Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
27-03-2024 02:23
General
-
Target
2024-03-27_49cf95c4f36110c349d149f97971dcb0_ryuk.exe
-
Size
2.2MB
-
MD5
49cf95c4f36110c349d149f97971dcb0
-
SHA1
3e15e776defa189127a3fe717a2f9a6008d3bd96
-
SHA256
4f1e79f50ea7bfbb6431286f7c14eb4d32d3f03eefc73cfbf53ad4a41c3eaa4d
-
SHA512
488ffe2fa229a093310fc8d7cd4e0d365abc5a312e8eaff68626de0789623fda6d183c119064389aa7c774d694bd3618cc1111390a91dff037a15cd3d10504b7
-
SSDEEP
49152:U1KA268/Bu0uIexvjiA+OaMPB+njgWxwj1bXklVbOH3eQPC:U+9uBbaOaMDdiVqHOQq
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-27_49cf95c4f36110c349d149f97971dcb0_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-27_49cf95c4f36110c349d149f97971dcb0_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5a3cbe5c286e2f9744d62a4242bdd2bbe
SHA13aad115fb849ee3d84cf3a6e14e4cbadd236eb20
SHA25696229615028336ab4e5d087ca45694fe7bf877c09dab31e04a03a93c23defdff
SHA512583ee7a36afe9889429918bb44028b1e1ca18648c480bf905f140ee98d51bd6c6b6b4a70902f9435436603ddabbcf748de74442f3bb7c6ac12dc513a2f7c1438
-
Filesize
781KB
MD592c950cfdd9ef08af06494a3baadd50c
SHA1df66753e6969948a90460db534e22afc643f825d
SHA256e4086a4a82d1dca67a3ef1753ca560717c568797496dc0775c72637335af7165
SHA51208753925646a85cf177b19e4fa535952d2f9125ba2c9911d3ea2300f428995a4105c282b7fcf48a9e07e14993153b20d858ac8fb6a69c384f3ec60925feb6386
-
Filesize
1.1MB
MD559592777d5108d4cbf9eaf2379deda6e
SHA10642b16d01e6cd9d610bec5cb829d76cc05e3d99
SHA256658cb620cebfbc38731398b059c6277173af7c58688cc79ccd4b596433b0a949
SHA512f9fb8bbf49bcfa5cc307ae6e4dba4f299f27442fea41eb0868fd88294e3deeacaa5a09e02e35086a5ecad8734d77d17ef2592b44001367ffd0bfbcd66566ca6d
-
Filesize
1.5MB
MD5e0fece875630e1dea604cf17b784499e
SHA139a2a1082de81fdf6ea1beef6a90bcb639ba0bb1
SHA256f3d52ce62bcc88a1520c5b3ae363c58ff205221dc090a69bb8f4a666ea343012
SHA512cd1098e0da85bbe279d3fdb8385a43ba356bf78b8a25a8861410c2dfdbf4448e399585c38c6c5441ad00c6ab03ecbf053b0662f01dde4344ae4ed38423edf544
-
Filesize
1.2MB
MD527fec8957610fd000a3ad88f642bccb2
SHA146e75dcd05c421d1b32a322016472da31de7edb5
SHA256ee54f0dbccb6bffba3158796e971ea5d5ef2d3eb5b1b51e6383f6c925bf846d1
SHA5120d2e4c72ae5542424534eb016877ae8fa411321eb59a1e57562b1c99d10015e8278fd92712deee8be23562956ff343000f608ce3bd2e66b1a9422eea033e26b3
-
Filesize
582KB
MD56a4c3d4a0242d0af3778cfdd9439863f
SHA1be14b0cc1452770c3109f8b3c35e3df19012c199
SHA2569f9b7481f8ab7ee5e9ce6f8ccedf9913eb90c8c29aea52d0ee35713829cbfccb
SHA512c0bfe3bc826b9975d15d06c0a8538c91841483772bca95b2f9099ca167e4ef406af91e3fae2a3311a0cd65c73a339bdefecae492aa4ffc007e932f4b302c53ab
-
Filesize
840KB
MD559ea1010399e8174f13a785509c6af2a
SHA10e742f4c4766ea2fa77a693e517d3730d16bb2c9
SHA256085c492df53ca16cfbcff0c7e5d0383996e926ea811f4cc88212584cb6a4d75a
SHA5128e900264aa9684694225706f11fd0f66b997dfa6653fdd6b5b99b28f120b68222286fb50a16f1acf94be4cbeeb1c9c9660a734f61fcfbb307e1561bd6801b75d
-
Filesize
4.6MB
MD589510d4b63c3c5de38224bf1d0400296
SHA1208c3fe612cf2e0b841f5c1b1505b0f02e696307
SHA25674603d7215253ae4b9ebe3ada966405f9e0038ebf7e50cb07c682531f6facdd7
SHA5128bec6cd81f68236b7dc83a0128e75a76f0be69f5f6448afeffccb7e246c302711df5ee193038e1ffbd0ea00800daff88c930a24967cdc098d935c2d154b00b69
-
Filesize
910KB
MD5df6f74750f351b6f352549e64a8d9f46
SHA15b0615dca005b7521c9c5cc8684af5011587feb2
SHA256fa36c351349aab3d24f9612b9b617a31c668546349e792d50ef3b453d1c2aaa4
SHA5127ec9aff3e6f2f8bf5afc5202d41533d20b1b0be6332041c4ba31c5e743e7c57bbf3850946d6ecb89d166c12fbc2908c649b43926dc7ba411cda36fd2c7ed0b1e
-
Filesize
24.0MB
MD56cfd9bcbed4f4b9fc5133e8f7ded81dd
SHA18c82f25529558e192d75da1b45b6a2169b48e383
SHA256449b711fd504156ccf870726012a4adab25a4ad7129779006053a9aaa7c79de6
SHA512539456769ef9323570339780a540f81dab5267281261e69b2cf52d1f2d2e8e79ac8ef70ec7766ba697c652b85a86ae3ccf4b2a298a163712c179c6b1b90b6f54
-
Filesize
2.7MB
MD5db628972b97459aba60ce5d2310768b2
SHA1e5c4b8ee5e0b76cba670eab88361a24fda42c1fe
SHA256bb95da6173fe65563a88a20a1eb0868528dd92f82f4b2cdea601f2efcc81e96d
SHA512d494dcb5967faeecad31b6c33b97fd0aa6f74e8a0b053c97d031c595e4ebe596b7b3866b73938f6f5bf1093f49d0523fa892f1d9d94bbf2401a2d8fa770f93ee
-
Filesize
1.1MB
MD5e75d5baf9207983971d4637574887469
SHA1cc050da980adb63c81b3c663585d3cf6237f9596
SHA2567796e5fc61e701f4713463d95129870435a2246e9fbe2eee1c27571c104b1e9d
SHA512ec8ead758c663eae36a220d7475168812ea931efb95e3970909584e66246c55d09bb8bb4a64000d418899b93c51456fed5ae5a66bf3978d467b1f0b86a741074
-
Filesize
805KB
MD5b6dad828e72b12a4e12c55c0ba7342f6
SHA19f9992028c732806085e19a197118359dc49e16a
SHA2565ac7e8c51f068ff2f0505fff3975a2ca6cbc8ba6356028eecf22281567e0c2f3
SHA51258c9f041504dfcb9521be5c16609288022e86bf41ab0c11e5fe8dc36350538e8293f056855497eb45c209249af9ac7da2fb359a5366ed5d562296eb2060958a7
-
Filesize
656KB
MD5bb6d7ae0eccf17998673e8a2dd0a5f0d
SHA1aa13bd1f4fad1b89368e9450315fc749432aa692
SHA256df74698e09777ad06fac8f017a065dad960cf9e15305325da246f3750d538bbe
SHA5122c1405f15f2f60106f0888e6c5eea7340a60ce0a97bf19983d25f93516e080012f0b1d7b106f336478a2fec90c44f326b8f7a02cc5a4733527cdd65e0f55ec9c
-
Filesize
4.8MB
MD5ce4bd46a84b6a7433246ab2eac77e6f3
SHA16769fa38c5bf994cf34711244c9db1aa540a12cc
SHA256f675697552551934941dcf436d78cd6a63e7b2ebbf56f56972eab1173d44d597
SHA512bb941b5d08f9e8e8dc33baa381742d11898a65568cfc6f4731e14b162208f0db175782dd579a242ad14f55f00f1e453acd7cf93297073e20470ab309513da3b0
-
Filesize
4.8MB
MD5ca7b7e550b90ec4592f94e4cd61eb148
SHA143f3de2df321bd45a5509f4407b704bf65ed6e64
SHA256073982c9c4a5b371089aef1f36c2c54c544e0b27d05d6b3486cdf6dae5276999
SHA5123bff623067c163fd66bfe4c0f2727160bd290c4d8053669328331d5207b624bf77987df696250d149e644f6a25d15602f548b6e09af5fb8d66192247fc00c73c
-
Filesize
2.2MB
MD52c68d468d5199a1d5b947e385732e870
SHA1878a8360c0eaaa4e8dd1e9ce95b9154294cff12e
SHA2561dd4c4eff8a3214fccb5fcdc28ac8485469ff354b199c0901a27eee231a57e63
SHA512078439420f8f840a6790e2af4358fe434ab20a8b368541f7be66f4f427033ea4665f3570b1ebaa9bd2cf7f63c444c17551356078a4d1c2f0909a5a2c7ede45c5
-
Filesize
2.1MB
MD545e870992c4cc3f3221fbcf70cc6578a
SHA183f52c5c587e8f62c09e1fedf74a4978e8c5d4d3
SHA256adf68cc7c22d668aea4a681d2890fed1fbfa464c1cc93b3bd30659f78addde7d
SHA5127082ec681e6979f8fd809b54faf1b3bf64f76d19398a653bec72055356e192d3d0bc3afc42c525bc4e7b4836b7b1397392ee9434bc58ae790f3d9cc9f217f181
-
Filesize
1.8MB
MD5222b5a6fefd408ec9f8ca2647c7abbe9
SHA1360ee3f320becff0d9407939f0098d9c7554be90
SHA25679145aa52e80a3ce883eb358a7669b4b8ef1d75ebc187172d7508cbc3ec40c88
SHA512d16f373408037d470cd5d01ed942e548a2b78d074a544732186207cc42ff4e8a52a3a145eacb4b73f6a5e3cc6a7ae60ee10dc9924b79837a5030d5f7f8db7b43
-
Filesize
1.5MB
MD50a2483c6a89ae52c6f4498b4e58e36e8
SHA10d15bb259c8b356b7991adb97f134c21db7f1261
SHA2568353b5b112878490b255f38d53b8f71002dc7981fad03574746cc20536679dad
SHA51270e8d92edac1239749b9743a20353a31e651a1941b24f752453346e3552d6cd8cc2428b6e0700df44788b013b864ea5bd6bdc277a86c4f0d35059a6f54e68fd3
-
Filesize
581KB
MD5e808cd54b648bfc42835de824788da57
SHA17b71623e6a419ab400ab1257f96ec66ca21431e2
SHA2567c88f4f182fcdc27dae35f31c7a4175e519542cea228c06f69c6c1b75cdc048d
SHA51274abea69526eedba5d32af4a990ebfd4de07782d2e243acccce604034981a37af4fb306b5b77b25b4bd35b74076c6ebe0b421267ea108ab94e3521db148334c8
-
Filesize
581KB
MD5dc4960c92e57e631c8d64db6994d3af1
SHA1f7727e7de390c981ef3c0553bba7be4f42432771
SHA2569593af8f04153dbbf818da9874418633d320d957899d20c1a55846518d95080e
SHA512b7586ab5329ee7da27694a4c2c5bc03026de347245970a8f3786ad7311b1a973de1f19f3f01fb22abcd5205ad6ea3968188722cf37687f13dffbd940fd2f72d4
-
Filesize
581KB
MD5a3473b8ce5ecede9e291b0101218fb0f
SHA1f61c57f8d46a28d9e3ac31613bc9b96d21b0e2dc
SHA2567660d11d86bfdb1457ca8ae18a7395aba7328cbbe8fe07653aa268a59f5d04b3
SHA5121d7a6b952f220bbd0edccef65e5ee14a9a726270de5dffa0de5d0605f0db3b44a9bd86072b550d6a18d75271cb299e964285801a33e817a4f9db08bf38b9da8e
-
Filesize
601KB
MD5d91cdcd8af94d627adb0b99f756487c9
SHA1c983264ad601d0f2702ac3664dc576757d702c2a
SHA25668c9d04ef7e02687ab87b5edb71f917a0fac85e45582a8312a580e72988216dd
SHA51299205c6ec22dd821bc86b3b9e2fb6f99900d10112e28697ff11ea8c27c445124fe578397293d0e9a3d8e82d27dd19356a9634061eca0dbc1e2ee55b77bc29be6
-
Filesize
581KB
MD50e68a786f84c8566e7adc50a80a9f75f
SHA1b9ae29efcf9a797e187d568ff98b2d0887eedc59
SHA25648fac5586cee67154862e75b419a3d12db546fc564ba917c8625c074f3fc4267
SHA512b4af532495ae33aebf3144de5549d064598d821057b7dca2db87e65cf202bca6f862d1015b34f173ca792a211b6edf3ff14a6e5eaea761589b929353f9ed3608
-
Filesize
581KB
MD5fe8c1bf2b0f064f10ec35d27c0267a8b
SHA1d18ca9ea0cfa6b542c7d5a38defadd9434a8987b
SHA256cf2648a5cb36f529d9bbc4e89f84ef24a687825de4c2d5c308b8de683b60f747
SHA5121e4fe55415d5ed87ae5f79da84bc8eee645e16a1020135d1bf0f7ebe3471b2b0ed6945867ebaea8a4c55bdb57c1fee3c7caaf47b81b63b783e727f7f38e3975d
-
Filesize
581KB
MD541bad24a2ba4eed8f487f2f663809963
SHA1221b50039fb634058c7e4960d77d5d7d153718c5
SHA256104ccb6156c5625cb2b30275efc194a8022f0d14791855c7a816ea7263583624
SHA51264cc286aadc9be78c7823d73235fe3fd017d697e95b12e99b1e4a2b54a8701c2b87ea3d57660b617387126a7bb66ad9680dcc8e97f2d9b3307c224271358dc75
-
Filesize
841KB
MD5625a736f2839342fcb02839f1139d55d
SHA1267a7fe2f02c78df0908d45d26fdbf000eac6c57
SHA2565e3a77136f199df57e07053d3cd136e417a3933b79c69e5524dd2cee1ead7f40
SHA512e3d20e5d4adbff567ac029ff863c7c49692b20485aaed27c162f5ef48bd02ed8e2e7a84a30998e232b16181dfd85fdf73b86d945b8a3648df336f16ac596ffce
-
Filesize
581KB
MD50081e6b8eb275078b46b2b8f9f0b2b08
SHA1e1e235051577d5a609b0081a73d9a4309839ec5f
SHA256be7e42ca42f89b1991a0b73d975482381f2bda30e4fc53b24681a1db24df5a56
SHA512be2c67682c5af0f0d7008e341ec1f98071fd15e680bb62b96c88b3cdebda9fdb569ccf99e10c7032b23ab22cc1060d6a61c36265f1e8e22816d1e7eb0e3fce63
-
Filesize
581KB
MD5dc887b5ecd5790a634f4517f91363cad
SHA19351a04831d7d8aac9e49c8710ef80f0365d3452
SHA256bc71703564604d3e0507448e5de1935f4b517266de30731093d438928a20294c
SHA512565f9ce2c65406cb25510103dd97a2d7cefd6fdaabc9a66afbe07989ceaef832ddc7b1c49a09aead87dab4a45261471e557931608d3234c8574306a06d2e3859
-
Filesize
717KB
MD5d2457e4f5101ee1262d62b67c4a8b955
SHA19e8abfb9c328f3bb70c207000760527759d5b3b0
SHA2568130ffaab12c8eec8221b0dff28e6735d1c14878e4f7c53b30c3d38ea2e0bf9b
SHA51221fdad75cea1c07c32268fd2a692727a437567fad94a9fba117ee8ce6519069105e8cadf5a9857be82dbc7d8f4a8970b6e4182251273c0c36a8f377a19c4132a
-
Filesize
581KB
MD555cd6efbfbe541d0f4903daea4a968ac
SHA123b0b39b84a1535ad71e0daec699ddf14a1c375c
SHA25612731265d45760f18a51833eb56c462baf3ecf36f35746c64bb971dfd8111366
SHA5124fb81c43ded8c772cf3d7e9fc1ebbd464f5e55b5b7db37a8726860e15679875d38dde37610ba8a43e51aaef3ebcb4a517f2f5817d739987bba2df99964cb904c
-
Filesize
581KB
MD54234d3265add7226342cbd7ee11da704
SHA17bf5b531e3e9e9db900275e009891ca22e959943
SHA25699b92a5db7c52dd34de2ce1eeefe29eca4c485ef89097e3c41b3c37615a4384f
SHA512555cc3043dcc3ed49a5054ab5b77c53299fcc35e3b95b73cdcb0b3baf446121214b419ffb8d7a5650b7c676fc8757305c13545605e94a0eeb16d6e66ff01b5b1
-
Filesize
717KB
MD5115d94b08a5dc78562d8abb6acdcf651
SHA11eeb6be864be5cc03ad840c17b7328a4e535a876
SHA256cea0839c4f09780224c9ddb5aabb6586025e030d44636db9040e73b4b8c86ccd
SHA5122b62a9f6b9d46a5c9d52162178841b9dbc2515385823af8cdb561f308f3ba028c73e336af759154beae0f1c129a3ad972d3cac4cca0cddc7b8009f212bc28471
-
Filesize
841KB
MD5dfeca813408a015f5e8db9db3acd3187
SHA1a2f41fc9f94af6020e23f9f082f01ea74ea6ef11
SHA25611a6eb188f95c8008df91715e28d8cae55744e9b60ba255598fa4e50884cc78c
SHA512d8ce3575b2049870f547b8f99d545054fd8e092639fe7028988731ca7e9d2e8851c4744115cb25f51827d59baf09bc7602298d02f3a5080e1c155e713486c77a
-
Filesize
1020KB
MD5b4393e272112d11b11baaafd959722b1
SHA1c055af00708e6b013922a7d804a30a0a73185b6a
SHA2560cf7d99738208816c1c99d922e85baabf42cbc0b391308183f01d1a99931064f
SHA5129d03baf24e841579a36afce82b92df1b8f6e46efac24d44fe1deee976462172796ae753a494a30e93343872917c724d322dbd829ee22ed05e8e6b0709336e7a9
-
Filesize
581KB
MD58553866465a0ae1a9cdf44da45c74bf9
SHA1bfb1fa3cf2b6d662b1cbe07af999025086c56cfc
SHA25672738fb0d309bf2f1ecc13cc1c9c0aa706385c4d6f2786dfbcde158cab7afab5
SHA51210547dcf9ba5879944a9a44820760a4ef761765b6e1e7d9821851f41f9488175b1a38014f815c681de8d1bf50c88d6088e0c26f9fd34d1f235faf65689ce3ba9
-
Filesize
581KB
MD5fc812ce8e0ba1e2bab34f6bd5cc65842
SHA1473f2e4e20ca56c0dc7954d6fbc6528c0fd36267
SHA25636a440bff4bf2321ef669355ebdf490179cbb5571fadd14894cbe9bb7c0a7325
SHA5121cbcc4a4d94bf89680ee763ff915c4d57b5439da77a1a65a06d3fac4049582a50249f43d8f8d10471dec399b2b408d8ccc93a093acd6ab0c4b777152ef5777d6
-
Filesize
581KB
MD5c39121f4029b6cc76acf4ac8c0ac4660
SHA11b8891adf87695254f483c13120e33a873c9df94
SHA2560226d6bce0f1f096556838eb1a26f22161d1f835e7fb8cec2302ec8107340b97
SHA5128a9e6d3bc582ab2419a39e5736175e2f11612797339ae6cf12aeb09dab619c7fa8514815c15cebe022925fa626061831ae667e9eb3ad12b61e57ba0b722a964b
-
Filesize
581KB
MD5b97ea9be5912beb263c811b2f202647a
SHA1100d3e09cf40dd363e503383b6bc8de668f9f0fb
SHA2564ff31ba9d9afbe6e409aa067f78e8cb5985e4c5435a25e222f86eda69591d290
SHA512816cd2e63bc7e5de8a5712fb782b027c046b94deeaee3d47514b0e32ae3b79de1a9f8c19f6d552c1c98d5f09163c6d2c60e9051bdf336fc875140926c77e982f
-
Filesize
581KB
MD5ba0f3d9cadb79a69b8c97569c45645ad
SHA19ebb860b6c728f0515fa1bde61bbb2b49ba7b3d0
SHA256e291655424d72cd2340ebe8808f8cb42c40e12056c72fb037351c4dd8710a907
SHA5122f6c2bdfe3f8b1a1eb867ef1d31d0c9afee9a6f5a1f23969d4a688a910a359c497b6e7d6635a9b24ec7dbd29eb14d6f426deaf4b1e523d74c6935411f868d00a
-
Filesize
581KB
MD5cec9ad8922125572ba346d48a9fbca25
SHA11ef745f7d760feffcfd847e5a76222c8b8f44f93
SHA256976a7a857a6c99f3558f454d26a0619e85e85322a0d40723116c9f9c81f2ba1b
SHA512b0a65ac3e1d5d3f40099729ac9f469168e10afb8b975984ff270d9031a5d725ade52bd9707b34fc809007f01bddc06bbb80b072b32cec00536949325c62ddcb3
-
Filesize
696KB
MD565b79f98a04cd9e3105e809b6da6e4c2
SHA1ec99d06b60cc136885d777c8300bf84bc19afd2a
SHA2562b6a3b0c4c4be822396d85540a139d76df55bd65d157f3ad2ac8056374e7be84
SHA512048805316f7d2882aefc5f6a1e3c4451d49333ae8d8d426099bb74f465dc70c7569fd6dbe7451d381e75c62494f4d8390ce6bb713d3acd296bf883caac14fd37
-
Filesize
588KB
MD5d587c1c72c3b5ca6bc87890b028a9bfb
SHA1e0485267934164eded01b292f9f22d4193b2a2d5
SHA2561ad7db9f15581a23c42165e8b2863f8947884c8ee01c471edc8c3d6116dfd679
SHA5121207f75e1c8bbe2d3aa4be90b7d51887130b457dcd5fa8deccaa1a174896879cdd011f80c5104dbed95cb4ec6cfea1bcc1f7a05a71b1af47061aeec38cacc91f
-
Filesize
1.7MB
MD5f4357c6029650b957b5b142273ebc347
SHA16bc88f89ffa60e1164d6dbc65a60409404f06395
SHA256c465f27d222b5cec4ffe69085bd12943f032dd66bf437f5ba1f6d508dd23d527
SHA512452b6f322d94b384d141005207dbb1d8498641846ac3c625758cdc8431db7b1a6e23d89c1139d0aae8579b08bdc8e7e5f33890a8f64897e2d7dac303faabd256
-
Filesize
659KB
MD5e358cd0a6d1ec6852659add7addfbe00
SHA1ec7bdbe56566ae2c93186bb23c88eb5c077fc4e1
SHA256b75651080462796a44c62af7e4d8a6dac610bcfa7e4c23c5fb1375c07ebe1f20
SHA512a1849d8504f075b9aab7d3e5b80b9658226b57cc807a9a1efbdf96c386441940dbdaecd47af9c3dff8c480236453394a13a408914e764dfa060cb93f6a691a8b
-
Filesize
1.2MB
MD52309e0180d0810e4fc97d6ba0e61f804
SHA10e86973fed2d9877d624a1a90a58b80cffce7c9b
SHA256bc00b849427c6b6512d37345683f0983c477f395db4feb0d3d526c569d425525
SHA5122c608f930934226ec8ad8ad1357feef5b066287645e36c5730ac90d0ff71c6803d89c61f0a23b4a9fce2c03a91d2cf9dfa04f477e1ebc927bb7640f4d3c65811
-
Filesize
578KB
MD589f5ea7719c5199fc3d7f3e739f911e8
SHA1ff4e855463a8c09a318ead16ca9af5a8f186010e
SHA2566c1a52ad8b602c501c3c89364e4306bdb1585c13dc7ccc7043fbf9c59e405ec4
SHA5120e6f74cb17f81eef8ee45bbff68abdf3a258b4c26fcc9583ec3f29fbf273aeff0b1a7fb0cc878f40d812550409ec969ffda846e78b5515a4f3e9d3fa4d7e7457
-
Filesize
940KB
MD5e364b4528363d5473fcc8a1b97e67cb5
SHA10846ae086df42c58b720f29b08c1f33162a8ac3f
SHA25682976acde18c6e31e9fed4fe14828b682ced8b708aff646457fcd7934fd85bd4
SHA512e4b6b2c27342f5875a214216c1913887b240116b85cd677202cc394c5bd1c401978b0e940d926b96e7b56afc26138eefde58737009f95ad6126641bed99b553a
-
Filesize
671KB
MD5acbcec58e0842df7248bf4675af64212
SHA1d7cd39ab9ed894715ab3934c3faf1678b1630731
SHA256e52f5edbf1a5cc019c41cb5c2303b5b3d2e5b61b6238b5d229a2ed51dd0462d3
SHA512a4e8f803fe9c6b44822ebb1650209da0ea38cb21c6ea2d87f43d2c029100e8e654d589945fed1b464d91d58d6dbdf9ebed65f1be20317ef118205a7c598c2fd0
-
Filesize
1.4MB
MD59eaf0e12d4601b71b881ce598e01d5f0
SHA1c54ecaf2521464a91e51d104103cdbfb7ccc6e4f
SHA256c7221383538ac07bdc0cf6f33285da05fe2ca03de2a2ea27deebf31970e54405
SHA512b90376631bab4ee05ec100dfd7f36c02da02d8d9c2c90dc732bf3291b858c62ef8ee246a0571fb5c7a3c78d08520f32a601d9b9e5a17a41e5eb12129b097ef47
-
Filesize
1.8MB
MD5f9a8e56c56afb40c7b33c56322f331a1
SHA1c93033e00be29af07722821749e42b04a2cf5463
SHA2568f82302f7b6010a14cf69346f7483363493c2da937451216ea88d331313432fa
SHA5126dee54d2c9ec2f6b4907cc62ca5fc696dd4bf53a24d7ff8d20eff312713f4c8a2b7b25846e169d1d1a2189a4ae169e453cdcc3cbef994f06c3ddf67bee47c20c
-
Filesize
1.4MB
MD57df55a69f5a3a601bbb691e327800c8e
SHA1f926faed322265ab0de388ada2c36f7737d1a702
SHA256415a9c8734984db659d37b57a9e7dc0156c80595936e9993e357371f96b736b7
SHA5127e166a2265566387e1a76e4eab506c98cc6d4f12a455a89216b18c41df5240856ab3f35ae8c5986a2457b2acaa34a7667da9a8f98a7127e0a553db6ce8114e0f
-
Filesize
885KB
MD5c4e0f314fb5bf84587f076d32bf7704f
SHA1030160c74c9274ebbfce19d1d8e894ef4229298d
SHA256b154a40ccc3ddab0e89bdaecc115592083dbf24083f71f673619fc8bbcbebc67
SHA512aeb1df0f4ef77d93e3a2e2eb4efd26bd95c724f3fe8aead208b87cc0148d826d65d703c6beff4195a5802960267d680870e3a4355d5f7532a873bfbba557ae73
-
Filesize
2.0MB
MD5e85f6eea3e4cb3989b3d5a065bece958
SHA1cf47bc34d88ca09fec5aa7ee20593d281a21cca0
SHA25690124d3d4e3575a28ea4eaaa94c97e04b0906f2dc06dd41d2eabf84532209fbf
SHA512bc515b5e8e8d1a833199609a52bd02ad3dfacf521e407ef898a4e04f366a7da670afb4d5631a36bdf983461762bc894391944f42a4b2086315441447db97f7f7
-
Filesize
661KB
MD57fa6f1bf9597ea689fb0a41f24598787
SHA1b99e3dfe45c9fb025ae1e00c78e04a8a94b2a24a
SHA256c1cce76eaeeabd208995a9529c5e0d8c52e61eae533961d229359027d23f8b37
SHA5124ec0453c85c1b9408c5a4ca8ce62e53a33710ffe767ab267e80f2656cf54e16a73c7a278306feefd122a9ed4398b2d037a800fc555342f189b58cfafe199dd5b
-
Filesize
712KB
MD5e48adf8fcd87b057145d5f7ec969b7d8
SHA1124d3783eb49b4730b37326d69b1f8c34cc1237c
SHA256e7dcc588deb0a4690fa13501390225e9f10229287cc8961d6779462fee0d36b7
SHA512c4714fe2a54267fa87bfee8fe929c9b6cdc92efbf20542e81fa825ffe9de4c07fb9d19209a42076b8a25ccd57788675a77df1052376679eca65bd556873a8cd8
-
Filesize
584KB
MD5a50fef4677a1ae395905e0db607f02f5
SHA184f7bc74d236bd91dc8aa52eb068a38d988a47e6
SHA2562df2799674ea2efb27eb955c6a558e51740daa3e97a645b89a6045081302fd90
SHA512c152c3d2169fc6026c95bd91a39ceef973f3b4c2f6ff18b0b8b3724ca9ced69ed69bf763e618bd5e022afbc8a628a5b23aca8ed6f82c170ef72473d4e0b6b215
-
Filesize
1.3MB
MD536886488899cdb27d522f713f3cee3d9
SHA110d5f575d3b372b46b532c5937790e23ad0116cb
SHA256abe303444e0a579df1983d63ed5ad36c0599804d9b265c7ab01d7c941486023e
SHA51273e966a2bafab97e3be410ca2473d7b1307ea10ec416771d63dbdd47198e7d014c96dbe6752f95dc811892755c46d128b5b63b9148320fa662bed041159a7b8b
-
Filesize
772KB
MD58ff8d0e058e6f3d00956c87410f8e055
SHA1658efa31d4de5fcceb2aa56d7b327fc2964cebc1
SHA2567e0961fd3f0565ce4fc13227a654719c89a9a126279f88d802d4f30b25196f19
SHA512cf2ba1b79716d92024e91fbd1197536b46097f8e4cffc3b5ba41f9865daaa1e4a2dda046bc895f7f03a2a6d1ed1f7f178ef542c65596ec967582768d63dea2c4
-
Filesize
2.1MB
MD540a2b3bc220923db700cfe9c59f402df
SHA1c37ec60c165a6eff584329b016d30b8034ed895a
SHA25686f342a327cf0d1a98d0bd28c1e9aac26b5f9d5db45e844e5d34826bad838624
SHA5124031bf957040243e5bb7d3156e0637df30d371a51be11908bf8eb7822ce816de167f370276bbbcff51ef1cf4363144bc3aa6e6587c9a8546c2c56c9c9ddd8ece
-
Filesize
5.6MB
MD503c23287c6d1d657ab897b0a4f8c66d4
SHA156bb6b0645b85181efc73e53ca20490e86f16cf4
SHA25656aded54850c8cc43bc86b61faaa6b170e6fca21f997da3315527d7f7581716b
SHA5129cccde9d6aa49245c3ba1f0975aa98653785b72fb97e63cc2e5074b8253f970613837fef2d69602aad127c788211ad087bd9def82e6fc6f3c8c63290714e7965
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
408KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
408KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
684KB
-
Filesize
384KB
-
Filesize
684KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
680KB
-
Filesize
384KB
-
Filesize
680KB
-
Filesize
904KB
-
Filesize
384KB
-
Filesize
904KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
600KB
-
Filesize
384KB
-
Filesize
600KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
792KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
384KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
384KB