Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
21/04/2024, 01:01
General
-
Target
2024-04-21_350c5a5f095537b7da2b2770462e09d0_ryuk.exe
-
Size
2.2MB
-
MD5
350c5a5f095537b7da2b2770462e09d0
-
SHA1
04d3797805b687b121f33653b27435294098bba7
-
SHA256
d6575e46833b4b5cecfed25858ed8bb3a2e02219a004828a43ad5fe0efb6161b
-
SHA512
eeaef686539a9f02e14e9a96c0d9a21fd333fc0a32fb15fc7f52e51a97c68c6941450a27fe1bf1a18ef5ad9a2459931b363fe8780b9dfbfd7bc80c04530a07d2
-
SSDEEP
49152:vNl7soq7sQCc1kyG2xHywRfHIO2Ts4bvDj/i3da1YS6ozB:PD2311kaxp9qj/iyB
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_350c5a5f095537b7da2b2770462e09d0_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_350c5a5f095537b7da2b2770462e09d0_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD54842cddab3717ebade215e329610151a
SHA1af6e5e9a9a2e61d8203b3cd511270f03b0395350
SHA2560878a531cc9ae49d9fc72d7a61c04f44b9202fa9070346505fe225ae1bda997b
SHA5122117588f0496cc5f1434210c3a2978e7cc6e6536fbc7802377d05f1472bc5c3d7f64a95399456a4e37cef213a75df368ed6392317c5936ed0a58f58927955de0
-
Filesize
1.4MB
MD5a9731b60c35847c4fdc09ca73de1f9c7
SHA1071883affbd12eb69aa6079afdc0c785d58f650a
SHA25679ea0492830a3f49f3e68e1a4da505da00f58e9f2cf51d2f9d6bad7311e517ea
SHA512f9c15c3e8b8a9fc72c208761aea9e17b1fc5e7f11f5a71162c20502e7c88a23486808958f3b8846a7d268dcf0b2d451ebc11f55d169732b9f8c334a2241dc5f5
-
Filesize
1.7MB
MD543aa9eff1ec54cf770231bb0d745950a
SHA1416ad9980343203636594a60ae38aec445ac4698
SHA2566b5c10614acb5b763224adc37b57357a31bd98a3112205ead6e07f019f0698d0
SHA512b112d070729648ef778e17aa0faa62454520de31abefdb3511c2b1bbce022fa4ade42bd295c6514e4d6323462fb3fdf9afc5553025edef3fcb973502de4aea49
-
Filesize
1.5MB
MD57cbc1b4f0b849ab7febf8cab1e44aebb
SHA1931f2730fc6ed479f8336791511b5963990eff35
SHA256fc530d8a10031c4b39884e73710bc1b4cbce31c61bd96c24dd43dee5d07a8ee2
SHA512425a8a1ec2b5d486a7026871f33e777570d0fc64f7d3ccc0800e7a1b1151912c61867e62e82b3e5b43294497f6f569adca5d38130c7e47cb81898d2614be25bf
-
Filesize
1.2MB
MD5ca116b2705aac58e93c0d93a0ec143e6
SHA19dd99ae3018090b0b682cd99c8c2261b1c487613
SHA256d6862dae6da64d6f1859c57626714bd683f91aa29fa31fe4159d42af5b5943ae
SHA5128a3ec5d4da57402b19e3e1820d4c31ebb7d7fa08fcfa195d01b4ba9e8137033b120fd4bbb64234a8f53d556dc14774583240ac3dcfa62c003b86a08f8d70452c
-
Filesize
1.2MB
MD553f8699fc212a93d85b9994140f913ea
SHA1a7b9dd6afb5437321a9cc15ed356edb06053a26c
SHA2568f9170959c4e341e2a0ec6a8b3c26bb2b809ef4c90f2aed81492dddfe2d2ccfd
SHA512d5b3927126e61166a8c425877101e5a699fe41c87826b537135bc0449c7d02a1063454bedb7714b47c7e7d02749fba6b183f3c3e6eccd10dcc98cfab8b1efff3
-
Filesize
1.4MB
MD552e4579d7a6071c60f666c5879c9b1fe
SHA18735f869626e5f78de45578aba8f5199d9cf137c
SHA256a2511563d056669b07819b8eddb73827bbecbe0c1634933574bec7eaa9078987
SHA512881ce546a2f184049767257d2cddb233a7358e65a260eaa46bfebcb92b9de7f3475e597b4c0a9050c54ef56f1f66fcac725f67d1334e5a23cddc7e122d20b4d0
-
Filesize
4.6MB
MD540ae960723253de4dde6a61d7ac547ec
SHA1435a59439631c8afb9ffc48cc12cad7dcb21e540
SHA256219645ca6c3f655dcdb2fc122606a04183c1d19b6c4f5080e5ed158359c639b2
SHA5125a467ac5d8ed1b23fad58e63f119a098da3230d26a21c8122e1974b4b2b651f3a3cb401521d4c430503eb440082e7d0c6bc3f56ff853f87e6fa502e0c120b7bb
-
Filesize
1.5MB
MD5b0cd205dd5d25dd53d51db21fb1132d1
SHA1139d2ba0ab28c733ca9672fa90d727369e516106
SHA2566486f695f5a0021fd0ef4584022bc158b36107442dc214256f59264cb294c20f
SHA512c7502f0b7ee314e264f368c568d89e3df0102f6d70a8773f6322359b3e6959e9c38b130555a6fd157b0dfc163f02e5140ffdd56daea4363ef69f812ef3a59348
-
Filesize
24.0MB
MD5c1580961eaa6916884ae73bb42386dc3
SHA1acbcaea6e7bfe249764181875da0396bdd7c45cb
SHA25623bda1ed6140458111cae870dccf4e20cda53b09bcd467b0631ce66ec28e4d5e
SHA5125972fd3fe56f42f5ee30e850643f2a4d20be7a5f79d541dc9b1357d77e3c6bacd09415c92e272cbb7434f9719f2d2f6089aca2fd2a869dbb0d451ffb65de8629
-
Filesize
2.7MB
MD5bc5239171cd69a0119ddc85144e5b967
SHA19e74fc4aba0a0f9ed093f1a7619682df47d0b45d
SHA25622c1ad86836034e9c54bed75e1779455206e5398238e21d77f4153c4e59c40df
SHA51202b1a868a146c9cf39ee561d5a04862bd966ac9d3e29c80b78502dfd1edee05996e3cc6abfbe4107a9503f26577249fadcd9ba9b479cbe33f9c61bb78ba59b8a
-
Filesize
1.1MB
MD50ebb0d678ddde5b068d81dd78980c97a
SHA12fdc0af54507bf34cad6f846b9a3cfc0655e59e2
SHA256668fb615dfe259592834e5eb18926546bf1e39a61086074ee8936bbe2862ae5f
SHA512bf563420063419db249f49b36617f5b17b201442b792e76b8fc6ba58b405fccedf53d0d2a4a5bdfe54a963bd804eac20a4499adb7af877890b46af783cb62677
-
Filesize
1.4MB
MD560c1b41873dfdaec13aaf60b07923955
SHA12b17ebe30e951d16f6d06a99dadbcf7bdec2dfe1
SHA256c3b118f5a523c67f835def60cc723353a20cf89cf25a137346cac596ca67f49f
SHA512fcda9fa2a41fd42eab1346d0af94bdfc7268460da2f3546845ea3ca1a63c9e38ae32231d449a2bbbaaf52eb1ca59ece38cc080482abbdd456a75ce35339765fd
-
Filesize
1.3MB
MD5d8b2ab4591f377681f38e7e9aaaafe35
SHA1bccbb7171937cfb13dcdc89fd97e553ebcc69653
SHA256a81e8f1b1bbc4a10ad6ecb1b46b64d06671d3f0be48c892ff1fc145304a03c52
SHA512e3860d5813d86fe3a6776ef70d116233a933f8a0e46905e2421d8a2cfef41b87a693e0fc39a0874f109c109e6b19d07042cb699bbe56fdb2f2c25cadae42ff51
-
Filesize
5.4MB
MD59e45284ac4605efd14a580c1b9332a14
SHA19289f953e8bf064930674dca1fcd1cf491a9fae7
SHA25614c15ba725bd29de1263be18629d718e8d543d049ba1aed50df1e38983401372
SHA512755a7e67106c506a4742f9017b6b604e2a9724a8813e47beacf7d5a1cc5b030d0105ab94228e46b16a20a8bad52b92f7a68a5cb61675052b62689c3206eb6571
-
Filesize
5.4MB
MD5d827254e32eaebc8cdde3f4597d7b061
SHA1dd8d2511fc164506dfe975c6996a33fe7c561775
SHA2561defa335813490a206ba9259f7397485634bc9a3a9ed88c72b8aa7ae1518ac90
SHA5129545adcb2e1edd8200d2afa71be94509c50b6c668fcc5b11c41b2edb944bd45284db78ffa2b8fe41566e3ffd4ed2b998f77d1689646dd621ff89e5c73fb80c9c
-
Filesize
2.0MB
MD52ebae799fe169c3b8d14e162f5a85209
SHA162eb39be3925df9311e582c66f3237f550a23e6a
SHA256df9c5020b1ad7e04c724138a09c365ca046edbd1dbafb5873fd65c6c4e4696a0
SHA512219d6bb0dc47f409e72508eaa97c04652147aabf45c3fcf90d9c3b4d63683b1d0687319667e9d3a7ecd30f17dbb38038dcae9da5967f16a485647ca14bbad040
-
Filesize
2.2MB
MD59d022a387fd41ccd464f89010dc41e0f
SHA1c4a1761217b89f0b22b80f3f4ec7ac3463726f13
SHA256591e32735503bd3eb77f59d3c4972c7fb70835beae24f67e9ccfe895616b2462
SHA5120d4f25734f92b253fb77fef9ac8517c421db7c2d1d10640ad5d0f5ffffd72bc2826fd9513d64a1156835e988bfd6a2a661e1c6cbce874eb9ddc3b8e9468cdb1c
-
Filesize
1.8MB
MD552924a85f4baaf1261d2703fffee687a
SHA1e909eec005981d3d6deec027f2a6bcaccbf901b5
SHA25604f514cc058202d8662a6acfbeb0216936ae35363e877cec6d4636eebe982573
SHA51210ca7cc5c7e9d4dea847ad50eb237bb4b3b627149f52ff4b1116fab24fe2c52eae3720e75d685ed0b3022935bf2fc9223560df5ddc8267cbc2e7bcb312846d96
-
Filesize
1.7MB
MD5c81e56aa8acddd8e9233b6d60efe2a50
SHA1a1f363462d78a9c322288729b8425e41ec55d2ba
SHA2569d2d67e5bd6400221f598d71ac7bbce51de5e75933c02f0b5b207481cfbe0a50
SHA512b9b555b991b8cb40f76181d1cd68e1deb202a39e592a99c92be31c70880d1c134495489816f64a43e2557f1d786f752ec1d727c475ff3e0619429e6be05f6021
-
Filesize
1.2MB
MD507e6bfceaefcad4228be6c10f75e2b4f
SHA1328eaa352e9b6891cbb74a2c93b39e57d0265050
SHA256cb1f430072b4d6241a985525f0abf74998c0e9c760837163c9d5f04a52b93d14
SHA51286558377205d3a2ae63186174b8347c71401ef01e675584c3dca436b09901dc33ba353a2e5d295674c938ea10d033826a62827aa99a95206fdc29e618c7ed08d
-
Filesize
1.2MB
MD5d2a563ef28afdf20e6d836788adad291
SHA14b6fd38f8e7512d2eca689d895fb62e4bcf61ded
SHA25605df9ce5a91d520c5c904ab529a29ac0c2b60d3a3d2ac89b27e3275a1b3f6b92
SHA512d07d54dbaba6e3f32e610ca1ec29cd7a633c75eca8559dbdb4c3b4e47ad352e86aaf4f1a8e18ee39b517812d83c8b8fd20d36da390325db21628189795447a54
-
Filesize
1.2MB
MD5a0a4a02d018e0c66b7260cb9b3125c38
SHA1bfa57fcfe3ffd0a45999108049c20ecab7f652d9
SHA2561552508a0040fbe617f43c8821877e416ada2c52ce1499664b798f11243e0696
SHA512ccfe65dc809ff7838c118f7b505f3470501c25c05027f43f2446945dfb6d6f3b02448edc8f069012611bfc727cc62f8ac699157aa5829a05643b3f6f3abb4285
-
Filesize
1.2MB
MD56370ccfcfd969cef268de0c55feb0d49
SHA1313f74c1c892c039aaaac36e073e4daf39504d48
SHA25653791cf158388ba83db315c683502ebc264881e5495ea3180510ae77780d6005
SHA5122572e0cb0e2f7c39dd3ce65018916e482af6907d9adfcd2fdaf8dd72ce93a669c61783f6f9908bb3b957c268813187c79c3d7854b2a0f2f2e4df4bf6b1073bf0
-
Filesize
1.2MB
MD59d255d50c34ad4fdffe3e38231e66987
SHA18f89b349e303acb76bf68e41f0ea49daa448b1d8
SHA256214f0deb6fd9654e71d084b15ce7aa7721bf6635e66805316449ef95d0e890c9
SHA512b0f60617d500504ceff5008cf4871c1fb9af1004a2bb7df48272a05345d60a38edab8545847f01922dca6b436e4e8b6a95084aaee57856eca69e2f50c2e48e31
-
Filesize
1.2MB
MD536de8e8c1c69f6ccba5bda1cfe79fdf9
SHA1371eb8c0e01ed0e340efb35c62b3d5f545b40583
SHA256589dd3e90426b8ad1c9f352b90c25029af82156ab5fee5d58abcbe3133ed4dbd
SHA512152e75d8bf206c65258f8c55f5f43e9c1edb81115cfcce710c15ed9ddbd6d93d36e651c0814326360de7a5c5bd46f4b4b186eaac70df9b248775129a3cdb5951
-
Filesize
1.2MB
MD5aac382915c96ee60b7fa7e20fed79ef4
SHA1ea1dd714bd5add77bf4e6bf9b5ce8b0cc72f73b8
SHA25682707502ae4d5dd53dac56fd687c18322ebc8d44ed266cfe2a5e322c8ff94c61
SHA5127348ff8aea48ae39284792e50b1c494b162afb326e976f11bfeec183d2b17e9e3a70c4fab8f9ed361db705f94f87117d243c236d78b67382efa54ad0b3ffbf74
-
Filesize
1.4MB
MD5a9bcd8bd4e6e95c26629666e285dd105
SHA114f688641e1fe6d42d6dc56c74f14e6ac3a25ca0
SHA256d99a8f95aa3d144e97d2f90727a3bd7b025d25cac1ed9bbb255db387251ace58
SHA51244da7a276a17f70a6d788dae428737b54b7f6e7d6334b8f75d66db1de1dd25ae53c357aa483556fd9534a17fca8e9f5f2b50fed9f4e3933453b307169e8f5033
-
Filesize
1.2MB
MD55ecb4f5b0302cb3a131dbf0ecb0e1dda
SHA158f278f04bb1fb6535bc7039c80a0185081be923
SHA2561730163e35eb2d0dacbd44501f4aed4a4ba686d82f8073e1a04e9b0cb924cdaa
SHA512b0e3c54712657bc0686eb41da60da2f298025490ed26a36e977ba3f6c051222ec836cf400954ea585c059a28eff580a66ffa1217831dc51a817e3da15d62eff6
-
Filesize
1.2MB
MD55854ab6627dfd03c83df9eee5feec703
SHA1765abbfc30f652fe3cc80eb02ffb4a2e00c9ca78
SHA256372c45136e38188bda75666d624fb8acc247a0f6a10b8ceced8e762f2adeb087
SHA5121769f995b4681d2ca7d76180f1ef9303a7e4f00860e8c101158f38838efb02edcf297e391eba4aa272c983eea2ee65c4de693b24cdf1670b1be999a7c0e63149
-
Filesize
1.3MB
MD542827805cdee6d178e006d320a76eed3
SHA14fdd49e2a00c1484d8ad140353c5183cb8393684
SHA2561db3fbdc2b59aa06e68e38a16c23be287fa545bea66f93b1bf18d7f943272eb0
SHA51217892e56dc4880abae13465dc393a587cbd030dc67dc3b4d60be8100b6c67e1dc609ec290cbb807026b1dafca99c86feb486ae5c21bed42a7d37462e1a4e9295
-
Filesize
1.2MB
MD56a466c6946df07d90c52d5ddef7f9611
SHA1cc8a538c79807547338cc4d8a54891bbb07dcab3
SHA25654acfe2a63c9599a07de0c5df3ef08e70450d9e96f67286b0c7038655caaa6be
SHA512b9583dd452d6c15f02783ece22c477b84648d5f10e091d89bfeed4337a357bcda37b783dde47ec8ce77712a5b5c51ecfdf82c4cd76a21de98c91ac953b793110
-
Filesize
1.2MB
MD576df64f9c0bdc629b7bd081f4dd29b6e
SHA1eb84a7f3bbc91622f1066bb915e2b951591ba7e2
SHA256d4273650f1dacca2be9f93e221d9fd8a1857dc8d4cf3911a86e206c885ba13ae
SHA512dce260c443572fe6dc25840b11867aae52011619cb330f97a1cfc8e49b9d955d2c177aedcbeda9314accbe35a1828f639e0d122bcc511dd6c473e2aa8b5d6c82
-
Filesize
1.3MB
MD5f577fcf9bc59ffc08004d9f0dba34c5b
SHA1e3b71507a51abfad29300d4c939eadb75eac7a05
SHA2567431ab74a3cb6173356c2e63edf71dc28fea755331c3925e6b7331744fb7aabf
SHA512d72e45634e2a2b84351bb95809624828f7b8bd311c0ae1fa06b15c9d74013da4e9ad84c4bd3e491eda91ae0b3ada7e557e34ba579f86a65008ad9203ab84ad3c
-
Filesize
1.4MB
MD55ba3012b47d62207bbc8ead93b7204e5
SHA1e912afbf1d387f9544d3c81bf25edb3fbaad9714
SHA256e06398450ee5e86bae268a3088163891d5da4f2adb1cb16d3a13fd5706a32266
SHA512898daaf0fd8ecb9a35ea2dc2615e8bbd9d196b2533b269d5661f7590038de46318ccd3fb5bb4bcd0b97674b24639b9a501ede8a80e11f223a407fdf2ea48bce5
-
Filesize
1.6MB
MD5af678df4d4f140010f71b2d8c6e461b9
SHA1564ceda20b1263ee989fce9e8d13bdf9c986b1ef
SHA256399262b7ce912ca1eb39df6488814c72aa1b5c6b2d526fa2b06b12b022165675
SHA512a3031e3917d086f269d4b63529205978b2df8ff7eb03bba7a228408b544969103aa5ca9214c43412f3feb92522bb22ae8d9320ffad674240763e991fd80a864f
-
Filesize
1.2MB
MD577bfbbdfe3940e9e8ebce7617ca82040
SHA1c5b8f82554dcae38f0d24cd45fd33864916c016c
SHA2568d8ad572fab79d18463cff933bad3295f7f22ced15cf14d2af67cf0976b236cd
SHA5122b309b35d098bb8c18076ce40bb238c5ab3db7cb2f87b1832ad30c49d89da3e74c68e086ad086fd82af8cedadc50daf90ad330156dbd9459cf508828fa6fe477
-
Filesize
1.2MB
MD5e3a7d5001026ce80bf35a9e318a3c220
SHA1f5a0b9ba341562a55d15c245de833f419cb78f22
SHA256c67b7c2893c3a1be2e95a225f3347f3529117c0c8d45ccef27e63ea920d2c6c6
SHA5121c2f7136d652cc01d0fed26bc1942e6f866aeccd80bbc621540960049da20fe42b8a79ead42d9830a85c041ff2298800369b6f51606a90fd4f7ede5a6699218a
-
Filesize
1.2MB
MD541177b2e4f0b13ba42251fab1c461cbd
SHA173f50205c8fbb1538fc575a4da0bc9f756d46d7d
SHA256a8b1795f98176255055bc99286a6622a1438dce9a2b676353e1154f2e1a3529b
SHA5126e113d93bc4ea9fe7111c951aaecd1226119e068db3ad809cf169570a49017075ea8d45126c3f011b43dca05411f3e7ea8c9f81a0da4930520fddc80c51c06de
-
Filesize
1.2MB
MD55c51a3017f4a15cdd00bc6cdb295816a
SHA1ea2da6c550e6bf4b71ae315eda7c2cb95a6b92e2
SHA256175f7598907137e11747bbd043cffde95d931bf4cdfb8876b80649808a74a5b0
SHA512b36abab6fb62b7229c2810dcea68091615866d767feb049ee1db000395ee33c72e830c9f372034a78a046cf5f5c09fedfdd384af7cec21c1f8d4b9067d40908d
-
Filesize
1.2MB
MD531d5069f0655b0907e27d73c953fa260
SHA1703e80bbe3c00402a551f94097f76c7233d181a3
SHA256e14f3d65f4b2825c185e398378799e7355fafb687f6cf07b87e84eace129c745
SHA51208602c36167a9a10dacef193cbc7aee7af8afaa514f1860b6d3fe1390fc9bcafd6270615cf62140eb88bcf2c35cca673ca7361007ef70b0038e81eb87eade43d
-
Filesize
1.2MB
MD50e2f44ea568a72e6f9b30384fb6d14ea
SHA1ecc78cc08d54d8304eff8f576523dcb80f4b6931
SHA256a37d923b5e07123a7c4618a271ab39e9fcf3f1c082d0ae3d17cb202ec95c978a
SHA512a1aa797469e43366cfc16592c44322812a02dcf35537d189fdd395a8032af1e627812033d6497f0d2a5e0b6605e13c018b304fff2e91dc71a67e4e1391dd7a29
-
Filesize
1.2MB
MD5f98248cae757f1280dbcf1d305f6a1f7
SHA17276d77c5c254098a7733e0025bf3d69f4a2f96c
SHA25652b1b8ce57d3e2ad533602309c9c4f17e2a4ee6928ad0fb29e63b98662ac6e24
SHA512f207660e2bd43fae669d89aa13d4f955a38a1a129e9d338dee01ccf0dfe59f6383b542c2ddc9b7ed4cd4b64a45069ce912ee81a16fea6bdc6a7239fe2efa52e9
-
Filesize
1.3MB
MD5bc775844d0c316e552b56fbb6289081a
SHA17be0c89168d1fe799eec680c11bc71383b48fbe3
SHA256080051475feb461e628d852b91cee7cd2da4cf5d570f6dc0bfb54a5538ce72b8
SHA5128158131cfc9b0ab431b4cd2f336806327f0993b49fc7c8dcdcfc884431baf0f619d6f6c6bc857735c1a318c1a7d85b566d5390475b7c6021c7e526bc35f0dbfb
-
Filesize
1.2MB
MD55e37971be1a0df5d758f3585e89d5678
SHA1f33f356dd687b1be33875b7d1c29a00847063c3e
SHA25696e287ca28150d71c88900e6e2076d2504de69291a1b925e06773f8c58ef68ad
SHA512b6440e25cdeb5395d49bbb4c740bab192609382b9a3bd22cc78992225100183024b74593ab620b6be191d5fee4ba2a6c92883f3ab9f68719a5bb874295d82657
-
Filesize
1.7MB
MD5e35da779280def92194c9cb2ce6e714a
SHA1ee695b3b42f5f76f3c565ba92690320aaf138a11
SHA25693fa19a7b4e46e66d11ae2f79b05bbeb4a8004de93ee6448bed05c00601954c5
SHA5123178792fb39cc43d34fb33a78163c5900d7fff2bcad03994e19997a56cb81839ec6720cad156a4ff149d78b17f57db35e3cd3ed88687351bbe8dc6cfe28404f5
-
Filesize
1.3MB
MD59fc62f4868cb6926ea852ab6508e2b2a
SHA1d64eb2a270866ecc4977d8a05e8d9d2ce5611778
SHA256aaa346f8e1d1b169bb5b904cd85c118f8d2de39d91237bc96f338e7e998f2793
SHA512073bdac082a4fdb0f0330e4972d0420e4278024ceee466ebbad11e75ddbd12893d1bb8c6d8ca46964534c526af5d3107b626b51eb80b96db7462781c56b683f8
-
Filesize
1.2MB
MD5cc7174593a8094c106c671663f92bf96
SHA17dea336e6fffdfc88a9ba8b891d1efa4ba793227
SHA256afa03e464dea6af34f79dfa200bef2e5d03ab3e13f568865ed3818187cafb55d
SHA5124ee2a8432fe0b93a85ae3c0e7941561d60ce1dfe2ff2f0818584291354785fb10c86bb48ca242193165d675a349c1735f5f421a65c1e33f6065b4145622643df
-
Filesize
1.2MB
MD535d01aa76625630385826be633278917
SHA192cd4910be4bb3660be9393cbd0422059c670e4b
SHA25671b4e779f2d0bfbdeba151cc7225984715a32ed0f87ac4553a7847626286c0d1
SHA512ec740381704441e7afd04173db9f3c890f6c49a659f68a663547255c08760b5dc4e9b7d38aac170e490cbe1763b3950561fa063066c6b9514acec6273e51fec0
-
Filesize
1.5MB
MD5947921214667d75489103a0045793234
SHA148e3eb59fac70118fce09679a343de13fb050282
SHA256f17cf5e0a9a23078e558d018ea9fe8871e9c5f690ecce53054af730d813d3dcf
SHA5125d53494b737242d3397f677c72ffa7c2dd8ad71753ff78f76355806221cdcdee285c3c03303f5fe88936419031fabd11f035a43077eee1bbd2fb2ab2671e16b2
-
Filesize
1.3MB
MD53d75ebd8e390a74a9f11fe422e52406b
SHA1db9e9a575a17423f9157e8509bc96a6c9f356239
SHA256fd656c724d1d1eaf218cadbf9a2925dc76becf6f0c2a7cf2fe7176547b86a63b
SHA512aecc21de2f42694c0fad0344a30cc58bb84ddc7efe361000457eeab59ca2d6343912a6a7a0d4451564e0fe65be2b5406c43fe74c7c9067a62562d7eb51c99c4f
-
Filesize
1.4MB
MD5b6432378494c959851c2c87872ebf30b
SHA177cf2d74da8ad4106871a9a4066aaeda8d7f6895
SHA256126b8641840b106d49038c1e395da1ffbbe19d6ec924d50f575e6ce260403482
SHA512c9ccc5b59c6c316f5705a5b3dac61aaa720d0cab5e7d6db4d9c131178eaa51b624bcd8d3f93ad038d3fcda9efbec376dbb8b8ec358ad97cf7c9de0b9566416af
-
Filesize
1.8MB
MD5808ca16c41e04e58ba714fea3b0d1ae2
SHA1b1c4b1ea286dc3791923faf1ef7d97be6c9bead8
SHA256be90f25ef48e520442cacba360aae204098ad10d1e8825656c7a9bda879f084c
SHA512838dc6137528ac00370ddfc3722476e9ba1f43a7f16b8de4bc796419371dd340cce15f6386c6e0f1603265a948a811bb816da00e23101a78de2d91b107131823
-
Filesize
1.4MB
MD5d05e4ed27a50702a54217f42c78641f6
SHA1fad03f2f4d1ea5e54d61fcb388cdb98ec154974d
SHA256953e84dfdda498a99ec766526a5e3803a48af14a86edebb91e51931826ebb3d3
SHA5123f13b9e1ba39d4308b6c63632b219e3a34f13d6e23574297ce8e1df283fd9ca5316ba5267eb9551ffb4f753c992d4b85b8bc4cfd6d80916c126b0e9c855224ba
-
Filesize
1.5MB
MD587dff48de5978da8b3ebb3ac5d921c68
SHA15d537df5d9a6ca6ec856b33bf7c0801117e07316
SHA256e491dfadf7619cbc7606952a333110e1f17f943502265fb07e5960f430c3849c
SHA512d4cad5d8a9e43ca7614027ddc69569cfb40a3f24279c861ea7e5c703fdac414864bd501a6a8fda726d4934dc7b8eb9c496a41106084cded67164d4b52dd80397
-
Filesize
2.0MB
MD5e09daee8a408daa26a1e1b47929d0774
SHA10d384d7adbd36fb44cd7e677bdf313327a56050e
SHA256e5b358061c268394ae12e086bbf6629e95b737e15240d28940a1e99ea69909ad
SHA512ceb6d89737908a09525304cc6ab48b4bab40a3559081c67d6e5ab621df90bd36d70e4917b61e1601903f6194f9dd4d1a57105ecdab960a47fed0bae991fecd59
-
Filesize
1.3MB
MD529710693a22d35a974387c40396eca9c
SHA1d11637110a3c1b2fe1b35fcbeb26f19821dc45b2
SHA2567cb434327b7a6ead1ae1f2dc7c22d2cd256f324312b2131c34a5e29e837662db
SHA5122807eb870dc2f8dafdef548c5f7c3bee686bbe73c38c94598992d08d1673b2c2fc0855a90f5892b4f0933f0d392f2a0d99182097537f9f7d660fb296b1fad120
-
Filesize
1.3MB
MD544450ad564d3ad44d76cc28beee2f9b1
SHA10ec55942179cf6375f170b59a8d0fe1928ab0148
SHA256e835ce1866fbeb8137b321bca7c9fdb05d3532cd9cf4181d965a1bff4bc3dac7
SHA512e9ac541c43ea6f252a2e19d73bebd3688a82d278bba667686d783e560d5fe9d32a900b26738369e434c991a197eea728f2dfe02258368df64ed4762221b13e71
-
Filesize
1.2MB
MD550cef488f28730dcbbbf50f40df4371f
SHA1c8fad9344090375957714bb3d2d28bed6b553e99
SHA256a2946f2eeb3daead92fa6432b5b3b00447cb670e9852e0b3e05f98ff1d34997c
SHA51208a2c02c0eccc22c2e1d47100f3e12e06327298f0f42c3baa91ca2df9232af329f15a08146b402429c7669ee5ca7a672bfdb57a73c3ab61dc3f505ee610035d0
-
Filesize
1.3MB
MD561b50ab7abcf2092c2718f0a59317dc5
SHA1c501be6b8caee464fbe8c2ef3ede8167e11ce53e
SHA25644ebd74b45f1f90a31c0f48b1dc79cc1474b37f448df0e0bd0b8c56d25d502fd
SHA512803eeb41336ff55ab48e4fa70d7aee670cb4c23c5efd3a158b0c99cf2bb8a2ef4897ba2b1825112f2c4cd6e92043dd7710c34eeeb0ca8aaf2acedf5495dc9c2a
-
Filesize
1.4MB
MD5af64a14611a4adbc1368ecfadd0ee24f
SHA15a7f6905dda1277bfe0cd264519276c0051cc78e
SHA2563fae432023decd7f485ecacfa07743cd35f1e2eec28827e9d282d035e7e7e096
SHA5124340cd38118806066d39e39ce1ef5a9ae9792eaae98f098f290227dac142770217f3127d9a864b9f3639f57c9754efe54866fd921b874a6ee26ec2ce462ad039
-
Filesize
2.1MB
MD504a948ba26b144e384d65dc1b193a757
SHA173e3d4ce9b006b10865750b33683cb0081262431
SHA2565a12b9ee686b8af9430e87c67fca1d34023ebf35b1a80d7321ef2a59ec9c4713
SHA51285b1498fb8c510e2389f1e0b41ea062c120b89e183140ce9ae898cc80253e31a62f2e42f92896007d617b9588ff9ab8cc7d868439feb3e656c89e223b5a331ec
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
64KB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB