Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19/02/2024, 09:32
General
-
Target
2024-02-19_43de03677ede6f012b26a4e2ef563d02_ryuk.exe
-
Size
13.8MB
-
MD5
43de03677ede6f012b26a4e2ef563d02
-
SHA1
952dda5242f68d246cfdb3d86dba56ec7843c6e4
-
SHA256
e3bbdc685744de1c5772abdf2d080d2b4d0d758563bada7a7a41b9d03535166f
-
SHA512
23cf968f61a83186d872aaa7bbaaf74016956dadf5f43ff42970b8fdac85d82ed67ffe4d759200612b8a8ca2840a0461f013822fcc6513b79210913bdabe60a7
-
SSDEEP
196608:X+TKnk3+z1Niml8rTlVeE0mZF8PiIik9AnSou2G:XAKKmOrTlVe4QPdik+n
Malware Config
Signatures
-
Detects executables packed with Dotfuscator 2 IoCs
-
Detects executables packed with SmartAssembly 2 IoCs
-
Detects executables packed with Yano Obfuscator 2 IoCs
-
Executes dropped EXE 22 IoCs
-
Loads dropped DLL 7 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 38 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 56 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_43de03677ede6f012b26a4e2ef563d02_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_43de03677ede6f012b26a4e2ef563d02_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\2024-02-19_43de03677ede6f012b26a4e2ef563d02_ryuk.exec:\users\admin\appdata\local\temp\2024-02-19_43de03677ede6f012b26a4e2ef563d02_ryuk.exe --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=91.265.200 --initial-client-data=0x2d0,0x2e0,0x2d4,0x2d8,0x2c0,0x1402b3270,0x1402b3280,0x1402b32902⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
\??\c:\users\admin\appdata\local\temp\2024-02-19_43de03677ede6f012b26a4e2ef563d02_ryuk.exe"c:\users\admin\appdata\local\temp\2024-02-19_43de03677ede6f012b26a4e2ef563d02_ryuk.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_5072_OVSXPZLJKPEVYXDD" --sandboxed-process-id=2 --init-done-notifier=844 --sandbox-mojo-pipe-token=11271442000663977328 --mojo-platform-channel-handle=824 --engine=22⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
\??\c:\users\admin\appdata\local\temp\2024-02-19_43de03677ede6f012b26a4e2ef563d02_ryuk.exe"c:\users\admin\appdata\local\temp\2024-02-19_43de03677ede6f012b26a4e2ef563d02_ryuk.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_5072_OVSXPZLJKPEVYXDD" --sandboxed-process-id=3 --init-done-notifier=1408 --sandbox-mojo-pipe-token=3526963570972709129 --mojo-platform-channel-handle=14042⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD52ed86e1fa9145fa810f0bf6aabf85b08
SHA17fe47ee8153fcfd5685309cb98a57b1cd52510a4
SHA256ac365c9d88fee818708b87174113d2ff23d68ed49364fdf1bdbab04872706242
SHA512542ae2244a23cc6429b3605fb07f73e284913cbf3b286bfb1d43f3ffe884ed7f2567f0dbc4c631b4f19a5531ffad2e29a4a639494e23d351644f6f088723e3a5
-
Filesize
832KB
MD5ecddbf219150223facd53e40ca5af8c2
SHA17078b974a40070181ccaaa6781ad786d059d73b2
SHA2561b8d6c9b7ac6ae27e6f76c83c0013dd49aee2c00051b9f5df9c992dfd540329a
SHA51261d67dae82a0d7b0765b43ad0eb5362e11d6b1eb18f8fb8a95d01ec7a14a31a6397ab9805ca6c6d72e680e1155029bd8111fdad5c78a1e3567c61b0c794db88a
-
Filesize
896KB
MD58b275c5f3428fe1313e418a5b6eaf9bb
SHA11b0e7066d7449891cf687e038e381cc03a3eafc4
SHA2563a9fb29932448ad55efcb9a602755c5667da722c2d9f4b3ddb46d40c2061e747
SHA51216bfe4bb4a7036e76b3c6bda12242bd6ff6644f63c436b140131f62a152c730094c30e7f5936f6ef98bc1f08efa0d125f701dbb13ad9ab39659a992baa327fad
-
Filesize
832KB
MD55082fcb5d3c7fce0212178814261af04
SHA174f3c92f3a8b6dd58541730b9c4676ac6bf00f9b
SHA256065dad72222350e4bb6fffe3512f06c33d6ec0865f6566ab99a90df79c9fe6a3
SHA512b76de79b3c01d0458e199b9fd38cce63268b2de6950fd833df77331296679859d8d13f6b6e5deddf82ecfde2ec3001174dbb4aedc50d9040ae34d28f5f8c2ff0
-
Filesize
640KB
MD51f7a53b99b44acd437cd0a5c4487cc98
SHA1c341804b40978d53ea5cf80bf15e130b78c6b1ac
SHA25604fd5751c3c435f52fe1513f860caebdf4316c9960a02277c1a8885b5522ebd6
SHA51205dca231cfe8c3b67404fbd70797f57c2c98feb4134a411a73a5368738bcdfea142ba96d907fba0fad4d01cd639b5f4247ccc5d2c593d7dc502ff73bc3429cd7
-
Filesize
576KB
MD5d1b52678acfc35c6265aefb2f060aa95
SHA18d30fa862dfdc404324eb1c9ee9275e4451ff77a
SHA2562fcd37b02eedddf78ec3ed350a045931d10048fa1799055f981f2caaa24107ec
SHA5124088c57d01a63c807ba723c8b296b4c98c4ec89680daecfff231815a8bc7a3067d135a3be0eabfe912e6476d96f86b7c7335d2d9ac80deb9892e0393ae79e674
-
Filesize
704KB
MD53bd6a7c2214e882f92d86a04c69302f8
SHA160a57f9fb50d302d5ba6981a0bb95d3ef59a93fe
SHA25619080d041f4b5c495266da93c448325c98be145da61499850f495c248a0c2c20
SHA51254d802a49a6d82bc0bbc049d81dcd425bdef0f83ca5ef61eb619ef5879cd7a708f249b62462084a0cf64c2183c01e1ced980c7012a5e382fff8214071208784b
-
Filesize
640KB
MD571af6a98659300507364e9b81e127dfe
SHA1447b3cbcbcfd9462918d7df996c639eb76795215
SHA256134f7d36af58be7c44f811351d544f7ce5d8b366d6128372a23d62a2275b5007
SHA51224d8b6d142250680b0544a39482de1b08b9413e6335b43e95f19129787ac8ca0f435c37423202867d4ea26195328d65adbea43e920bbaf628178e629e5c02fa9
-
Filesize
128KB
MD5226093f7a2d3643bb5af7e9debedc1b0
SHA122928f92dd4b1a551ca5d89da1ff632b41a34b24
SHA2563062a7cf5b8ed8e4f2dd4180d6b00dcd8046abc6e625d38aff291055a1ba5136
SHA5128d2a0ae40c74b24714eafea6f69e8d3ad733d68a04a880b277ae5bf98dd0cad64171e5287036a5da9aecffa72b4268f0ec295ad7f5f4df371a434048e7e42d31
-
Filesize
896KB
MD581d094f197f555b97433cb27997166f0
SHA1626b5ff07aa8ac6aeff5b14aa2932861f67a49bd
SHA2564e7f4f7eba0684d411a6aebefe014fddcc51240e572c5f1d8c58466278c75fbc
SHA512025f24401162c78c7676d108c42e793f689962a88995f01fcb1323c438be3c82c38c01c48dbfbee1001ca66f9a82ef1f3167224b62c82134fc2e8b7b721bebee
-
Filesize
576KB
MD56de5df6af58fd3668bcc43c1453b48aa
SHA1260a6a3b59e9d11ed971f02d2f5228657abc5ce2
SHA256d1d3351f11226f447e4c340f1465cc5d1cce6b414c44bbf6b6e3716d89b6be9d
SHA51204997fbae45af0b4884f2211db615c327d4cc9f7f7eb1c54785bc1a73a4d7225d1a9f33923c0e4559c84f43d097e374858545aeaf8341f6477ca711f8b36afdd
-
Filesize
640KB
MD5c794d96572016dddd3eac3c93fa7e6ee
SHA1c26686686818c4b313ab1ccdd33271d27bdc880d
SHA2568c4d4687224204ea928cb74877b68c9943575508cefd6494e5e02df57693fd51
SHA512c8f4242dd0f1f3d92919b2fd0d46f643a69ddfe05fa2117a8a893ef82b9f36bfa62ea05057b39512c3d86b74221990ec2ef1b01774b0b9e1e921858d27cf0390
-
Filesize
640KB
MD56df306dd3010026e92069597a74d5f53
SHA1f17ad151d35f23015ed41f6b36bb592c6e00e7cd
SHA25621fe81c5f82710d2dde412d5bbc4f6f70e8386e164ba4a379e8e157c68dba949
SHA512bf06b860177b7cba726e15c913741c723455e370d23d3cd4861c0016d60e5d61166be8797681313871dfe5a1ed39da11027b03ebf56b13dade578bb7e647d628
-
Filesize
1.4MB
MD56cb7a53a94785ae806dc7679813135dc
SHA1a6adde3386d7464f60286c33856c5ec3d16fac49
SHA256c49789908fc1f2135ee6f4ce66f2cb05296afa4204bdad4de1fede8f464bcdfe
SHA51250ad4c2ad3603200f05932b78baa49c9128860715c224d31cf480c7a8bf1b4256655a5bd895e8d004f57dc0ab781ad171a17a533dc63b222e519486943370dc3
-
Filesize
640KB
MD535de0092058d61238c5157256a577f93
SHA1c1b134ee36746027866170e89f1571f674904829
SHA2560ebf76b65851c9ef07dc8645d87e315cc337010373160ec37c4d45ca1c9792f1
SHA5121f64f0c46e0920efc8bc72d1b31916ae638bbe72316f126e4240b732864be559dcb6ee8f1717175d07726c48a547c54c4f1b8bc6287fc11f5cdabfe6de0d5bbe
-
Filesize
2.1MB
MD5513d6bf342735893258225736b5a46d6
SHA18cac681b621b687ca64309b4e25b7172a8d38a2c
SHA25665c1e08cf4b67bdc42c25561c61297ccd83174f5c32a6b84adc8fb4a72526ca6
SHA5123d5770b8caa7c55d9c9d4732e8231840683193baf5326f52ce34cfd2e6240bb18742c3e35a705a3dad48ea79ed75fbc4a0d708790bea0cc521faf99fa4644897
-
Filesize
576KB
MD52fb029978facd9701a0478f082179da9
SHA10034fb153beb2fcc0a85086cb1111c66677e1dc2
SHA2560f2e053029b3075fe20776840a3f0f2a2171ebd049fcb30433927d321c705d15
SHA5128c698743ffbe2b8fb7b65bd2a42f567d05c6fa4983b8d99206f7ca2ee0ac2bbb7028541525841f3b4c470b76b6c1b3a6426804eda4946a6b1ee4c55564b043a3
-
Filesize
832KB
MD57b97d408e931eaab3596c3e18fb6c038
SHA1d58fec82261588b8302283f320a134a20c8c43b8
SHA256b0c5c07092a6a2dd0c16b8f2b1a5f30fbacecc0490f3a08dc51b42addfb6fbc5
SHA51298aff47d93dc22a891c0d03155a85ec0881a21be0e8484e2fe534d57040914e90214634b365ba73e4208047bbd79489946e70178e8599209efa6199e3a551e17
-
Filesize
2KB
MD55e31b4881862ebcfe91913cab37f27ca
SHA14564765c9f9a4940c02c5bf187263d159ba09805
SHA256d486795835cc6dec2eeb5b5eb0dbcbf7427782ce211a89cd1375f750195d099e
SHA5121cb926352650e1a4c7e6ef3946c408a46766c99b4410d560f315f42f3f4c1f9211572489bc48e3000dc586262d64b45113f1babbad9960ad7f9e73c50cc99d08
-
Filesize
446KB
MD5e9a7c44d7bda10b5b7a132d46fcdaf35
SHA15217179f094c45ba660777cfa25c7eb00b5c8202
SHA25635351366369a7774f9f30f38dc8aa3cd5e087acd8eae79e80c24526cd40e95a1
SHA512e76308eee65bf0bf31e58d754e07b63092a4109ef3d44df7b746da99d44be6112bc5f970123c4e82523b6d301392e09c2cfc490e304550b42d152cdb0757e774
-
Filesize
36KB
MD5d0cf72186dbaea05c5a5bf6594225fc3
SHA10e69efd78dc1124122dd8b752be92cb1cbc067a1
SHA256225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907
SHA5128122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285
-
Filesize
360KB
MD5d6385decf21bcfec1ab918dc2a4bcfd9
SHA1aa0a7cc7a68f2653253b0ace7b416b33a289b22e
SHA256c26081f692c7446a8ef7c9dec932274343faab70427c1861afef260413d79535
SHA512bbb82176e0d7f8f151e7c7b0812c6897bfacf43f93fd04599380d4f30e2e18e7812628019d7dba5c4b26cbe5a28dc0798c339273e59eee9ee814a66e55d08246
-
Filesize
2.1MB
MD5fa3b06879ec3dc4835ee5ece11a84fb3
SHA1fdd904b5546c9781f88c9e5d7b1682aa0c5235f0
SHA2569fb8e31929fdfe9e96911a2d59ae2967896288428a4ce1826c87ecc782869f17
SHA51235fa1ed94c49f1160b3204bf845c004693a85309aa4bcc48d6fbd22f9f131eeb471bad96b7bb26cf18ae86b9dfb36cf20068618113d08b12f74371030800f2a4
-
Filesize
1.2MB
MD59b1e89ad026dbe4e357485cb16b7c263
SHA1ec47c11341433f089dd241cb3891ee44350d5314
SHA256054876bb76c8b0d4d7469cdac77ef33591952163d3d11317749a5e9d840ff007
SHA5127dff5f2ffa8743a061144263c15e4b549309ffd5db4c799ee8bc21c51714efcaf8f5410083ffb3221eb4591dcd77001c39c98db56267e85023c5029bcdad0421
-
Filesize
4.4MB
MD50d1a647e72b099b42de34bb69dbb146f
SHA10ddbd77ba71aa9f3a7ff65a0fb45c05d13a94a2f
SHA2569a5a405362c111d42d89113b58b9a305a762ad8f0f61638619c3309bc742534b
SHA512e4c1f78cb1dac41e50ccb6261a0b00ec0d4e510127b8d109da835f77c06b9216f057a4879c32a1b02b658f2669dab2c61a2f7e8f2ae4d270c8b06f1fee996bbd
-
Filesize
12KB
MD52cf93034b169af2ad960bb9294b3421b
SHA1d30c399123376529d809a0e1d29f9a2c721ff663
SHA256e6486b1f4ae1f8b26141b5eb20cdc33b4891f97b54c03eeab60a2d1f9b293650
SHA5125fc20e730cbde408bfe753c587597789d5837dc3afa984898cd7411c55586262ce54f441a07f23f43b73e3e8870318a880a99663bb11c634f4164f689521c719
-
Filesize
1.2MB
MD58b4a4f0da3ebfe42799d07302e63b576
SHA1bd763fe138f3c3665426132192608a516e0691c1
SHA256527130e69d0c54b8165aede06b8834987ee9e0a4bd9ed879c380545f1ad9560f
SHA512b7371eb6181c7b7efea1c46a47f3f120f277a6c31db099903017adf601c25f495b78319bf078de6364bc4b520886d129dbddaf26cec39596e78c7e921e82b343
-
Filesize
1.7MB
MD5ff4a805e82fef13a47b4a33c1f917e29
SHA1cdf591201435a1095b1774b17cf0b778a39c9ea2
SHA25608d48ba70611dfdba039104f9b376c0672c90371bd80aaf71162fc368958aa79
SHA51202e5f894ebaa71ca5fcb9e2c390da7a98609653d622f2506230eaa422fba6ac2629a2846202d0d70ce11e22ca1f84e6dd8bc463c245173712c4abb3621bdd78c
-
Filesize
1024KB
MD516c44f970a5cc84ab7b2426485bb6f8f
SHA13ee8626e8cb08aa14fc98df29e5f4f4e1ee74fa8
SHA256b1a0e29b2882215341f42e48f0b39c4645e271d081d8c5beca31cdd9e8575baa
SHA51207792ed441cb50a41f5a34b7333dfddccde36ece381882f7428c698e25ebd1128d7789fabe9b7a4d5e177bc6160116e2a0b256dbc6c365b84ed36865bfd228d0
-
Filesize
128KB
MD547b70d813e6e0b46af5af8a840e7352b
SHA18778e0c95a77f20b79323bef220a68296f7738c1
SHA25600bda9bd2d300c33a829d6f3935d65171e51632170f9799454148203a6af06da
SHA5123da93bce4b08a7e7e78d7a28ff1d8dbf1e02a7733ed6cbe5f605f6a1e25ee9eb6737dae3f7784b493aa882d34291fe6672fd42e59519ea75f56e1b3a2ab1a6f6
-
Filesize
1.2MB
MD57397c5af0859db8c3c5923c16fe69f50
SHA1b753c1975ec91153c54d7a36ee6b9aa316c607a5
SHA25632bc5a8dde7815b2e13cb3a2dbb52e4db87cf56a34761df06cfdfda984ac768c
SHA51242e5482e9e62e27614451e3d7a3d1573c8ff378e885c5e41e294384c87edda4c79c27b4a62d74457c4a00351ebfbbf3e795bcd637d1c199952586dd4d6c57afc
-
Filesize
1.5MB
MD5d4851121d24cf1603d0ca7fa01919a53
SHA12b419890c4aad2c27cb0c7e0d2b7315adcca0255
SHA256fd69e62452022fb667b185e367e853c4df5ecb58d8ae35876a85398a538641a6
SHA512c84ccb7736b4bfeba102a6fae4c0fb9ae45b24f42cb8a640efa5da21aa1e123f2c1702762aaf4ceed00a9c3978886de2bf6ad04690eeff96803bcaf5e1f20de6
-
Filesize
1.3MB
MD540a118e35b8e4ccf944ca4a99bf5829c
SHA19ed7ef4eefbcf49e619b02e08b85c38270cfd46a
SHA256c6caf7a1896cdc8d3bde028483f68a7b46f155418cde4cbce2367f1262405bd8
SHA5123c631816f3a1b11246f67a191e023d7fc1f55c50b112b49c3731ae694af5041927397362e7bed62141d739e122baab1c8a3b3928db49d41b279da3630976c2bd
-
Filesize
1.4MB
MD56e4db8812f10b79764add00e6fce36b8
SHA1bc614b296fdff2304fb1097e78da82006b9e5c76
SHA2563896347d5ebdd25b81235fe83ee8f11c2ef2bf323f76bbc27923da9510057983
SHA512b173b25795724df6d344799da2267c10d6ec2e6f4167ccf5ec826f5d204d64858b329c02258416c55ee090ecad2500eb10bd19da25feca38bbbc579c42cb2943
-
Filesize
1.8MB
MD54bedb1c1cfed5125f75acf0199395189
SHA186d74e0a89e72c1ac1643128411769c370435a07
SHA256540ebbbf1860137921c0fbc4ca6d57960a17b97c5972c2331fae928874c553b7
SHA5126a0d4156b1c569807cb5ee86dcca70012e4ae12bb8f905404946456491f06678cb5eab6aa6554c9ddab8af33c5845ef3d1a2561e6ca1837401a105f9e20ce9e9
-
Filesize
960KB
MD5668f8e53093b6f328fcb8ac2defa4b93
SHA1349cbab81184f4e9e9c8b40f1b3d0fc87bb8ae7f
SHA2562375baa640004095eaa5830b6fd1b6721c253ec63c14e1eaa6f746bba53351e4
SHA512669ddd47363b86708338d40cc966dea64b3523a4dd279089901090eb4afec49c06f49843049762d3c66d1f939546dc36161b26975a740bb98ac7bf87d8817268
-
Filesize
1.4MB
MD56d3a02cdc4f1a34f908cdb330da88830
SHA193a22ed35d17f0606259d5f42860860ee375f505
SHA2569fe326ed3f54143b15ad9671f95d563136663e6344b4ada5b00fabce99491718
SHA51232d80ba2ec7bdaea69ddad6ae38cd5d56b17acde69daccc7efa0f9407fc2763fc691fae11e1ae38ba0a19318d3769a35059a96f446a7e46187faa897146a893c
-
Filesize
1.5MB
MD5286a8343e2ef1b3343f14f9bf0e56490
SHA1e590f55aacf09e7ab3ee31ff78139122598b144e
SHA2565f00db0ba5026f752e66593ec4f5ad25906bbb7b58e9797360f4499cc8f2e9bd
SHA512a08389fc809ca6fdd80267b6ebe27a6a6e86bd64990167f208691ca7ffd06c704b75ce4dc9a2d9a0d8febd00b778f2819cd93962340b0ac9e92ea235cfbe7608
-
Filesize
1.5MB
MD50012abfb71c65fbef92a63fc8350eee2
SHA17944aac92969a9df1b3fb303541dd5c0aef1f0da
SHA256243921af8ee78e304d86a2295da75ceac217f4a017ac0d21b6879cd646e93265
SHA512f8d903e28661c7e336cfa3596eec3583051f92e880f7b96c25611d3ad1cfc7f2db6084fa5d4b4167ce1d5760b831b57ca2401c0a4a973ef3554ce6a30bdfe9d7
-
Filesize
1.3MB
MD587ddba35e07a5481e2665d18208e0f50
SHA1cc5a64b26c754b4d2da03b1627317eebe9919490
SHA2567d8d188d2df4e743bdbff3ee18851dd2d66011772844a686fce9c550ea7f7d01
SHA5120be6dfc74686f28a187eed7ab733495c7fc319d4e72bbca74bba89c61740a8ab9fb54adf78b8ee9df803280e614687ce816e056466c3181ec9523d066e7281ec
-
Filesize
1.3MB
MD57633deaf5b3619120c0636b4349763dc
SHA16be8dcb0420ed22457c848fd3cd23383be2b56de
SHA256f368ea7c7a1b7a2ff70e8ab0559b809aad9661d06e8ac52a03156ac265a55c17
SHA512931754b878d144c9bd59bd281917387c058bd43e37a27ecd1ff5e22e081009ff20768b876e406d1a9086349017eb44cafff98910cd740ee847942ca8ad8cde6d
-
Filesize
1.2MB
MD555c8542edfed1f21527d54ee9e2390f0
SHA12d98d606542357c25287a51d4ea569cd7f1bcd28
SHA25617640051b88cb14ae25be6960f079eff38afa13c9ec407c1165d40d35df25be1
SHA5125982e12a35fd14e32d4fcf7634319549d9ed6d858bd532ae512ef71ef980ea96352a6bed687f535771234f72187cb8eea4bf555f7e92074ddae531bd813c8d92
-
Filesize
1.2MB
MD558f6e5fbe03db9b487200bf8d0be9bca
SHA1210c05e90f7be1a7daba33ee69f9f846b1fa0cb9
SHA2567c6c135de8f88f08b4494787c4f180262708c8b967be96f66938ed71b28a7928
SHA512ed154482a38114d8e97dd28838e17b765e97c68a349558f9f51ab9da0fe2fcac492811b1d7826eaff82532b8ff1efbcb3d99be655ede7cf9e87b3d5eb50297c9
-
Filesize
1.3MB
MD50727a1462132343b68c0996087238c38
SHA14b082988eb6f877f261954aa06814acf2b36f715
SHA256b67aa4ab153bfa7d23790847409003d3475c58962620a1901a1d289a13802c69
SHA51225ea2cef8d9b6a95b39500dedeec16387d265d76ba22d9a5738c59ca0ebf369460d6517b66b91e5dc603f3aed415f63d8708e36c1333651c988980ebe63f1f5e
-
Filesize
1.4MB
MD59cc53abef7f5d1cc7ad5e12d84308289
SHA1da77dcbe65dd822c85200f881507bacae0d12e7d
SHA256037bd1efd7c3256acdeb2c90374d68b65244cb91ec99ea8c67139724d724210e
SHA512f6b3c5f857660143f711c5576d3f1712500a6aa7ff42a181e3933ea2076de3694af51640d728df2366ba5bf158b860aabcd54a76093b0164e543daf3f9bfcc71
-
Filesize
2.1MB
MD57d8652908f76a2ffdf379b9744f27cf1
SHA136934f7bd1680b6ddeef3a0ba24a220eecb756c7
SHA2567e74f8d45d4dce718ea841a71c170ce94b1d1872bfdf769d61f09a519efb9a9c
SHA512a70af07ead2babf4884413f36b0c504d55af761368a1f393d377cb018310b4d6d4c83cd7f40dd906816133e713def9584169306f145c3e2fbac65b2f2289d2b1
-
Filesize
576KB
MD56f45fdd8d672bdda9767c7a241a28638
SHA157a5245a7035ec65c8a6000d7159a85ce1a6f942
SHA256e93329dfa109bdc7526ee4ee24ee5ea6b9d30f3d1a4fd2ddf42220f30973b658
SHA512d18bc9118d03b72b760bb01307d9b61a86be9b6b10f9d39d612ceef7e2eef4fc46b36bab389054e07418dff75fc770f6c4636d374252e494b19a9baa88101a3c
-
Filesize
896KB
MD5d115f9981cb599aa8fce046c30a7b03e
SHA1c7d9a6169f2a344c73343d2a680190d260e7d716
SHA25655743649ea32d3b7e96ce5a1b8671d9cddce11e0fb80b0d668c8979913d0bbcb
SHA51248b89fbb55fc64511f79b29de2a220e0ef28801c9b9577d7e55e442c0fabc7b7bfc0b8a7a53caefb52c4b09c19eb24aa45d42243ade43c21ba847a1432c69235
-
Filesize
1024KB
MD59d7ec1ec3aab189f21ee26542cf99309
SHA19eb61eca5ca14e8b115298e5670f21906a2342e8
SHA256a03e77cf79226d062551b3c77929a3506d46d94fdce36afb8931792741e0dd1c
SHA5127f1492918f09bfd02c1770c27f37dd3e12e957e394c87ea8c84d44abd1fc1b791fb070431cefbc9fd9a35885e89ca5d97cda3ff451018756446036e82fb55074
-
Filesize
960KB
MD560d58b8d752fd06967b555a87d822758
SHA136b7cf4a926bdf43bbdeb4b709e63b8d5caaa4d9
SHA2567a24e87b63d80efe16fb13051aaff52a7383bcc0675a0655ca6d19af7017b052
SHA512ee52b60a74349e635a21a815610990b8395d18b9c79a1955ceaed1723238135020f6cca812b6cf75ca22df1ccbc743657e643e0845b518509ad277ad17b73175
-
Filesize
1.1MB
MD5d22130aa7719c2751081959c3327dd22
SHA1fe383f7cb8404efef9b4258eeb21de4f486d3178
SHA2563c6dab5b9919f521cbdf7f7a9669c18c476f115dd3c5da3591a7fb5613993541
SHA512fdcf0196a26e663a526ea5cf9fc5f41c94f252527067e2ad96c43c1ace80e6ec72fca9809b85d5ca342d34b17d15c56e2e9ea962210a4271fb7f6b5ff2c82f29
-
Filesize
1.1MB
MD572969f1ca566dca1abc2c2bca063b9f8
SHA14f5293a8e5e9bba3747daebec228d7a8b3b37bd9
SHA256954e9b000d9f9c240a7b8f59bb00eaea9a38bb02619c382bfec9e47a5bd4c747
SHA5124b8942d2137cf2351a5cb3f6e2e8e9a2f3b2a94afc657927192990757e2c2577c14b4949e9756141acf7099db8d94f061f35206e16c7517840e239b889fb52ab
-
Filesize
40B
MD53a328e5872ad52a6e60166408ba2dba1
SHA159a671c272c6281176a6968b417b401ef15879d9
SHA2565b71317e4ad698f4618bddb4b35efd5ddb7b25998c1926f43b313678037c9e1f
SHA512ecde03995a65eae14b47a385c24027fab958af4fdfe767805fa4e5611a3b4c34d467df3e3051a730706520d3dca7f053d4d03df0e538914e0fa914ccf025c8d3
-
Filesize
4.4MB
MD5700943b61a069d745e6e34e972ec984f
SHA10018566e617ba51ed585f3eb381a42426fd7bf55
SHA2569728620f1abed445c2517bc17adcc99d93fe35eddc6ba0f9ed1ce5f3c4b5a935
SHA5127029b4eae6a4784189cbcab3493b3e2b1c34538f134b00a12190ca6dee3593e84c2d42a2859d0354008b99f96b81d8c8c9c08ce8692d1a2050751bfeb0b19b5a
-
Filesize
576KB
MD5169a2ef320119891cf3189aa3fd23b0e
SHA1de51c936101ef79bbc0f1d3c800cf832d221eef8
SHA2561072d49da0a70640fb9716cb894f4834ff621ca96d4aea1f478754edf4d0f780
SHA5127fe27d360bbf6d410ea9d33d6003ab455cd8b9e5521c00db9bb6c44a7472ccf2083d51034bab5ffc5aef85db36fc758c76b02fa31f0d0024c9d532548a2bf9ca
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
412KB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.3MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
13.9MB
-
Filesize
13.9MB
-
Filesize
384KB
-
Filesize
1.6MB
-
Filesize
384KB
-
Filesize
1.6MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
13.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
13.9MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
13.9MB
-
Filesize
13.9MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
13.9MB
-
Filesize
384KB
-
Filesize
13.9MB