Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
20-02-2024 18:46
General
-
Target
2024-02-20_c8563dd3adb82281868916d9e3a152d2_ryuk.exe
-
Size
2.2MB
-
MD5
c8563dd3adb82281868916d9e3a152d2
-
SHA1
c84886ce91d1a35d45c70087ba0c078e9534c256
-
SHA256
c4a6af9831f96673cf4b533399ab7a0634e0c7507eca112565206bc13e1c4ad3
-
SHA512
a566e6533a3337f47ad1cbb7aa559c6dce251cf4af8c538010244d264115456c9fd1b65f34ab138d4ae68f358f2940e839f58688de284a7c39e1b5477cc1c41f
-
SSDEEP
49152:uNl7soq7sQCr1kyG2xHywRfHIO2Ts4bvD+xlMPdlR8v4UC0Eg6ET7M/I:KD23S1kaxp9q6l2/V0cETQ/I
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_c8563dd3adb82281868916d9e3a152d2_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_c8563dd3adb82281868916d9e3a152d2_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD51ec80c5c76639b184595394f20f4840e
SHA1d20f8c52a3805ac17d716a634c55cedaf944a622
SHA256112f95f9842b03bcbadf88e280102e33e48be54dd49c0c2939ed8c3ddfcde769
SHA5126a50cfb711526e6c7b97f6bace0bb4e885c24c5f550fde198c86285c25c00e06b82d82783f54b3c5b30dca93cbe34a56f491f90c46894d7af8d433d751b91bc0
-
Filesize
1.5MB
MD5f243c70318a39e3f35c65df1770e2b3d
SHA15d2d2454f212b1a03fa6daaeeffcb0dbf36c9c61
SHA256723c31e4a243753a99705c790168ac29cdf005fb266bc6e30ebbb185d7be5d30
SHA512c6a04c55e96c8ac8cde4ac32595cb82f03086c48f98ff6af79e6cfc10f20add58f840acb12a081d87d61e7ff29fdaeda24d42dc7625ee8bd2ab7f549c98d6b2e
-
Filesize
1.6MB
MD50de04f58a0d623ae9ad78ac3bdce1c0a
SHA1073a4b6d59be66cd3494153bba6184c66e193455
SHA2567488ba6595494e5ddc4d65fe30999c9eafc21167fc9ec03aadca6baf812d2500
SHA51248ff98fc0ff7e55f68af839f5775c08b9427930af4f4648ae66bc6808b389d35193ad1349248d89241abd0ea6d649a2b9cc1483cd2c84dbe4281ac9850127c0b
-
Filesize
1.5MB
MD5782cb064f4dbcde6cbdd194a5740f027
SHA10b9f0bfa7d8c34aafec920668a8b749a4357354d
SHA25684165921d746668fa43a4af4fc250f5b89401c803331f8edf76a86621a177168
SHA512459876532ff22ce41320852fbd9a5a2a65e4c7c5620ed8bcacc8dfab5d69716d2db53c24b52f97a1ca5ace0e7f27eb3fe888b0545bca509b586abd99b7b22659
-
Filesize
1.2MB
MD5acc68eea9a95e85e7183b007319cb35f
SHA1b379f2f1fb7915c7c3df0c25923b4a6009b46cdf
SHA2565d344fee5506a338a79830ebf77e0b73208b08a2fe91019dba1b972a09f41bab
SHA51256df7f6b79f8be5cafbfccbce1f9860e279a823eb7fe25e6c0af215f257ea13eb2c92360c308f6806679cca3bf461b585f0ac27fb1c6f28649cfe92835648427
-
Filesize
960KB
MD57babdc8d0674215dc4bf55b379c69d7b
SHA1fd2879ab5c6f3661e734a8a3d29b243127961bad
SHA256479002dc6444ca09469a3a58d06cc70fd94b6bbbda9919d803c6745beee9538f
SHA51214edd486cb8fd75f23da46f20e731adb88bd2e39036da5a8cb0ab7f368a215b2320a3049233297f4dfd874efeeb165e3185eba0bc11372a533c354103d86cc33
-
Filesize
640KB
MD55eec86a13377249ea6136777b78f6dc6
SHA16098bed757d693dca2c27e49700d25ccaa799951
SHA2561e5a3b72143a5b7ddd87b02af1d5071a15fb1e874f70fb9a65abd4353a4669f0
SHA512320e09819e5e46a439323a6c7fb42a89d5ee744dc54c0a84bcc8a02ad5c1bd1fa1cafaee8ed5d1000455b995d6cb54496053918d1e0de698e658e1358cd1f1e5
-
Filesize
576KB
MD58044bef156123cf0f5e34a165322d8bb
SHA119d18607f2308e609eedae9f1eed965ffd71c0e3
SHA256528f807eb08427dd35c08c44bd75a43ea07459dc27389d3d33611bd3ee2467c3
SHA5121709442be47ed232c7afa7e5003b6913769432266403837292cde044270941946d6bc8edfd0c9b824215e11ca661d3e0e04323637cae3223a854feed7d99aeef
-
Filesize
576KB
MD59678449ad4465ad46561c4ac632fcc97
SHA11a1f954948e3f0c7a4f8e0fcbf17b982e3b2536b
SHA256f71c726f23e3f5039dee6a1afcc9352a7b1f95d8ee5d55a5ac5496297d61cc04
SHA512a5bb108cc2ad9fb1e7cf127570da5b7c56097b8232d06b14943f51c69d96af35f760db7b40d6f87fada0a3da31fe1f686ed640bbf458950652380575a070c7d4
-
Filesize
576KB
MD58953c501db306b3f04ed6c57497aa4ce
SHA1612e1298fd6ce027603be7cccc62acaf019d5abe
SHA256d4fba858edcb1b3c907c11c349bd4bc681b7e1268a7653d96e8bd5428891ebe4
SHA512ce802dca394589b5f2f5fdb53a28ebf132c77163c93c5566da2b5676c05289fb3c8b81ad38bef2da49f69eae501baaf5880e08568e114449bd348a5dbc854a1e
-
Filesize
576KB
MD5b2c7100cefe89cd4cb3a42b855fbfcd8
SHA1065a629afb676c4504dabd525b1ba40371474ae5
SHA256fcdc809654a4ea2fd4ecbadba5bf025e2308db2e48238c3595bee85528e2cfcb
SHA512d4031980f9e38cb42e75a3e8b9438a8bac58867cc70f736d48bed78fad7c967851247a74ee7eef0c7c549aef265667d07aa06b3dedbd9aaba4fbdc1cafd17f8a
-
Filesize
1.1MB
MD51da2fcccdf58665d6643c641db48fd57
SHA1b72fae06bbe81bf08a64840455eae3500bf7cd3f
SHA256a825aaef6b8a781e9aec08aec4983ae4e1065efe71f4377f5cd3bd5d84ce05df
SHA5122ef0aedcd6fcc74dc720b17ae6cccea4e9d702b16460c9770a86151c2c6186bb7e6775c10ef4d7cc62475dfad4e6af2935a4346bcd673be8c3ce3c31ba4e9f00
-
Filesize
1.5MB
MD5b4625e24a9ccc4df9dc3b88f305eb9e7
SHA10233bca55755ff7bf4fcda46505f1720897acb81
SHA2561ec73c1c659ef0b4d09b92545697a75d8ad6b908308ca78bb110e677d3fde305
SHA51221fb2b0bb93879565ae5ab47cc097ae4f6f4f56259be1cbd955fe1211021df43fe479147f1534a1b76168234814584432e2b4e51d92ab41dc940c236d5827ebd
-
Filesize
1.4MB
MD506aebbaf13429974fb7939090bfca9e9
SHA13f2afd79cc38f2c94d939085b21851bcda11dff0
SHA25648a8e715078a09de30f9ba7c38684889588588e2cd873dbb8d6db46eead8eefd
SHA5128bab6ab5ea22f77b035577eea62c0b080fa80b9f9850245b6ac130753d1907d8dccbe0e6b93bd1c86f44b4e6d6f1756ba72efa920eeedbb77c2950fe981479ab
-
Filesize
4.8MB
MD53ddb8d3ba9cc2374e12da42d440829e3
SHA1fa444b659d455ba9d034155153f1a134dac40d72
SHA256bcf271873d5469b52686f241def21d68eb3bcfb5cdbaa93d68c3120f64a62f9f
SHA512c99e767d2c61a6411162323f7b2ae312b194ab6bab330202e9c141b0ab448dd958fc0240d9c51e02de5182c6bd7cf88e03c1651c7342fac6f1d22d41767ca6f1
-
Filesize
4.8MB
MD576a681dddd3bde8d69d4043cc7d5d64e
SHA113d5618ce0dca96b4a6eb719de8d41b59a140fb1
SHA2567e83af5780a08e297ac32b57b44a9a26d6c1bd6e7497e7f89df843c4f0ded501
SHA512482ca6973d1dc5be9ab80f5e10416b7a1c33f9292fe75024ed2ce1edbef8238b17dc80c7fa48bfb1e801b7a2f8bdb84950b6b814b8382db5e2814e154a328fbf
-
Filesize
2.2MB
MD57fef8b18848c66a15562e03999bd560d
SHA152d2eb4fcc1d9d8b593482cfc4464ee950f0d78f
SHA256729658b3d3f380adb62cf637cdd425151170541db33d890cf1026465f3ef017b
SHA51225406e5899112e017d27dc4fed5fc4d16c05909ee86d1e1c78879639dfcfe8439083de112191c2a31e11b489339b7212bc66c7216b3116efc177466903949b4e
-
Filesize
2.1MB
MD578a4ad0e1ef2e1c36b644125a8ee45d0
SHA1ea9c82ee806c2ef3cb6a934bf66acebe4fbefb18
SHA256eb1ec77784592cd3eba07beb22e00c291bacc1345c7b46dd8581952c6a99703f
SHA51245cb9fea5fa6f37811cc328bbe4f6c501aa3c6559769718114941dcd4e1cdadf062dee3256b34bb2cfbc83261cb71e5e21e4d40849566a59da1c3875b431501a
-
Filesize
1.8MB
MD590cbcf5b95339accfe20daa82285b9af
SHA10de4dabb71463cf57862cc978a8b5c074b704796
SHA256cec766afe2042337404715406682da54c5fa127ece8d3aa8679e23dfa4e68f7b
SHA51262d4d4f525abb3144ff1ed92f70dcaf69c7e7a0cd053d8e7dd10913cab06120ca700a1d4b365629b600f12d8cf6a06fb32e3353e23f8b9057b651acf43c22c38
-
Filesize
1.5MB
MD53b1cbf29e2abd6d1310c2b989ac26c2b
SHA1b541334807979630a0363ccf03354aaf0e7687d6
SHA256c3d3b68714ece134d5a8bc598b4a537def47a944222c6cd82d10dfbf4d90dd7a
SHA512d5900854a72956a7e2bb5b9d1b9be4fe2126296b51a9ee1d96ae939efff27b44e071c3d4c24aac087737078a2b0e33d452b8b6c1b3b65d0505a9498606575716
-
Filesize
1.3MB
MD5b2a01fb324b54d92816d824b38ceb769
SHA1359592f198a99f8c47c6036baeeb30460474270c
SHA256d81ebbb6cbbde5ee935c47b9c8b92649ee69488a29059016f7e89ffca7820289
SHA512e2a8b3a6935028b96d89640a5f53799a8d3cc6fff83a98b1f71b687edf5aeba24ed90f09525ed876a37a09e7649d21000177dafedf7c814ad90ffbb8bd38ba84
-
Filesize
1.3MB
MD5de7e1418b2dc143219096b846de6914f
SHA13d0e8e8dc340848e0b5622ccd09b280b7e977000
SHA256a1a80cfcdd02935ee2ef735177fa3c05acdaca6c32062e41b926d01a1906e569
SHA512e024cf40a32eb996f4c40fea33b915e7eba49e8a49a0a3b18a4e91debd9f90212526aab85f7f8749b00233a09fd45fb843907ee915479b83009d2b9465a5c488
-
Filesize
1.3MB
MD55345d94c99b8520b43c4953bb3012ddb
SHA1aafa7973280932056fdb1978ca8be0a2350ed21c
SHA256ae65a54068abf2e05ef040841505cb5b008ceb75cc3ca483f395ef61d0851648
SHA5120a1d398e731cfd60115941b481dfdcf26c9b82cf1730c492df5a31ce087bea044d0b8b972264f52363695550a71ec3eeb3e721f18f22a999b641bddfc4e40a31
-
Filesize
1.3MB
MD51f78f5d3588a97362972ff22fa6280a1
SHA1bd1bdd5579c5efe5e91bece28feeb7a13fdd06e0
SHA25622b25cc75f895d67c503d89a972e41ab89eb4f012a0f75aa146ec6bb7d2db9f8
SHA512acd4d41a50b104f6c005aadd1ed96b2536abd716d71b1b655684a9a7a521ecf77cd1bf5febb93bf2ae53aaab3aa6777d372cea6b50bab9b9798433813c9e5e9f
-
Filesize
1.3MB
MD50b92edbed9cea17e29c2b954efe606bb
SHA1d8a14779cf1152425bffb63d89bd82d28e05ba74
SHA256957bd7daa4a1e82fa97049b39aaa419536da3d4663a1bb0a4414009f9bccc0c4
SHA512ef585d054aa15c59e18912ccaf37117c8ad9807a13007ad22513f3098e5e10a30aad39d356bf77c3738516d644b9e00eb3d95536cddeb99d54eb155a132826d9
-
Filesize
1.3MB
MD50b9249db696ad0326fef5e35ebba2fc5
SHA14f8e3d6fb5c81480be7bb43055fc44cd204c44bd
SHA2560940672e55fe764fc40b44780c532ae43b113d072e324b574ded4295c6cacad3
SHA512fbabedfb00575f6aa71fcadb4aea856bfa130e010df510255ce072b98d626df93192d52412e4fd1656798dd8182d145e0a6789c85ee15222c6d4984d3cbea6c0
-
Filesize
1.3MB
MD54fd56f0203a5d2a3555cd727a0ddff83
SHA1f8a0da2690ae2d6ebd6dd6376f199d5d1a9ed2a3
SHA256d6397b03c49c259766167e863504b13860f3d452135800b5258fa98e4c2e2c8a
SHA512bf6103b43af941b8e429922f89e6054b21b221a8dd341372b39a71eff3da132828c2e1d8c81e1a88bc47c854b6cc72a5673a53a12a549d62f2a4e3205470ebfe
-
Filesize
1.6MB
MD5c37d253e02bf915b5e698d60c1951eb5
SHA1649bb16e9ca0548e3de315962689aee33cef6020
SHA2560c0471c7d4229ee56ca5fc03bab3d5f7d7c70f351d03fde0f4c3caee82badc3b
SHA512093aa08555e852449d15b2aac8b00e7f04b64f3371e4dc7a4c170f565a3cbb8d9c23e05e07399c434803212c57ff6d34b9d22d369002c983964555f0474f3f69
-
Filesize
1.3MB
MD54c729bb8797096b97f7008ff2d4971bf
SHA184524ffee262f9ac56742c5464fe48ffa181150f
SHA25695378eaf50945afbfd43ca1ced8dc1ed302af1b8ed943a8686a0a8fc5ef1a85a
SHA51270bd96bd8e3bf37751bbaab8db5636d279d8a6dcab7f9a3042d4a4010d71846fd05bf57c182ff3d8efcc5161871c33188b356b843dd981ba9b55e5e56449a1dd
-
Filesize
1.3MB
MD581a9167de8639f2b9d6eb7348a64d3d9
SHA12235c443be5933562fe2afa05036d410b1e41d49
SHA256425fc7062d5bda8ed3ece225effe4f0c8a095869ecb4ac238558bf0f0260ba3f
SHA512baca579bef2b7728ab489a24c4d1cc82e61ee02e335fde35de736b45c8d1cf2413e9d50e932f3565e84dd896594c9b3d7e8c45f43846d055dc2d4fcd05e78a18
-
Filesize
576KB
MD5d06847d92e86964d4aa6dbe67be7d182
SHA178c5a9bf9de34372a711156d1c75ff19a3860bd7
SHA25614d377169f963693eaa32b933a6aba886e8046b1147375fea4317b5a79c58018
SHA512be6f76b8fae3d30d2148d39b094fd2d932af5d7f39c3937fc525fb5d4f615453295c322331569878a44a66e9faa0fcb0e87b735929bda40389331acb7ec3eda0
-
Filesize
576KB
MD581b441d9d6df5789825717a34d7805f8
SHA11a7d93b89df4be54170a97d4fc7c9a7492cead39
SHA256def9051c1852b216d3e30ff4e4d9870e5a3fe0b7884ecf717aa16ec884ddf74d
SHA512745637ab3d99612045a6febaaef66bc3ab1a3f5296ec2745fa58fce580d4b8655d1ddad9d9d699fbbce8c7ab51c7ad794c2c9fc70f74fdf3c897b3be7b8b15d3
-
Filesize
576KB
MD5e2eb5b0a3a6cb432766edbf46b212a40
SHA11eb7a16c98707a90af28769d9f21302b391ae327
SHA256374fd6a6921d449432b5b2cace213f0a7cc0307f6675c4204a56b455e9fb8add
SHA512bbf1687bdfd80269984e34db888278524f1167bf1ff03bd72780676b75408b9e5b36629f6df59e7f4d512982ef353e7d8e5a0bcd18195457becf872eb2bc2104
-
Filesize
576KB
MD5808e25496e72b9440a27c5591d7f1f68
SHA1f9bcda427e7ca1cfbe729c5049cba4563cbad26e
SHA25603f509acd9fcdd3c00e3d78030420bea5e22c24afe14ce012ff279f2ca45cf74
SHA512b4290dbe9bd9bf2bea7afe5a893a4e29849992bad3c1b0e836ffa96a26f01b56839fc7d61ec4825e485b53f956d7a199f82f1ed51254ed6bfcff046aca00a6c6
-
Filesize
576KB
MD55ce9b10a528101b58f5f84059d580738
SHA18e2446118de0a9cf7c16296a318c1742b61b019c
SHA256c495c3bcd0b3c7a8b51cf8b86e44a586c48b468665c8986190e211b1b84ac0aa
SHA512106afcd4486992018510f7a8337dc71cad2421fa70d925395a150bb1cf9c9e0fad6818bacf019669d616b71129dcaeea36c202a823cc089577f64607f841aeee
-
Filesize
576KB
MD57623cc41b1290f9d6189a78e9cd9e859
SHA1956655f09a64ffc91bb0bf37bc5b3c5fbdbce945
SHA256b372f05a131d8235b94bdcedace75b253c6e708a3803ccb9ae0fc097270cca09
SHA512314df441ea3e2c8e8001f9a6f5c06af1b522511c6e1abfdfd1f47033c8d1ccf7e313bb67c2f0da8ce81f102bae97db7da425d855d8dba27b57911955809c93d1
-
Filesize
576KB
MD5d3cb7c1dfb081a922c7541206b1e3221
SHA1edb706e8ba527cbf9822b0eb0a6edc48515a41c7
SHA2561d9ee2430191c98cadc046f12c9680db465f768f6653a6d4800770b5c4396792
SHA512cc67b38f83dd065377ff0583f7f3278b9a99db8e9dea594cc522dbf4b85e521cae4751a4b779de3cf2c8b2f1cd615515e38ee858219c99f069bea08c00de1563
-
Filesize
576KB
MD57dc121fd9f8ff85d35e541f4b1f288c9
SHA19b4cc7e8883989107b533e0428764738d79521c6
SHA256567ba5b1e91d0f9472bfbfc65485a7f5babd8437ead67969248e0b3eccaab2d8
SHA512059682f59d15a87bbf265d023e6c36b9e1ee55b9fac6a1f0330de05eb806e98c624d28440e50359ec0dac264b4830e51889bda72669981a4fadc29b308e37859
-
Filesize
576KB
MD5ca3bbd26b20f79db6b3a5ed6432fe4a5
SHA13ae8827f2f240f2e9973cca437a5f5894ee522fb
SHA2561ebedaf3a76bc20a7924e6103d6c326380a89e06da9777e37fd0ad976ad28b5c
SHA51251d8716a889c0f7d62cab47c4de87694962a8e0260d784842652dff727ca5e1d2bd4dce0906a5fcbbc4806e5d0d0a32e4d0f01daec94a84b1d7718476f57ad15
-
Filesize
512KB
MD59497b0ceac8111d3f91c14ece6dc4141
SHA139624f6a3be1dddee97d9566d3e8733baee38065
SHA2560b74a86a8848922c119a7133dc46949d56c5ea664410eb5762cdb83421538dd8
SHA5129764557be46d65a700036fe6f6f8ba313d171d1770bfa748788eb6554618be840ff89e8c6e63acc0c355eed3a614d8b46e2742b310fd620026b17320b1671cd7
-
Filesize
512KB
MD51bab72fbdb395a4a3669fef9130c56c3
SHA1ea92e94a745be2cec3d6308a01487be89cbaa9a4
SHA2567a18d24effab56c53d7b3a086d50492d3308e21bc688306b9b3023a25ded5c4b
SHA5127ad8a2b6ea3113db25034849172bfe3f460ad534c8d667e9eb7e58a9d9003db08d9a1d5053546eb011cb10df634b625c39f8a0e919855c62af7232cceccaf0ba
-
Filesize
512KB
MD57d72d8b61853892c1e017101fe56a54a
SHA191ec188b6050b4cf5ab04829149c4720d00036c4
SHA25651f76fcbe96999e68a7554719c9d5e12aa8d33b3d99296da757efe2db5bd6826
SHA51205a88d4df2e7a3c67b454a33556d519de7842985f9e020d894ae6180ab012b6ea537e021be4a31183035c90aa6f3975488e084056565d1d8d7cacd4667fb95e5
-
Filesize
1.4MB
MD56eb83435151d1a7a2209ea5726f98a18
SHA1fbff16b54e38501f40c3d120fc2d960518ea7d5e
SHA25655685e6bbb592ca50cb79d4c5899bc0ca286edec1c49802e0cc9e9f80b9590f9
SHA512dcc9f4756644e47927134a757e0cf1195415d8d5f145ed4ae87cfe86a0670a4ff12a29c681ac9f62e6cb1b52be6b21d40f64f82d39c2e9a3d88d0801b6108d1b
-
Filesize
1.3MB
MD5984704389bf54daae482a34dce9ba3f1
SHA18177be7ba77f39e4183b0dac0ecddfbd3aee5bde
SHA256e05bfefc9345e042f5e2b4019d8eb26fe12963c6fac52a694d852963a42b0b4d
SHA5129bfcdfc692e9fac3b18c4b11b9350f904b038002cf32ca6d2dc1a3a3998a51feeffcd0599402c74d6875418f0a883dd68fa020192ffaa2ea0ef4501959e18e61
-
Filesize
1.7MB
MD5a16b2c03f80719a330c3c58b24732c8d
SHA16804528c438a71f30d71ed5f25b8ea989d08dc8b
SHA2565bcecb1b52f821d6bee015940e01d4463c06368b91ccace79af9ea8825ec4b0a
SHA512bf4a5ac8edeb726877bb2dd8872de13df8b500403234feff21f6c98be770ec88a68358b3d3388505cadec8a03c4cd2f8e07a0646e90600c9878b56046711c2f1
-
Filesize
1.4MB
MD5714c430a773aac960c8682ff0dc35afe
SHA1629904814f2fd2ce9a38067d07b55ad0522914d5
SHA25694217bbad8461f9a74666d13856badfaab95d56e18625e747ce27414ef2fa6c9
SHA512d8e59808c2e2a9c92b52999898512a1df7c053f8648d9c8e9b09b125a0b3287b08ec6d3775829a975ed1a02192bf3c8b37229bd3631746801ad448734e71e1e6
-
Filesize
1.2MB
MD5f730d09d7bf31c86e902af07e864b846
SHA1f7d8ca2d340fd18153ef81ccfa730252d5b54a91
SHA25628d5d5312f920f3d054436a7eacc89894deb2cc54f958113948c495514b75a80
SHA512513a192d30c3fa50fae0bf848fde9cba6049722d2561ba1ad86aa41fae28f610104e19709bc1d49da80260d586ab35b6d2c46bf67d10e141f125ef2915c603e1
-
Filesize
1.3MB
MD5487f46c2296f6df0ef655499a75b6038
SHA1211a2caadadf1d36554e24f4b3ca095910704a7d
SHA256b93b9b62a306fee895e1def921de6128a38a0b60a7ee51494b308a415ed14627
SHA512fc923688ff4c01a47068dc315a4fefb516ea4cfa2d7b2db08c4aca10c802df938d57043f92185efb702df6ff29a1ccc810cdca230c24b3cdbf0bed83077e174b
-
Filesize
1.7MB
MD5562ec8bbafdc43e81ed2caf0e35d44b9
SHA15626e37d657ca28129b1a33e3d9dec1fa3cfbb06
SHA2565779be88efa71de64b3a6533b02a4a0ffe1d3a78e648190b1e4695e6765104be
SHA512f1cd7c63521faf201834184b6a1496c30935ff989adec2e67cdefc10268a87d2684fb40879c2bae6532b660bd282c64909153b11f8b27e3a0b5c64b7784884d8
-
Filesize
1.4MB
MD51f9edf74689bf7f1bf1dc0e29878adc6
SHA148ccf0de9fa5353c051b4a166c01843e6a1fd7c8
SHA2569afd111601368ab5aff07800c21e032b1ac5391ca04e30155083ccfeff63342f
SHA51221dc53ab212d78f25462199ff6a4647e6bd58ccfe5cb00cde78b90f2e5994d7b7749400116acd40ba960a750ad7d63c9b94c3b159fae58160ad4b5849fab5b79
-
Filesize
1.4MB
MD50ac556724abd87a6b1826affeeeb870c
SHA10b3f30a0430c70c7d4337efa38b59c6c4a2886b7
SHA256c1c0be106113ed36b12282ee7667367f639b7459ca01ab7d3373340a52de0e28
SHA51291cd552432cead47984789c7b41422a96d7a8b4125215a5f4c4e947c527fc9136c5ae04377cdf73173273a0b0386fc464d56d1acdaf24171eba9dba206d34fdd
-
Filesize
1.8MB
MD50965be9e99dbf226ccd45e22f7c78aea
SHA138cfd1387e07becab0e88ec6930ba2049a933d1e
SHA256023a64c17ef1846564f1e65d55e0ea6723e20c058ae5077666c544de05b9b831
SHA51232f06422f09aebd9d85aa4370344078486411a127d253abea346fc792775e71b897d1d425ad11d1b68cbe8f835179f34d040af53e52709687a58913098adec5b
-
Filesize
1.4MB
MD5c40cbbbaa326f2383ba278f98e06fe6a
SHA1211ee3b31b82a12aebf23e3ce01fa6d0b9e0f801
SHA256c91cd4cbb07615ef37a35db08840c4f190c44508811352d19491115ebdca690a
SHA512a5a62fda54aed38f3a3af2ba2955ea0ffe6f1cf2d80f92931e39885502a997bb8e5cfc17240c70ba341fe40437e26474fcab033deb777fa9145090002342c32e
-
Filesize
1.6MB
MD514ef6d12ae4a8ccd2e53a82030b65365
SHA1081efbfcd4789eb3c19d75e603c478458c86b775
SHA2569462a6d1541ae2d957cfe91f2b0f117c783d39c34a736357109eaa802c4701f7
SHA512fd9b3b39b96906ef5442f55ed28d827259d6d6498ab6761e70acb76b8d7831c9db16cca45ffd4aca37eb8eb1acce3a2a77cf1d2cb93df54e28b9cb1a320d216d
-
Filesize
2.0MB
MD548b71a09dcf8d5be682f6adb77ff7f27
SHA1b41ee8deeb68ce364faca22672affc8cc1cf30d7
SHA2562665ee3819d7d762e9832b52f90ca1e3e3ba34780cb459bab1f980e64df376f1
SHA5121b1ec85c85a150e2a38abcb5845db45b2c4eac15c113f7b6c23690c62ff80539c3c3ee1a4ea42ab9881d98da59595c4529d2d1888c7b7828d8d4f927cda47103
-
Filesize
453KB
MD5d524ac70539c19c6c547e96239694f87
SHA1f58bbc9ae8465247797196a8592e64ad21ede73d
SHA256ea2aad175dfb6d6e7bcd61d184f32792c44a7e37d534c1ffb0e41d6dbe7037e7
SHA512bc3641988caba8fe7d52f9815a5cd387f08411bda218826d2df853826dfb64a48fd919a6171d92e8a96a6cf3fab9a2898b9f019d0bdec5dd5df80cad7e2040e4
-
Filesize
1.4MB
MD55dbd21991f49cdc1f21ca16763e4e3bb
SHA1b8b0e7b712bbe4e99407b1099f4669224d56c0b5
SHA256b9903536c7fb39df5ae4ab7b5762554cb625a6c36e4d29901f0a3210eb7ffb52
SHA512e44fcfc4a8121c8647c38f8596ad48fa0d00be91f2a1fc1e7195c591b978f352806ef293a62038597ccd6a8623b79a29eb3dd47020809085739b31643355101c
-
Filesize
1.1MB
MD596578479033b9607d25e70697f6fc087
SHA1e804f3ae4968ca8e3ec43a8326a70fe50e01f3c3
SHA256dd35c6c34925556058d0d844ac86d44a6e4ac03a9b556e9703794f5b4382d55f
SHA512076838186fa8cad7daf08384f05306999f6b2e8c1b016927fc179c3f402e63dfdfc325e5fa4dcd034752bc96e5a4818edf9595d2ba5456e432cc936076a84bd3
-
Filesize
1.3MB
MD54e106f353bb0e4c3ea77c16d3941fc12
SHA132eb0f7d9fc0421d70463ff4e96e62ddf670955a
SHA256dd22364d0eb537aeeeeb7091cf36ccec86ebf1d3a4a6ead67f080052b0cfe86c
SHA512899f6bc3e94ac66b69faf44ff17f29f458ad37e892f465c445cee8be1922fcca515f25d85b8fa101b6e5033c295d1755612d537aef1e2f9bd347979be29de8e3
-
Filesize
1.5MB
MD57746753ae530fa0c9cde75ad9bfe08bf
SHA13cbd487a43809313bd9d64c03308089aa289c16d
SHA256c1032ff535c4f08e277b549421fbe8d72505ce1281b673b4790bb5984914c359
SHA512912573257d0676fbab863bfeb3eb364bb42b1cf4eb0cfc160f9f23791a4e337bc4e926518b4683ca49015ee44f0229603a9729addccf8d46efc9193314372610
-
Filesize
2.1MB
MD5330ad520f1a6deb5551fc8dfaf167025
SHA1d7f275ebdafd77dc9dd4a723665eb842ddf65ddd
SHA2563375747386e6618bbf4a3b9bc7e96c2367bcf5f769a1bea586ef2a860cae8508
SHA512051bbfd81139cf1e04e15ec789b8a8adcafe465beb294a3bb8713ce232f000cfa0799091fd16d9a972207848f82d3930725695bab7655d05ebfa580fee0b6b12
-
Filesize
1.8MB
MD5fef43a614180856b7876031e2014fd74
SHA1510fab15692fc41fd0876973e2f224225043ddc5
SHA25657b7f283fa0dde3a11013c74b92ee4c04996f472121e14e515a799f51e4f8da5
SHA512eaa1cfa5b2cd53c4341b3db796a88846eea17d7c12e5055c3ec57f5b45f77b6058e8d6bdf2a0c95291955d7312173f91c0ac07a47553cca1f402f3fa4b93a737
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
2.5MB
-
Filesize
384KB
-
Filesize
2.5MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB