Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
18/04/2024, 18:26
General
-
Target
2024-04-18_51ba2225767936bf5df6e60c709ce4f0_ryuk.exe
-
Size
1.1MB
-
MD5
51ba2225767936bf5df6e60c709ce4f0
-
SHA1
75b27535a47de9a40d56ac3add7d344053debe68
-
SHA256
1ec9bb440a52f8000a3079aeba06102683ea0456b4a6d4f3a3bf059c9d6aa1c5
-
SHA512
c17226df6cb6371d9a72e7d6c516fd75cad048a64ed72cbc4f15062cd45b3f0ed067b41ff10676d3b848f05712e1ed0802c092606ff6cb1d8f9b8114dbe85bce
-
SSDEEP
24576:WSi1SoCU5qJSr1eWPSCsP0MugC6eTcSRQ5UOOU62FBnO+E222YJbNEUQKGOb:GS7PLjeTO5UbU62FAQ228QKl
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 37 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-18_51ba2225767936bf5df6e60c709ce4f0_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-18_51ba2225767936bf5df6e60c709ce4f0_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5246659671c53dd92394d9af7fc338905
SHA1995fd7bb5708a85b2cbebc3261d46cdd38eebef0
SHA2563410e8abcc27d96a4027b8cf3496b4ff204d429aae3e53a50305fcbd9eca5413
SHA5128c41e6c76edd2b57848d425ad647c3d3137388180cc3488058df149a414e91dd2384147ccb4b50750f21711abb536544a5fc36c2429ea9fb204d327221aa0395
-
Filesize
1.2MB
MD599b7051dad05015eb87e30c55e71e82a
SHA183fa8334b9962fb1ea4f842a33e763013515e5a4
SHA256e9a106719ec410c3f2883fc362a5659e7d42f9ca02fb6f6cea11894790fe7ebe
SHA5129287f9ae868793ea0833126846211a358b9ff491926cdfcf65402ac9fff08f94ee0063707a4842a3c16aca94a10cd51cfef55351fd76fabecf9a305a0623bf41
-
Filesize
1.4MB
MD514b00a137855ca9e7f872bd35ddf5210
SHA109c6eeac643741531217798bd50e6d3cddb82653
SHA2562332b679226fa794781c2eba324b6669c7f43468b24ea21bf22e4ea1f70c3e13
SHA512b25b194eab7489cb9f1970c6aa87a8808a7d400fd6b6e07250f8fbcdee6b8e05abc3a83c2c6873891b3d932a45d4706172dea09cb89c9e8e561b7a331cd635ab
-
Filesize
1.2MB
MD523f1c47067126c626c8107388a99aab6
SHA149f69a4534b4c3746137920d0ffe19d3a2c85d48
SHA256bbe0c6d8867472fd8cc2ce877394181ab9f9903dce3f44ebbf29b3cef84176a3
SHA512567fa89e4fa1fe249e9154f2a0e8f76408fc50dd6b74eecba66f8cb4cb91400181e94383025613871f5e9ce23d8b2fb170e25fa36bd0f4cde78b5b81fefe0814
-
Filesize
1.2MB
MD59958596e087b7ac102d897def003a728
SHA1219433fd74b40a4c6f2743403a854c193203c0fc
SHA256e5eb1dd613e2452e295fd3e6c4090eac610dd0176e4ff195d2b8c2db23e68263
SHA512b61f8635358764c7cdab9b5810452355f89319e29373bf817b5473fcc491b107947242846ea7de1cf243432be60b97fde96376864c68f1b55ff760c23c775adc
-
Filesize
1.2MB
MD5a3679c1bb5ff55406fd4c9cac471bdd9
SHA1e65a08cfc4a8795c4d414f134a7b16a40b60685e
SHA256d42502a52a3515c41c69f47896d46caaf8650f86c5de9edc6e98c67aa93de3a3
SHA51246abcdc4a3f178548b0999652cfb9dc6ebdb63d1ead0eb7ca34f460c8a91be7ab42b3c437dc7dbd325d9a0c768cf2bc4a31c624067f6a1af52c96200d239626c
-
Filesize
1.2MB
MD5d6b3a69284ee7a11c91b847d4e23d38c
SHA189321b34d49f1643866eccfef0e5967b3b477503
SHA25626de18e51ce6261a620e6709f4940451db27f10727fc9050b43ef4bc8417d978
SHA512a45ce13dfe4fd9ffdc46382899596932e5b85bd6fb477febb69d51980d41c79c0852d33563047d9324f0d16151f3358e4fbc4ac01efec0e8f6025fc8e692aa15
-
Filesize
1.4MB
MD50a1e9ba669b206ac4269b13e5bbbcf41
SHA1de645ea43e7c9a25fb10c0094730b43e91f32fb2
SHA256b6af0751cd7d2bf4a592c42566b3f43a3fcc56b98e17fa593f0dd26f383fc044
SHA5128cdb2b56dd5cf3191c5e639828f5ee743ba0b047b3c9e0677e517383e0b067d2d7c07ec8f6b999c6fdce918c96025582491f84a57aa82c0c1b416b4002824869
-
Filesize
4.6MB
MD55e48a5c07ab5e57a3ed2aa9a7172f4a9
SHA19af88c3eff16f886ffbfe14043fcfb6cf66228b9
SHA2562e3e7e3df35c58828db3bc38d12f2a14676120e77d5afce1f6d0242dc111216b
SHA512681d50b30f8f5025e883492485659cae988992b1b222cdc5056f25f21b4c1870ba27eb7952ec2a132fdb7a3b7970c210960896b03f11105585012168b7fa248a
-
Filesize
1.5MB
MD5348f02fad374b033423506538afddce8
SHA12fe7ccf2c18903708107eafe21ea3be8d2c29eea
SHA256ef5ddefeba6de7368a0e029d9fe10cb06b653089b06fc22a4152b056cbbf3207
SHA5121828d3ba957a0cf852a957fe26c7ec29aa663f3f39ff445c51291eef0681e733a19439b758a72d0775e4ae9a4c89a345c1f4a3cba491d347cb64694c9e322bc1
-
Filesize
2.1MB
MD5a068442fc1fd970056230fb536e0bb0f
SHA1a3d5491b608bc38803fe198e0b34a6d76b98cf87
SHA2562a70b96ccfd6a9e7652843f934276cda7e9afb8750e72bad037e697c6a068e2d
SHA51263ea1809577c9181506f2bda7edf13c35180495f9e367e85741b470b3c9a758e7b5e5ac1153f18bee763893dce01d7bb699ed6e3715b5cbd8751693c3ca8650a
-
Filesize
2.4MB
MD5084d9b88ad413368e858ea3aa535f022
SHA19dca23673e760502894381d82bf60c0d6916b0df
SHA2569591d74b35fecf6be814d24e35ad5c855ed81ea4dd1f106f1eaf79dc90af1d3b
SHA512cf0939ce1d8a2fe764cf77513dbc95c8016632176b41aa125cadb9d7e758169c1ba293cf85a93ba070537775dcf6a72a8d651b1826953aa475bb2cec87f54816
-
Filesize
1.1MB
MD56e11acd2331a8b11e41850a1cea6f046
SHA1d8b4ccaac579de2a0a94fd573c202531c7a13baf
SHA256ff4df2a89f3a32c18cdaf5e37fb8843080ddd977002e256460ffd0ad74769e4e
SHA512eedca31a014ce4837e28226641a4de0ef08a8879940892400c979fac7613e2cb52ed3f0c0745fa7009483b5286aff53df52f71f03fd88115eb451f608b9d5df5
-
Filesize
1.4MB
MD5779e0cb2b1c5ffddd4a745631eb8e5b4
SHA19093c2b5b794509aa2565de3ab5ca840fac2d260
SHA2561613fe57df8a17316136a66695889636071f3bc58ece249843883103cf28a4e7
SHA51249d38e666f4121134dacf8d78b1cf7a282efadbfb8b4def7731386a133d651332005030697e78f293782796ee20e7a671bb4ecac6e09a1e66c18bcd2d71ecbc5
-
Filesize
1.3MB
MD529e67d1aaf1205173494010c261bed36
SHA1c1b56ef2c3a1f24f4638b86a7f81f5b34eb5e64a
SHA25663cd5da86e6a53e84a421695d9205cc2f003f4d505a66b5aa2f998ab7de355cf
SHA512f30e1487422c9d57d214800a9a7706bea7c74203c1d376d6e9b12fcc0b3b30a16a0b46dc03bac4ee60cd16262bbfdb223e09c9d78eea9d1b1f64e7936d5843c5
-
Filesize
2.1MB
MD5e512675b7863c6ca24c3d32a2ea0857c
SHA1b93850adf2ce77eb677a2a191ab41958702df9d7
SHA256fd49d997c99cd825af877a194b48995241eea8a5e74714bb5dbee2a45f877a66
SHA5120519775854e1912089a11530bbc0fb61a293a7b8d44680b6ca21c75c1c5dedf6d4c2c3f8c9cbc01ab5ea5872b4f61335be0bdb7a9ead81f5777ef6a18fe1a743
-
Filesize
2.1MB
MD532cf179735422f2cf11f1e9cacc1e2da
SHA1c13d4414f288819ff20300f6c52ad3031941913c
SHA256cc7cd277c3a4e04ef0dc9fca890c2e2a3a0f95403ee5f0406cf3f76bd08bc2a8
SHA512f7f6b45996348b8227b894ff07f152e68375f97cfc2bd54c573cb68655708b28dcd9dcf1aae83f7c6e3f15300ed8ca53326bf07fbc6bf25194a9bcb58416750f
-
Filesize
2.0MB
MD503e76fed88d1ba28e21a2c34a63c6313
SHA1d4f121383634c6dfe7a8eee5d6f286371710e93d
SHA256c81fef6846803c8bcb667abacc42faff9f21749e9350a47a361c97aefa7ca004
SHA51215b3c12f4234d73c7f730ae8631d04ef702e02be6e064715780eb941ed23a993eeec1bd1cb2b77569ffadd7427141ab4a978559c6c9bac1b0e526e5d59831695
-
Filesize
2.2MB
MD550849847af7e46ecbe6d3b38deffa64a
SHA19f6f18c5192d135811e41585ef81b78fda11090a
SHA256d45c9d014892d133bcb08154323d597ce6849d615b4ed7ae9e1a931ef8801e12
SHA512aa856cb243d5b35e04ea69ac7b59c7f90288b52679bde44280386d4b39bad7295ca1a82e2d7f8d1e750720bf405245bd3a1e1e5d27082ce82e92b2ea2dd48495
-
Filesize
1.8MB
MD540e8c8e29cddf9ad5255be9bf0dbed38
SHA140f08646b2ca5e94844152805ec8b11469dbf4bc
SHA256adf7e0b0e2c8ca72ce4f3fca363316c8af7db46c40ae1dd1b8a6760646fc2939
SHA512458efd6cb1d29663b81219814ecef2f18cbf7668a679188ca92cf00b71908b28eb133b02f1b43a86deae6367fed025aa81e75453cd3e35c116dc56f37663772f
-
Filesize
1.7MB
MD599713db7a945a27a6481d55a280325d3
SHA12b4f0c40be4c2255e700c333b55a20cc3478e512
SHA2568254634c35e4944b7b17fc7d8e66d93385142a889ee240aca74c348fcb3992eb
SHA5127d9d77d5cc2980c661060ae5c221b38885c8cf79e74156b074c6e84cf0c1ff01558acc9e5c79727160cd82913dca91df3e528d30e85eecdc95ed2e72d82a6124
-
Filesize
1.2MB
MD5bdb35cbcf8c8229633709bcb607f8bb7
SHA1934beeef2d4cd76e45cdf8a0514b6430eadbb73b
SHA256dc5a31b2c9642668788fd7e6c2980765dcaf14c931a40cd3f2c606ea84a4408a
SHA51253233810fde473b374f2f9cd26ff021193a358a583adcba11241bc3514a6084977c83de7612b41439b11cbcb8b16aa329fb9082d03045ce8c71fe4a696f4df8f
-
Filesize
1.2MB
MD550893f703956aca068bba8dd85fe4709
SHA1eab2740e51fb0474364cfd5e2240ff9087260900
SHA256ca5c6fe50a8edd1de1e37d8f6c7364ca8d3d84d5b5d1acc3f2025edc46a73c9b
SHA5128a228d003ff21a694bb6b7d758118e6d3a6357473053ff3f58c22a13ad5c39957d84699f6e1b95f22f5328139e8456bf63d82837708c30431b86b9a60feca19d
-
Filesize
1.2MB
MD50804bbfc1e48407e1413645ff54f1676
SHA1fe2de4f409908b642e01b62e3d72b34dc991be27
SHA2561266963b4802d461d539ff6eb669bf0423d358e1c19dc8441d3945d9f9d80357
SHA51270cecd0cdce4fc64c47f37de88eadab7d63ef6fa8a12d888e13880e584e8dace4700e7ee945d77ca6001965c8a8cccebb257a2c4b0e4d9f2dc217da88206726b
-
Filesize
1.2MB
MD565b5d2b157b38b25ef81bc9bd9c1494a
SHA143a2e07a9145a2737be1716a7e5e10f7c920d736
SHA256df0ddb8575d65d01171097521b2082164be84684e91859ba9786decf79abbe1b
SHA512e29751ba52ad50827cd93ab1ca8cbfbbd2c0e67da5ea64e3235588e54c8d5a52188750a915146ede8077efa9cabc30556ec1221e0e1459ef7bf0d16f95df7918
-
Filesize
1.2MB
MD5ff3791fc03c8f0f87e59ac946517eeaf
SHA1855dfc8699553385142a92577b4ae7587fb09b75
SHA256ffc7429562c929069d852dd00dc5c9b10a613a9fc0b6080a096fce5b04a87cd2
SHA5120dec182915507f6a58839030c704e790aadf76285a69a483c312f45802ccc204e670983790b127dc38e3935ebfd0d74d47df55fb2da8fd5733a1ddfcd25bc491
-
Filesize
1.2MB
MD588a653f86fdec88c4ad094da9660e50b
SHA1b4f8967b48417a5c5f2c406d3ebc015628132d59
SHA256640091ec40dae553911c953e05ccc025c66673f6dd2ee65ee923221fb3c3a599
SHA512cf794e8cc1e2293eab0d42e42f31ad032eb400a63c6a15ddc95bc787dc69f2040d1df0a1d7f9fb21764b6e916b61096ec22fe9b89ebe5523a0e1ae8ac9ce1bb9
-
Filesize
1.2MB
MD58d72994605866bc512ade423bf9eb5ae
SHA11bf0458e65869a28cde02ce1db69f96b9f79ecba
SHA2567b6daecaac344578a6e37c2f9db81d62e419cc2a6b8e628455b3a26479524431
SHA512a75f37446220a57be06b9bfe3b505b5fda78d49da4d64405d33783257ef8b9eb12e99ed8e92299da507b787b15d0a34b2a616c61c5c641db7b1f2d5a18ed56eb
-
Filesize
1.5MB
MD555555f15a0851bf3fded034788289257
SHA1037b5784b131d48b7a2476a20948004110c57626
SHA256b3320fec1591e424953465889219a18030f99779b4937e0b360523347d61f1b7
SHA512ecbe14be0a261d681710a69871c7e8c4c9afb568d8800da2c2d5b30ae400be976a12a6a169f3a256a55aca8673c66d1119f0a28fa62e55462c08f048c2337472
-
Filesize
1.2MB
MD5fe3d6d2542691d9135f927938d675a85
SHA18978bf39bc4117b492b2975bf117631b10c98b3d
SHA2563bd3c1e795a092e01e33fdb03f214cd3590b1052dd10496c9d93a4a6823b38eb
SHA512fc75a43353a6bb7f18d120a09b306d32ffa07d0e129a7e97a318705907812a6d48b1a44213bc39aaf199ebe96a688954cc38f7976601a7c6c89b0750082e581c
-
Filesize
1.2MB
MD57f579606fd2997e2b4af714e9733d1f4
SHA1a6b8bff60f1d5c32eafde07112a27ab8d8a5fea2
SHA25655a0d06152561962caed96c7e7579faf6710c661cb38e9090791b5606e35e2ab
SHA512ccc6431d9b2fb82d93a3c628904db6cd6ae874bbd54ccf84659512bcae58dcca1beb006378bfb640357474db106392ff0839f5e67a75c886c0a4115b6310f0e7
-
Filesize
1.2MB
MD5a4617f7e8c69d2b31473fcf144c466f1
SHA10ac0023fae5b175f642c6d09edee7274d1d5c166
SHA256de97b2319fc6f23232b2f019ee5df196eca99b517ce45abf704fc19f260abc3d
SHA512334201041f5e473e9a9454eb912ae692d2148dc7d939b2409111e9666fa9588cbb612460f1a39e73897f97345f4aef09502b979d51e46009e0d50d574b5f982d
-
Filesize
1.2MB
MD526c939c245dbc5ad8c7e38533d82e167
SHA18a81661345ae3031b2d00a6c7b6aa7f4065f2ef9
SHA256dd21892ccc1e486183325395dad2a702ffdceb5120845e53fdb94db16144af5e
SHA5122dd37479b687a95efc82d57fcc47172366145c75c55bc5b32e770d6bfcc6a2c7a261101d040212895b4f1380e3b41dc927ba5bb7dbe8580e1501637ba939995b
-
Filesize
1.2MB
MD5f802e9fb01323caae69024391dc28c64
SHA1d315641d489839d009c646a977d08f8e5cb926e0
SHA256a0219bc20960e283f8ec2b82ba8926392367303680c32480ec3dee0b3fa2221a
SHA512c724b7c5065603382cdbb04a329d25af4bcbbd61c6331def749860e82674811e0d4db3d407425fe75a2f17bbfe1fe2ea5d79d459482100756540f39253d17b8e
-
Filesize
1.3MB
MD58ae70382c47bdfd1b79b5cf14cc5cc04
SHA1bfc2ac379e7fac3a9ac0f457226fe55671f4fb6c
SHA2568a8df289aa1a92199949705505f13fe952fa97789c63911919847b58817a8473
SHA5123339ea074e2db6d51c35e0d9747763b84618b1b7ddc02df0b5a12f4d91edc4fe04299bdd0673f7c914769f237cd867fe68a19c020fded53af3c70c2257d109d8
-
Filesize
1.5MB
MD542a556dda77a913fd5ee4baffd1945a8
SHA1276e6524c14abf38f5fc8efd0716dd27bcab993b
SHA256a913f08c792e23a391e6928961386ba2debd679c7f93e2f08c9be03be75770e5
SHA512ee02dbf7bf2087ab804bcbfd11092747bb9d46242163ef56bfa1482f6bc95447f7c732a11f6e50c98cf357db62df9ff011253249cd723bb479c914aface58425
-
Filesize
1.6MB
MD545acf06ed2d39c2b800c548ca5122fc4
SHA10a8e40a50efb5ee03f54cdca758b8caf2a5fbbff
SHA25647c74cb64ea5e26cfd5237c6d63ad492b8944400c9d25dd4a8c3674fd44dd884
SHA512fb7ca0fa44bfe487613081a2be2bf78a9c745c6cf128b8cdf982c0db6a549e217913bd33aa37bf631fcdf06df30da32b1da34fd125e6c993f23e14fda8b7de82
-
Filesize
1.2MB
MD557f8a4ef4d606fa3ab50680923a5fca4
SHA170d2c10839e9836498cae4d0baf86b42acaadc40
SHA256a58e845879803879094190986917e2992dd24b2232e14dbabf6773f62c0e6a9e
SHA512aadbcf7813aa7d6e880925642286b1784866e9f28f1fb77cfe955e1b1dc40a90a60c0cdb9f255b4a04c23133b8febd1cb3743149cbeb07d3bf97d128296390f9
-
Filesize
1.5MB
MD5e9a30ae490c758d712ec247d3aadc05a
SHA1f749340e3df0e7b9335c2b69e3b983a63a90246a
SHA256e9f329602b0a89eecf9a93b06f9e7e414990ab7599d9da4798d97bd3c093a2f1
SHA51256197a816287b7f6a914c0f4a57a25744a41a79a87d233ea26e857501d33452fd5b4d7d77afc913c8255a9892ea105b1d66d6675a8ab397229d7f202d9b8d535
-
Filesize
1.3MB
MD52ea6c7964d12408873e2a5e56d668eb2
SHA1328889f1d610dee699af3d30d0e1dadbf255b00c
SHA25646d8259186d23682c626aa41c0ee7243f3c06120ce11a27cfd23c8eb80fa399f
SHA512c502ea493633de8d6f7037a351626d99ba9b65d51e2d551da7229fa879836050033cc2cc14e96e8175ff50a8607a6e0e1c904577d8c3334fe3388dfe88d50801
-
Filesize
1.2MB
MD55d88126af14a85f3afebf171c0bfdd27
SHA1bfbfd11306e24ab3ce5fefd749a6677de9e8e93e
SHA2568831c810bd656a1be8a4e6186e984c5b5a214934857be600e21fad9f3826b240
SHA512d30c2be7cc6392e604a5c4ab43ac55d46372dd8c86f827f2a5d7db130dc358b1a561398693b57f8771eebaf39fae937a2dc36ddebd196c5b6e89beaa7cc587ff
-
Filesize
1.7MB
MD53cfca2e0492796528fd37528c20d5a02
SHA122888985a191c1017d88dfe8f81618cebcc502e9
SHA256a3583c4ed5b3fc20c312f1ae4214d6437c3abb6e7a6b1cdc559891f26045c209
SHA512ec7506df7fa3e27ca52cb50e80c634a3120ff1d79ddccb7817edbb4e737685187f6201b9e49554d7a9dbae8d3f85bcca628b9ef76b3c5ac976c89da140419067
-
Filesize
1.3MB
MD5503b21348bdb74c257c009e32a9b0d37
SHA13e1f220751e0df51ec9b9fa6e987ef8a104993a7
SHA25674dc77a3a8fd86b2a4486a70919df65f1d8e09b57af410b8a4dfe2443f534e38
SHA5122821a1673c9f31e38bd2c1e5204b079ff6086b31f95c8cbb8137cab5fc240e99e5b2c23bf2d7df9dcc9844ce136bae0f2f2200f41a898b705c4d8b2cf6056ae3
-
Filesize
1.2MB
MD5e846cdde0f2587974781d6b73b630c63
SHA1d547b1e9d5549a55c9e17c857312fa10b508bb4d
SHA2567260572efb80fd9ddb52362ca644e2b320a59faad2328e9024a695bf567b5249
SHA512d68e575903111f1bc645be7f2921105dacfea9b2e1374f8607fd35d2e7a1fa8a67941f84546dda64a82abcb9c8abe37158e26c6650fa61e8fda86b517db95090
-
Filesize
1.2MB
MD5c605d06a66ec263ad0d945d0ec047362
SHA157356d5e9448cb00c55daa364bc0f736b3f78375
SHA2564ea57b7ec8b8cd417f18a87ac188b23ea2530efe7ec59a3566b93b3375da2f51
SHA51205ab9a2ba5ab460cf71be4a03d803efc42a846c9c10c0a6ad3472ac447d0fc6d901826763c1a2138ff5d5255caa70ca9c4d213751e5d1e593a6ecd251842c422
-
Filesize
1.5MB
MD52cd6ac4e7b74b5f19bed86fd0cedea85
SHA19accd3d02f5143f2874e3c7f204f4fff2a455607
SHA2562a077eee598085ea3f2a9b8c93d7862ecd76b4f9a45c5bc4e00c0fa94a87faa3
SHA512ef4ce1258e0b26fb4f0d21fecf6103afa61119f4a72b11c62a886ca1e09256ee64f01e2756e59c378164b3c7633028f8d329cead7c202dfc01f3789072c37cb3
-
Filesize
1.3MB
MD55cfcc9187e26158acd7a2d62168188b2
SHA17fa7c0a9a8f0d6da5d1e5c8248b2d503af1d97a8
SHA25653136d0b3e9d4c4fa58cb3c5348703356c035254c2f8fd1be2366d5a6e6c16e7
SHA5120f0799d02bee19ce6f4955be979e882b2e4b5f7a39cd5e0eab1ecfdb5ef574fe6fa108a9e73b10fd73b21f7af8736dd7e0defc46339278cddcc39d3f2b1496fd
-
Filesize
1.4MB
MD582168fbeec8c4542b432ef45bd1cc3c0
SHA1423456f07d3c3e3ebe96e4027d78362c8fbff2d7
SHA256562e37de14252f2b8a2120f8d1dedf23e66fa119644d0d78a2febec414ba8b8e
SHA512dd2c2a514e5b9b18870e95c79e1db3b4d1766aabd86cb35386d01fd508886e1f7283b72ae17de5e828e535a9d2568f706b6a00fd43bdbe0d4afabe7c6d2aa85e
-
Filesize
1.8MB
MD5567fdd7e0a7206212c152cd7e69ed8bf
SHA1016481d6a3333d46147701cfbb5816cbe846c532
SHA256ec059976cdf9a8258a9e938fa7efbc57b42a307da0b11e1c1deb740e266a77e4
SHA5123020b6f8659d9b517ae0596a0e29d8b2f0cee72f764950eec051cdea9a8b521cc626f77d07d1c36f651a3a0ebe52bbb7827c86ab42e9b5e406d46ca386e991bc
-
Filesize
1.4MB
MD5766f5007adc8c86e8e2895858d64f71b
SHA15a93b0f1ed528c97a390cb470598f4e6dca3ec15
SHA256536b9d7653bb56ea9067c3643c96ecfe3a2731646a658999269232d13c198094
SHA512b46b9e6c31f49403bbdf3f1cabf84c729b5eaf9cfade4a13198c3fe66203b03bc582bbf8d9a8e7fc38782cd4af20fe062ffc418e26450f8dc279fe75632fc6d5
-
Filesize
1.5MB
MD51d1e14dd39e0e4ba3d8968d024f70317
SHA1e4c85f54a037fb8f626202f42ba4afdec48dfc6b
SHA25646a0d3e082fec63231f92f85e2ed6c40b16816158853c9d55e38b6a6076bbadf
SHA5128495ea108c876b6a98e93753b347abd8db1fc12b5edcc84ef84cb3b74a54dcefda01d452260eba5c09c5c21c0e17da9bfd508899e2e0784dd119a13833ff2768
-
Filesize
2.0MB
MD57bd0624a45eefb53df0724290e448986
SHA1f24d1689324a6db17961f3c3e8b67ff1f4f4cfe6
SHA25614f969fcd51b365fad5f37e17bdb7240ebdbbb243e15259513fdd9c94413ae27
SHA512922cc0fe095648de3e38d1c4bca1b6f91e5f23380d6adf8a92c76e68db5cc2b03a2d59632e1dcb51fecd039af38fd36c6d64ad2861fea0f878ed1b9e40e59d28
-
Filesize
1.3MB
MD53023f7aec3e40930475f81b69ca55b00
SHA17e87caacb7b289f280a51204fc9f884703942c57
SHA256b02c665e8449d92a98aa559252350441b9eff8d5cf1ad81217ac44a62343b6f6
SHA512632bd23de0bf41bba3a846f17317bf5754665c7ab851c6eff009880df2915b316c0aba326fd19014bccdfa6f898094d8355f71e3a4cc5668843369e37c716bb4
-
Filesize
1.3MB
MD5a866a8a9410bd629f956b6e19b330e21
SHA19b3a36495ea8f07a2cc3879e7016745183e98e4f
SHA25696b088cdf8eba5851e8c9df19b25dbe829a7215b04201f302b900092d0aeae6d
SHA5121c64c135f386105287398f092d1f1c9793f0854e7998f1ac733d1fc027a7190192e4de553b4e2a03a0a3eb07216790f6e3401aefb578b67cc59f608a0d361119
-
Filesize
1.2MB
MD5ab6e0c0900e2c7934e497c8d4aadce0d
SHA15c2fa6a8b12547765833aaa932d8015ac3ad1d9c
SHA2567a9bc8cbcc4a14c1afff0ac81fd7da78589b371082389744736f58c83c18d9a0
SHA512c0cc7378548f029262c68634398a2d2671caca68cbc081589901d783b2092a7b26ad02c34d6daad104010f29152e848a7ee57d9695b5529f497e1d1b50d95151
-
Filesize
1.3MB
MD5dc44aa94fd818d101d951213dee516a8
SHA13727cd6e6d554bbe3fe6443cbf09429beda34855
SHA2562db656d4c7bd424cd2c7623a094e71f8416b09ce0550ac72f218d943695f0d9d
SHA512844e65a007af10dd55120b04f7b5e2e281b024b897b8d13cae8486abb81a2a772d4358d97e967a96a64c06db5d1e546f16e3ee28be6f934d1db0808c50ca7f45
-
Filesize
1.4MB
MD5ef8e2d49a0fcdac9c4a76cc781d8676f
SHA1c42777fdc09ecfb860e5b1cb3d9c8e59d5a0dfa9
SHA256102cb49cf452f56712a17196be6974c379d5245b50242d5ebd8060379fbe094c
SHA512a1d41e3ddee9420a04e4b8b27a1f231f2639c7654fbb0a865d0e5ae6544a724fe14edc8d0176508044b25bc9823fa2ffbeb4317775e510c2a85cbfc307c8b537
-
Filesize
2.1MB
MD57e9bc076970d238859042f5eea47b040
SHA1b55f4c9099bfc780fabd1259be8ddaedb620e9e6
SHA256069718d8c302bebf3bb47d0a7d7b739f8a95104137d21fdc95247d47cc133a1f
SHA512160c72b46b1242554f8b40452897af8020bd64d1e606b9ca70f3fe9537abd276181372350ef0263bc94e912ddff5c8f6f19129f1dea32438ae8ec19f4ca6de0d
-
Filesize
1.3MB
MD51ac00e84ced342b439471c3d0bba8bf1
SHA10bfbd13dc04982a0aedf70e52d3445162e37ad6d
SHA2568219927d1e14ff76e4d3744459e1031be71f5dd72de87f4d5ea93ae26eaeaf19
SHA512e6b1986eb3eac39bf1ddd7d5357a24632457f9261a0a6e94620fb43b69eb4fa598c5d45c3d3345b59e70b3169e649afae2ac28378baddabe2cd8c779eed86a1d
-
Filesize
1.5MB
MD5edc51d73d617dcdf690524a6f84641d2
SHA1da9ed3dcf33070c870e1a4431a683c4589657e0b
SHA2561a8d5fcff2a4e1e77e28554fe1ef7ebb35025b1494a309775da083c80e840b4b
SHA512aa34c5c5a8f075b80cc0244f8e4cadf1177505a7ac8584d7ad0f962e7593ef607ea3158b5967deae520add4713e41209b4a2a2d2267db55c109ed53db0e21c7c
-
Filesize
1.2MB
MD534945caee7fe3380aadd9ccf93f3bd44
SHA10fd0b9b5119ad6d4b748d4438e055c5c289e4467
SHA256612d4560d88cf8cdb7697be803199befcf8e1071109d6594481a64c983e346d7
SHA51205406545ad6a96e68cfbd46f5a468b93b4aec5abb8562b92fc0040d0a3723af4d72222664c3117ba3a014cab9a0c896cb8444a23d64010f96b689512a87c80ee
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB