
-
Filesize
2.0MB
MD5de69870113a6e62717c491f4aec00be8
SHA1d464a990a9b1d1c7e9270fe05e581122300b1c16
SHA256dd5c2de3ed44d4fef64810907a274ff7ad08e2b31e892297150bd7870965cdc5
SHA51243f80e7f754d9cc7564809446e9bb64ea1b1a609bb3af594b32a325a2167a02565728cb8f355dfc30bf99d92381c51556fdb1515e7a7058255118b7e8f2fe7fe
-
Filesize
1.3MB
MD5b469d52503738dfa659c10d5330d1e0a
SHA146d5647099284a22b47dd47acba13cdf160c627c
SHA256bcaa2ccf6422ec19ba62002391ba44983cfa5269db23fe66015ffa904dab62ff
SHA512bf736309cc736fd996fdb1098137095cdff7a74a287834b8049eedfd37d1efec41a9eb4e01cebd9ff451dc05d0f74e918c300d4f4c990dc22b50646a1a4c7411
-
Filesize
1.3MB
MD54d3226a70286c77a2110b61d9df3cf92
SHA163a467902bd4313f25e71891ec76e04637d4c199
SHA256d693f166d6cd008e5074a02bfe4d35f8f444eed5a7f2594655c70bd5059b90e9
SHA512828d3b737770c2eaa1b3fd88890025c5d0caaecf83472abdb999ff3e94a6b6c98e40ad6e487353c5663fee8841d679fd0940c9b7b3a25bc320a6ba144f44b5eb
-
Filesize
1.2MB
MD57dc394e4d3917dd7020ce1dec8fdf8f4
SHA12fd7a4cfbd85488fbcb2ae19ec60cb7ec24904d1
SHA2569a994c2b73659107e0cfc20ff0fa71c96a3d94c7999c670195de9cc0163123f5
SHA51212cab1157e1ed0c8f8eae529d742ad212b3fd5f5fbfd0dd72f33ff5c0c35fe63294b71751766b503eb80dbaabd8b793e5481a7c0f8d3649ad1b8ee2d76a93f03
-
Filesize
1.3MB
MD522f23e65807081ea0423eef39e4596a6
SHA1e52cb83a867dacbfd5a30bac72a2fbfd7e40596c
SHA25674bbd7f1f64c9c008ba5ecb288a888cea689397fe5f9533b5e6847357278df10
SHA5128de3a2ab5ee2cb40467ea7848f2d3d9ccfd68aac007616baa2e58f90e07ee3e97eee97378bc0c1b0f35db8dc5d46c72201d9570608a75bc9f51ba05e71f4afc7
-
Filesize
1.4MB
MD5ad5914da0e5ab63691d90749c461e9f4
SHA16e11a282a60052f6825d8d06641c0c67b8b702ce
SHA256cae600fd9221f443837629b768136f00f95b2758220623993f1bfc374f65e76b
SHA51288c857a7d5b2c9a265d23284f50445afeafbfac7508b807e88f85599d21587ebd64b0c78de05c7403a35d625f1a0eb890b77ff1503cf6eb2f76105885de2034c
-
Filesize
704KB
MD5bc362b68594f94faa955ef461f4b1f59
SHA16e9d65687c53357d4d0e8ccd96acadbb7b26010b
SHA2564a9f43d46cb0e9897fde837b3f7f7a3098ef1e4d2ee50750a0d4a89eb06c3fb2
SHA512eace2fc53b9a11f16969f65af4afa4eaa6ea81210dcd623f07c8d18addef6113ad4218ab8f9b770453b45c742da94bc0617c06a2b0c418831939fab20583cf31
-
Filesize
1.3MB
MD51099410bd12efc61a56c7f4d41aae7c5
SHA130ab7d58ae7fbbcc3b2f8967fd5e628015891fbe
SHA256a062c6411b2ee568237080dafb6573b4a0e7a6ce34c54a36273a779740a12d22
SHA5127bffd535e77d89ee9578ad47898a29884d0ec9e0f93316ece7084a7fb9b406a83f716977dca769189e8985b5b0a80bd437032fa05196aa40e71a254e46f5388c
-
Filesize
320KB
MD53d17b721942ebfbed4d88d06a297a913
SHA187ff2418a70237baa1ac0e3ff06bbb6ae66e5001
SHA25616a804d056013fdca71ce670be7879c847211d313c15737dc48c48aab6279ce5
SHA5121a7d8edc6fe8be9338491ac5e60849a12924928c804838c5cdaacbd9cd6368f2dc9606465198af4f5981c990279e090ea072e04720a59987c4a0cd0410c1a57c
-
Filesize
1.2MB
MD53e4f54d607410bf86bd5148496616b08
SHA12c5a4de4f0970f4d9226ec630cd059b857a38473
SHA2562b70c6661a03f19ce44c63d138f7ee909ee7075e555eb361a57cd0e20a539a2c
SHA5125c1201d2bdb8f13ecd8b1f1237f6ac74829c61b273c5ae4d5415e56bfd02aa0362bcfe357a0611b433167d65129c3f84766aae1e10480d97b41119cb8ca12509
-
Filesize
5.6MB
MD5f1325404df8857cd5286c469a664c962
SHA109c90449b95f6402d68b2124867d35059f5e061a
SHA2561cb44f18619ef2524971d3d633f6fddff88b80e725e69e35ddfe0aa1cd4d545d
SHA512d8a4f6bc0b728dca81fa7ef2d92cf614166ba5428fd70bd4f0bdac8155d7dee99d28366b8c9b2a872753c85427771cc5889c69e94d1ca12150940e2ec9247727
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
412KB
-
Filesize
1.2MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
1.6MB
-
Filesize
384KB
-
Filesize
1.6MB
-
Filesize
1.1MB
-
Filesize
384KB
-
Filesize
1.1MB
-
Filesize
384KB
-
Filesize
1.1MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB