Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10/04/2024, 12:55
General
-
Target
2024-04-10_5e50d1914e96501ad2e3968328ed8f7d_ryuk.exe
-
Size
2.2MB
-
MD5
5e50d1914e96501ad2e3968328ed8f7d
-
SHA1
162aa982abd21a80f769f6c1e32f8f76034daf01
-
SHA256
440468a1f8c4f688c104be726a2c608ab2651784dc57eea325f2df7c58b159da
-
SHA512
d2a2ea3229635bc6193b682eacacc2b598c4ce68d265f3f61cc15dada584ce90c09d140cec887027320c0114fc885b136ed5dab7ebf5d38148cce273bab3a54c
-
SSDEEP
49152:qNl7soq7sQCc1kyG2xHywRfHIO2Ts4bvDs5UbU62FAQ228QKl:OD2311kaxp9qqqj2FAQL
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_5e50d1914e96501ad2e3968328ed8f7d_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_5e50d1914e96501ad2e3968328ed8f7d_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD58f6af66d0ada771fd2df78e6cd543c1b
SHA1dd9c43117e13ab6e1626799bf995b337937fdf48
SHA256c297f9956a60cdb118ab73ee9f9cbf0a86fa3d0ba38291add3206a4764bc6d5d
SHA5124eaa5510c915522e2e7ec88cc762924a59e9c0ca0501c53c3e35c183f3afb3dda24de6323962351895e072f294c23a7b19a4a0167a3bef6aa5f9ca1c9ca2544c
-
Filesize
1.4MB
MD5b33915676eb4f9630567e5838ba18243
SHA1d44294911dc66567dbbd3c627da16eade2aed52c
SHA256194d9bf65a4eb31dc16603f2f99ca0ba1e80de0fb6f7fe13752953b73c3f9ca6
SHA512b1f64bcaa8062e44cfbd50af0e3e9d5483e8b314f9091911d914c68d7c0dc2a8b0cffbaab1e168a78388de08133aad38a408719b8aadd1bd69898492125ca8f6
-
Filesize
1.7MB
MD522dbae9a35ad029d324e5a219ef68ce3
SHA1d1d2782071b80fd26d1aedc9064cb052b2dfbf12
SHA2560310e60f0ac393b0ab3a489f32a597d689f1fb54fd30c39f96e712f00cd2ea02
SHA512ebdbf962a776eb7eabcb004bc869ebdb9cb24cc857ef3e5cc7de0bce69814117bfd6536a5c3dc83b0c0d90026577f56d7e6416449e4c925ff36e5518ddc52d88
-
Filesize
1.5MB
MD5b23a5b75fe0e9965d4a43e0a60fd95d9
SHA1a86a5b19b92e84c248f9ff7a06b30103091a9e3e
SHA256e58d492a85d50d1c0870674667eb218f000637090e8396bd5aa771e88e5cdb85
SHA512b211301b427dbe5f0e3fb65e53330b8c8c603eca106ed91e31ac285a12d7829e59cb2059de3d032e5d843e52a428318402b794ca64abd2f576805f50d987ff8b
-
Filesize
1.2MB
MD5283218dc48c971c60de8bd0e037c9354
SHA1903f9a24ac513dfae55ee79609443c0bdfd4cdd1
SHA256a9abd03bc425372b3caa1822eaa907c4d8b6482539d624724a6dc56a54f4ca65
SHA512a2b017214785c0283ab8833f5846fd9ed15178d25c65cbc2acbcc7f610c4e41e7c2c5b7ec94714d34a8382bd4a652b59ab834555d28a08bb205fb7e508fc68b0
-
Filesize
1.2MB
MD55f1adf780bcd6dbb701431ff083951e7
SHA19c59652cc357a17465bac14475e62455424db1a5
SHA2563fff78931361d74a1faf1cd39e0881c5449b89563ad6c5da238ef47d24ee0d0b
SHA512052811549594cb5f4f90cfb72365e1bd0417720927a979dac2ea49c8f7fd8a942c03a315d03ec9b81b5dbc8ab0f08dc2e196fd82db02cfcfd6a266faf5852b97
-
Filesize
1.4MB
MD5e1c961933922af7a4a97be6ecaf6a769
SHA1196076c27fda2bf68c3fb0a4195ff3ac8be4b654
SHA256d362b37419b9471f11cd48556a574368c8e0dbb2129c01304d11e692710b6018
SHA512f7e6bf6eeca0ff7b747970cbebd9a54e0be3f5bb93eb419696b89497bbcc576868230214415b5aa6a42589b634fdbfc5f3433536a274cc9df5980f4381e19239
-
Filesize
4.6MB
MD5c96861b5a220d366a823b21e67741c31
SHA1dfe75b4a82357571f5dae1cf495d49b34f203dff
SHA25647daba823f415e3c2ae7749452ce903d3a43cce6d50bb6b10c64716eae38fff3
SHA5121091c328b5f8bc3d3860d662e65bd21def6d6f9682677422549d680f40086650faa01ab8e24300d44352b13cdec9e14518e6b68c70a475fcbb5fde51278224c3
-
Filesize
1.5MB
MD531ec1dc27de66f61194d65c14d9f15d9
SHA1116a195bf9231e7e184143e8800326abc003d522
SHA256876926d8f742243c681597b611090cdd53ce5201a28acd18cbaf8bc11f4f239a
SHA51201fdc3ed900516627ddfd83590116b47c82d219e9e627238473073574908a904fa631f7ccbdd4d9af8ba1db278b568797d807916a2af18d38ba0813c0cf87224
-
Filesize
24.0MB
MD5dfaab440f3a977993c4efe878cffe8be
SHA1336936e491ac62f1b13d7f696ac80d46b1768e9a
SHA256d13233546e5a87c3d6ba5c7a0b014151f1966537b5f92af75651802d79fa5c74
SHA512e6bdedcd5a3a90bc74e3d94d2a3404ace977748e8c4e7ef5dbb88fa1d8a7ff88714313a7d956aaa11876e4ec4774f337dbe1e1772d6521619b90865fbe74afe8
-
Filesize
2.7MB
MD5a1b6c2ad30db4645875c51472e97c104
SHA14171657a3996ba28be7a7657323e56e7fdd37700
SHA256c73a48af145f85ab0badc1b426fcd4a66a7869d10b49f885d187f2ed39f006a7
SHA512bf9732e9372f3cf0ae23ec370fe110fffd0c061d2380419219c4d6f5b6e39eb1efdcdc316da91dc84f1875405f42ba3fe4272b8723f9e72fa0c64ed6535eecc5
-
Filesize
1.1MB
MD5176b9e2a108329a780311cc02f530622
SHA1d2851c94672eacaf1f8c0ddc052945452cd6bf2b
SHA256fef1fa2a2ebcdeecc457af69f1a1522218d3743779fb0b3908ac70f4cec16355
SHA51273186d55beeecbc73386059da29dc4c060d2b6c90dbb95a4fd9433789eb239e3d10f04dd592170c943a370260948fc29aef5cc339a3c88e605709acd8450f53d
-
Filesize
1.4MB
MD5c7df41ef6e5b1b9cf0d48cb220912845
SHA147fe8a23b5c5eddc25a7782f39766b9584c14bd9
SHA256714e77b568951d213da8ec488e99fc3411f4c8a9ccc8bd029a9418df28dd814f
SHA512c331a94982e512debf20dee4e5986ebe0e98946f3d11b127f6b69a2a8e18250c24373ca22f0f403f42cb81c1b363ed2fe28c455ff7348732c6ce4d5de5cf5e66
-
Filesize
1.3MB
MD53c94d62e986ea6d16483d3005301479b
SHA1019c1e73eb0630f1d44385184dece900a6af67d2
SHA256fab23ca7315ab3d9c5b370e5cc5287f94a9d4d69657307283b854cc3086a501e
SHA51283688adaf85f8ab5fb43f66324440a92b199a40f7ff83209b6b81b1efd3e373be2a0345aba24c3d6624027882b3bae2516fc301513f83020be3d9aef44a468f3
-
Filesize
4.8MB
MD53f3519de82a779cb1dea060d3aa6735d
SHA10cae83b46deef611cecd3dce34dc563ebd06801b
SHA256bff073763333054a853808cbb6df2c7df61715f2396772dcc718bdb9af0d42ca
SHA51256aa201d39e16b673607e345abaa2b3696c125a4cde14820ea3650df5b85c838673469bb02fb2f4ea98307017f865879509a9bec2e52138261f13d2ad6892656
-
Filesize
4.8MB
MD5d139da26f8b0bac4db5e17a33c85b863
SHA17f479c7369eba6297e196f0bc7b9380fb133c2d9
SHA256f6f6bc7ddb4ac6e5a29c598b540ca3d975d5b429303511982ea4d88892b868f0
SHA512b3e9620f1e988fdc556fe79802a6f5a7af57f0f1bfddf8ab7023692bc90ec1bbf64a0644ffb091aac784809759d0ff721b2581f03a7861c85e24f1c2c2142920
-
Filesize
2.2MB
MD524514a35902ff67a2c9b84ecedacd13f
SHA1c4a9559f58eb8991e173621b6565e080d2c16f99
SHA2565b0e96894d6370ef4c9285d792c6f89b5a5f9274f32d08b7b4bf6e4c9e5d9f4a
SHA512a3977ef3b38559d56e791ef1527286128b1eb2f8c3949403d16b6bed2074ab0af70a6e6f71150e7f65b57341552245048715ed9bf974082b290408960e792894
-
Filesize
2.1MB
MD58fd5601676816c967afcc2acf916f768
SHA1c9f445c02ffab5e68dada4ae0a56b904eb417917
SHA2560a4678a2a385aed289e33a5ba6a21c71dd72c36310b8fa4b874f58d4eecf94ae
SHA51269aa50a315ac182129fa822355963cd4872cb41f4a12b8a26031167cd2357ae02b572796b5c74092c14b361aef049065435ebdbdd0c26dcc0c2f2d535672ac49
-
Filesize
1.8MB
MD547ce71a27a0278db6d1e98af76163210
SHA1ffd87363d20b234152e11096debd5d57d3c04f1e
SHA256b858c03a6fb5f45992804eae0e25cc60481c8307643399d1100218fe48ac56dd
SHA512ee5db3bb353267b190b1173542fda3011881a8aace9b95a4ce4e1f5fc4e46e88e1b7a6c23f07508ea939096f5b316cda6681aa169e493f178bf1fea0900efdd3
-
Filesize
1.5MB
MD5da26deb3dd307b911fde220d0f106614
SHA1c5ce86e09f8ff39a613170502134e38632826686
SHA256e00178e0f3857abfaa9dbe6900f47cddf92c09470e9f1ec2b4c354c66bf7fc5b
SHA512e2af31177c1b6bca122902e866d624ed35c06b85a0680c83c03522575c66f8757aa1f080e2d1da75a80793d93cc08be89d60bc8d7004f47b74457138230c6587
-
Filesize
1.2MB
MD5315d462de4217345f1cf90aadc934f32
SHA148866dc5def4baee62d0225a521be2c2c927efd0
SHA256a3fd97b0023d31776b84ac4200f35cf902db483c59c876d763d28f1c74004bc2
SHA512fc13cbb9387e964c511f14ee2f94bdfb53aa682502601bd78ee1edee39c2dd5dc86447657e7730acb8b05c418f065ba7001b38d2e74233fb44dbbdd50a49bd40
-
Filesize
1.2MB
MD57d9d86330d5cddc5b0c0aa3efc495f0a
SHA1e04d93d7a70b1f264b6dc2352f40162c71db8214
SHA25676ed1de4d86dd08a19995a2cdcb2c302d894fb4ff0744d6b856d27dbb54d1f8d
SHA512e66f7cd94dfeabdf8d1227949c3241aedee3e25b16b8156d36fa9e4940b943120c74d4fd664ee72b383b301a7511fbc84da94286b86c3d4c2e7bef694b9ea4e0
-
Filesize
1.2MB
MD57edf8d814939164cef590cc7b69221b2
SHA199f0fe21035a29074deed4a668d754bac61bde98
SHA2561a0758853a8f8f5400608323343b3f905210500f832fdf450408630d2cf4c13f
SHA512ef9d82b9b8607ec9719a8ece76aca2ebdc563a0c4e54426fcc5527b6b7690ceadab823d9b53fa8f5122847d098777a93422783288eca9bf6712631a272a018b1
-
Filesize
1.2MB
MD50feab93b5cc1df285670fa246d713a92
SHA1d531d75cb2f08aa90a6beb3cf7362e9efdcd1ccb
SHA256cef97786621c56599e5b0781cfb7a9d7a4cda70043378adb3f867a5f47bf18ea
SHA512cb2e97a42d7e600279049d81562bb9d52930ddc5102e53b16eabb772f98adbd97f3e7fd314ce0d72bbb884afa5c58a0ce6df4363b0ce2d095426a83f97e22d6f
-
Filesize
1.2MB
MD556768bbeb110ba855552dce9eadc5cd9
SHA17e1b7f593e04fa0c9904f833c6798190cf672f33
SHA25676f0ecda5111df29b54bc2b697dd7989a12324c20e1885c072c2430f7b4e8111
SHA5128dafeb8a7ab3f6354c2ff1c2587efac62c93d4ccbf5cf811006ae544cd126ce689daf6557aae29171c5fbed021b2218f784f7e1b7941531825d4e96d566ace83
-
Filesize
1.2MB
MD56ebaba2497468016f71fae67d7b33e1a
SHA1ac7107631bd892b1c2047dc00b0129bab9b165d7
SHA25641a1dddf3c5c700553b7e6c0de359fceec1766358668f41e9a997e0f4ea17376
SHA512cf202d0be480ea54702f1bedd8f81f79e4881f844955f426b4d092c2d9a395d7e0c1365d2f321d2552ad1124fb4e5767f6ca23e54db8c9e8adaabf9ce0955f4c
-
Filesize
1.2MB
MD577a6c5c8698e31df9239d6227da40960
SHA186f155796b450e23c8bdf411c9e5f68ad2ed02c7
SHA2569f501612d6c5c43331b75b6852bd1ce8fca7ed650e926f3a3e4a3cc9a509dfb8
SHA5122cd546fa9d8d824511b724228b7cd528a0d28e69dc3e3b5edb23125f8624cdfbeaa0d78f7a481d266de471b536489e59089691709cef43857a995248d28fd3ab
-
Filesize
1.5MB
MD5810f827fac67b5b47fffc540f9dc0d0c
SHA189d043b5eaf3f311984265f174966493fbc77246
SHA2562823afce0bda5d60e290cd9c198d7f6fc4ab4262c98786ca21126fce86be8943
SHA51268a05c80b54b8bf5b371ba4eeca94157266db44a3d7ec65f1020b15d70eb42fde33cfecd6bcf556c00d408b2091eeb9b010d79b2205ad566d85d064820a9cb68
-
Filesize
1.2MB
MD5fbca96839f5b181f886a9d3acca54068
SHA17ea0ce0acc0a6160ea760f9354ba09457de16be8
SHA256cbf8c49a374d593323fe46969319315117b3bfc22571d05c9608bd1a00ea304c
SHA512a4912a4774634a6b66289806538774a157fc06c147539ac6da38e00ca0164b65aa22f25cee72ce6817c33de8e871d14e0759e929eacfbf54ea2fa3c2b2d48f1a
-
Filesize
1.2MB
MD5ff6de1d5c1ad3b905acfc42404381060
SHA1740ab15df3c404dc3c689ae517d97aeb7149d329
SHA256616ed7ceb91ce7431be32d5ec131857fc337fbf8cad78c2d532e3ed8cad8d402
SHA51250e07015cec65dbe7b49d415492b1a37786da9e95fa438ef67c2810ee243fba36bb12a438bb6186cf91dcc37c7958b50c75aeed07bc33f504c28eca9b0000198
-
Filesize
1.3MB
MD519d269e85534562cceedc551bcaf3434
SHA1589629b520212d61372f8b85f2d85887c579b161
SHA2567e5cbb40133ccb7e8d7b1bdfbbb38ef5aa87e4f2dcc7eb5bcedcdd379e5c6399
SHA512eac105ab27c7f341ffac9786ae811fa3946b7a7f56c250f6b29407b72a236fb1a42dcfa9ac0bd192283931f7682af5ab43c43903c8e7fe3b0c21662b3116700e
-
Filesize
1.2MB
MD54472ce08b2505af97a7031805ecc9c66
SHA1bfb76a570008c28592ec1c8ee530d1b1536e971f
SHA256f58309b26729398a1f0e95c4fe139b08e1be75eca1ce0cd30d4687afedd93eb1
SHA51217728bde8b403355bf1edc49b2824d7df733660ce9e3396ba0a24ece7999c74c1c78199c07b969271a92d24989ab2f0ebb569eb3767e031fdfad72e2dd14627c
-
Filesize
1.2MB
MD532ef716bd7d4fba2f867b1d82dfddb68
SHA172c8f090cf5dbb2079bf7449aaaf4dd8737e507a
SHA2565ed31ee3eab7b3b598b5904c35425217283bf8e9fff6610e59aef3f030e48048
SHA5129124f7d4fcfa62b3750fc65291cac42b0feea7c1fc3a95ae52f3ab0e88693f020b72b4cb2d331c7acdc7ddea718bfc58ca5f3728ad6176b1c79c4c71fc21e31d
-
Filesize
1.3MB
MD51beaecacd5419c52abb496f7a3446648
SHA18ba5f17bd64a305b354e01e31d4a77c6ec57598b
SHA2562eb2f94247be27290e9b3ff37b62592f624828f0572aabc5c25955d48a6d1a00
SHA512884074b7663a231cd7309e07a1ea7a88659282e9d18eb6d7f5b39c52616e8b6ae9ae51ceef073be60d00687af9e4ccf6b0b79e2cd6ee588ea8d2d7bfe6fd9f25
-
Filesize
1.5MB
MD5cc220982a20819f8daba52db904f6118
SHA1e7060bd77ec04b4f5043984790ef90ae42e6cd41
SHA2569a60668972d726d6968f7bfb5f2785a6cc3c227e4b0778323d29cfef8bcd650a
SHA512fc91e2cc80bd53e95218056b2910897288c644cfaac10f7cd7e8a53c33a9d392ef73dbac7e6172143236bf00b53d0ffef38f9987905ea40bf6a3ae7f85273ff9
-
Filesize
1.6MB
MD560367eba53c3bf157213b8f7b3087eb7
SHA14c8c979b1d0159f4596092a4a1f90cc3d970f974
SHA256588c24565df04bf627b55afd14a39f1df3a8002fd172a59080eff567625592cb
SHA5125d27cd03dec97f160dbafe80282512c63c73d7d2b6e6b79358a6fc65f122804a3e30a193ee098d15e4d1d9151bc4491a32d6f402dad5dbb9abf74a8c45e0eb2d
-
Filesize
1.2MB
MD51b12598cee904fd7094f44c678202373
SHA18af5b40a207594768c2baf92927928563730fc97
SHA256e4a807a9e00dc15a8b7e4c36eb4eb4a02a23a3e753263b515369d4eb71edb629
SHA5127477fb3afa357d6bc5fe0984af01e8701fbf07c626b46fe0286e65068f6f45a4032286767d43b0a5dc598a51675405d22bdf2b614c04a5ea0d5fd4c73d849be2
-
Filesize
1.2MB
MD56a0964ebbe3810e60b0569a8ffecf679
SHA1d816ebbfa622d5f012e29155434d0108544995c8
SHA2566d82a2140ced420f72afdd2fe25353a558b48951468cb4cbcc2c5a6e16f1ecb6
SHA51202a2906f58bfa0a5debc99f9775b6fe5ec7c883ea839d0852ab81abb5ad02844f1021de283925b06d039bad882977b93bd2d7f1a131efb3186e127d1016196ec
-
Filesize
1.2MB
MD540243df6fab435f5cd1048921723ed09
SHA11ec59b16066da3ddc53aa4cf6092662e4c647275
SHA256c7193d10cc99d05e72fbbdfdce64c904cf9579275df038d09b596b31b770e042
SHA51250c472459c30d5a9e2621944956285012a36f6fe9159bf2a8d5af461cd8c8531bc7aa3f56eefc5b4c32d73744725f60723b9767d7515f7e2cbf6cfccefd0f5cd
-
Filesize
1.2MB
MD50e9aa21ff8bc793f7a021e869c110e98
SHA1e389aa7d38a6759eb578d291f06f646dbbdc990d
SHA2567e57ef6774804bd734e30998b8836d5e00b1fdc61eb690306d6dbc8300acc44f
SHA512aed5c8085211182bec3401c17665aac66eeb601a5fc9c59c1edae585e0acb27c87b4c06bd9c7d3022fff6af204529e5a3340f13ba65032791e6ecbd0433d1a4e
-
Filesize
1.2MB
MD529e4df63a5b82d97ac4da8787ddd0bba
SHA1b328d9e2dba8cdb33985db776dff997a6c0f609a
SHA2560ee3fb8372ce7ffdd11432d7b06e8bd415c9d3af36092bed04b625bed5b21e4a
SHA51209f440843034dfae04d8d6ab9b1253e913454fab5c5ad2ff2a6bab73eaf0fb061b3da416a560bc88679d12b566c54203600b17e2ee110962513488803cd96f3c
-
Filesize
1.2MB
MD5ac0b4b4f9a441a4e373d13b47b62580d
SHA15006283568e791f23a500b99c554e9933de5004d
SHA2561010cf916c4685a43dc26d68911f70689c9794fa18e53eaf2b42619e603a932c
SHA512808cf2b67dc879918ea20b9c62fa391f56152e6a6e134f5a31032f54c284cf6022cd744d616f01ecd74138f5b21c57235e160820c685de0fc5c03fa6933eab49
-
Filesize
1.3MB
MD59089469f52c18f5cac6dcb0b7062edfa
SHA1e0561db0724a79abae7bf8750650e0dfe65613c0
SHA256e58affa0a8f4665aeb2d620968363361679422393e0aec1321d8ad8164a93c21
SHA512fb7a1189470370644322aaf7e1afac6f50f37492c4fbb814ddb61c66a9751e28bafdd020d6e732e93bfdcef2237dbb5a170bb40ffa249331dd7b5f3a38fb712e
-
Filesize
1.2MB
MD5795d439c4097a1e92df80e008f5ddd26
SHA1fe75298632e58600bcc025afd76705badba63e90
SHA2569e3cee451631dbb81b4eee5e5353e04882e4d2349790bf565caefc7b01f93d52
SHA512003e98909ed1eab44dd42e97ac8dad5a9e0abda26c728ebdb2acc67ddf4e4ce9d9f8ba603955a4dc02cc7dea7c3f714333146fc92c4b09ccae54f9bb10ced0e7
-
Filesize
1.7MB
MD5e75ca663e5d4d1e7bcc49f5253e1906b
SHA1f647b06e578030a7fd1b083dff1954ea5a0d8f44
SHA25693f56e2e42a3f007bdc2611e3b932d2b97e93fa7ac8a7b1ce66b2bb92e3896e8
SHA51219a053a47526fb2b22cea16c3cf72a9b8354f3ea8fefa90ac4a8e4a8af0f88a01c73bc236192f518caea4de29bbd848c87ba372b306ec711e5405604c000394b
-
Filesize
1.3MB
MD5d6e28cac856495824dd7f77347c44376
SHA1e6ac15eb7d98ca39aaeb8611b06f14f8a552348b
SHA256315f0ddd4a6334afbecbd9a77d630ad210f6955785922ffd9ef5465c73bc0c10
SHA51239b3f0344c06e60ec73aa04926c574d453ae6fefe7a0ad1bb8c5fcd034f88e30bd2db9b4d3eabef9acf968e644420829a291ac4685b5d286a603cae93c3d6fa6
-
Filesize
1.2MB
MD5ecfaafe850dd174e78466ed888c5cee3
SHA1a9fbc6f9259577c3fbf570aa580f808cae177c84
SHA25667ed820aa3662c2cf06bb3eccc9425b6a3d558d1df50878f508065a4d1ee8bdc
SHA5122b41d9e3912ff8e86b1c87d678598f74be07a0026f7cb777681d74107bb6dc11322b3700fa79ea85c4ca9c8c28050480778096642fb1410bb0067e885c19f7e8
-
Filesize
1.2MB
MD5896ca84ca01059af54350d67dce12e32
SHA1cd3b21f547a8b512a3385a42d4b6a9ec1fecc790
SHA2560b37acc93cb82ab7e3a3b39e035a6136aae51c1cf456e5e7ec00ae8ebc208a14
SHA51239bc91c5196897e05f7b1e558101e83e0a016fadd1a3c1cfefd6ba658ffeb3edeb7a476596122103fdf9fc2ecf4c231df36170d53beeec52875151bfc7e46e3c
-
Filesize
1.5MB
MD5c99193c1fafcb6ef5e0588bd595f5b86
SHA139b7c2167bd09c0e6f65006b73e4ef88b4c2e28c
SHA2567262192e417415fbfebdc75ffae689ff9c559403332986ec10e0390513e51735
SHA512c761facf486c1f51160307cd43e5173c03353ba4a5bce895e1f5ee812163a1885f80007d350f9e5d3b62c96d6b7b5f1649cdbb09a1777052411d5022dd2fcf22
-
Filesize
1.3MB
MD50c5ab7b007cddc32d827fbe8947a4bb6
SHA1f8d8530f80be788e3c365a39c253aa67bf221c64
SHA256a36863f576745c15339cb07ce04f2fa699841cfc02b091ee289d47600505364a
SHA5126134e26653a4bc2256ffa233cdffc997919116c30b33b0dc5a9613b27ce6221087d3c39c83e546694a4053ad1e06897970b12cce9220d9afa7ce4d8df79859d8
-
Filesize
1.4MB
MD54746f82bc118ddc1580913625b04ba92
SHA1b8a556b446e43560b358ab3d5c7e91647ebd4d95
SHA2566e47501c8c8bd83ff6c282fd29fb1042931502913ee9667e18a4c023c357c0e3
SHA512385c8c9a3c87f4f98f34ffa047c48832f7a0c31e9d2dd12e2d77d9db2868234ac6eb920111a7fcc9cfde46d9306ec3e3fc7127e24c6f956aa516137ea009a4a7
-
Filesize
1.8MB
MD566a947b65f6b8bed9ec8e899499ea449
SHA1bfca72cc0bed88206fa8c7ba7a9ccbed01ca1aa8
SHA25622b5e8b443e54d32ed0df4a13d4d5acb3d274face87c1899c47dbbc257386e59
SHA51287d7a1ae70d42cad09382fb09cdda7e08c0198cf5c93de0aca060b205bbd4f755dec9dcec22355a8848d6f7f91987a0664ccca08098a3dc8ce90509b4e4e4920
-
Filesize
1.4MB
MD513193818e8f4e4bac5f416019f366063
SHA1b253c1942d0be9b9470f8804798245ad57f949e9
SHA2565fecf2b3fb6dc62c850be8ebbc4749426c2eef0bfd0daaec93f3ad65e31af398
SHA5123219dec166a21bb911febf96b5af58d66c4000038da8692f4a0081630375e637212f5f9ed81052c1447e1f388970ad4cf66969f0fd0edb2e136adcb15f8c61e4
-
Filesize
1.5MB
MD50a7cad52078ea64b373cb9461e616d25
SHA1f51b505348a1165ff66ef0d3d4c8b69bc7319142
SHA2565855ae18fc2a3c58c18a195e9915608639133ee940deb1bd3872c866f5d7915f
SHA512580af3cd2267f278592ffb837bd12c59bdfa34a090ac6f0df1d82a67d4b43ea1a960157eb6fa1cfb49fa4bf8af2cc68f28a9783ebe529c7099bb1cf9d89cdb2c
-
Filesize
2.0MB
MD52d2ec1f819219ba57258cace9f4037fc
SHA18b956270010205325b3c369d0f64a020d3f12828
SHA2562aa009eac6738d7b243c0f05bed2f215ccb85249d1056d0d79d2d2e75786fa41
SHA512a4b78ac55d6d77de9e32f7c0d36c3a475037d69b38629fef88090b185e4aa7694663f9d9c0cba6327b211aa9b32e85521c0a7cf8a41c1e5d9cd63bc78489f893
-
Filesize
1.3MB
MD54debdca8c5231d40b6ee0585f4d48fda
SHA1269c0e52c43104579e78329dd80b69a8e9a340f2
SHA256c6396ade0d63706bf64415f70960b99978ed3c18aba24644f8b5199e226859f3
SHA51237477b7831cbef6eba0877b6bc7ba1da56b8458fa1b75aa19f2abd15bff21cb256be3dc29279b99f950881bd8b12d8b222ff77bd757df58bdab7d538cc5ace1f
-
Filesize
1.3MB
MD59f1d0096f29ef497709ca4b51abbd655
SHA1bd28ab4f85fc6b81a4b755c81bab8652c969cb7b
SHA25619f0a9e8016e76ed5e7cd6a80bb342aec0e1296424877f4e97b23762e6dec120
SHA51214f92fe8b6cba56bf7ba098d8aa2a6c686043be2d5449839372e0b860a0b85f4b7ad9c5f516e3e51d87866ad4a8ca4703eff07c8514339008f6f264ebe1795d0
-
Filesize
1.2MB
MD555f9b4eb625420d4ca3e39a9dc7e8861
SHA12293547d07ceb3442e442873b5f70035606ba114
SHA256fe208980bce4fb6607d660df3b234e8d25035399fde856e8fdd9922ce5135f55
SHA51224b31fe05868c5320c884b52a1b5b2ecb07420a831f09d5e90a61c8f6f92f5326291315f6932a79808d604dad59bd889c49f0229f09289c64797f24a143f2df3
-
Filesize
1.3MB
MD5d50b8b687f0a028bb71940f128e0e5c5
SHA11793bfd0d3cfccaf0faeba5a8ae6c95f5962624a
SHA256d8362d57effb00f0b11501f8447fea3371eb619b9597426937712a0fa8547a73
SHA51288d136f9fc1b298497a2ea0ffe83cd99e6fb03209746407b9c0a4c86359bd145958aa14d7022cec3228273e79c873859cad08d82cbed79b0d40826d21c1c4be9
-
Filesize
1.4MB
MD558222941dba984546545f5b13a24579d
SHA1a2f365445816e806b3e5a9027ef987ab4a572b9b
SHA2569f7d65951fee45e33bd4843cac7e7fe30bb86fb0778ffba16f83fddf7fad4d0a
SHA512bc3eaf774abe365346303056b8148ac9144647aa63828d89a8b53c3092c5a18610b330553b7920b8fba8a74b2dadae647157486782afc21c7b5e8fea88e02a4d
-
Filesize
2.1MB
MD56407a982249a66e014f5041c7d3a900a
SHA1ba8a1a408a272c035b9e4d452eb6e0f5e0f01c96
SHA256be33d701dd4fc3a830cf8dc32b4403ce16aee1860fa011038e2571a34c33f3b2
SHA512b1082fa4f57507393459100f36752412c01b8380fc6cb42035093e4d89509b28c9a6088c6284a2de214a3f3f668234313fde25551e38651699c4840d102b8834
-
Filesize
5.6MB
MD54eb5972abc56fa4cbc2cd9b67166babb
SHA17fd436a5677fc3404afb1a1c841abba9a508b51f
SHA256e4d9f78b715091ebb73abeaa797fa4b6e8f1a99a16aef8ffe2c0b2f3d6f9b6b3
SHA51243585432ef274a262706e1c06d57e1c6239ee1543dda9a99dfa7ffa8b764fdd77c6f3b8ef0f64d648db283e67c072dcdef4ced4c30011ca0a3907be7e55898c8
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB