Analysis
-
max time kernel
119s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
21/04/2024, 12:20
General
-
Target
2024-04-21_e7c939c9bf25e5ea30d357fce6dafa2f_ryuk.exe
-
Size
1.9MB
-
MD5
e7c939c9bf25e5ea30d357fce6dafa2f
-
SHA1
42cdbc18207dd88a45eb51afe795049a4c51736b
-
SHA256
fd2b3e62f4495ef8cec9f0bc734e82eaa5b48f381b1501764fcfa3ad394d549c
-
SHA512
6a4ccb2da0675282d006b22741bdea5f9a309a51228083d3fecc65bcc215355655d822c61bab3347cc02744c73b119893ea873859896781fbdf50743ad3d86f9
-
SSDEEP
49152:2lOVDTtQY6SoNtaUJ67UnHpclbwbWAaJiwmcTdco8GhaOIh1Dp33PM:ZqSUHxqPFFDIhZt/M
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 17 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_e7c939c9bf25e5ea30d357fce6dafa2f_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_e7c939c9bf25e5ea30d357fce6dafa2f_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5c04b30e30c7c88b57561a75da4c8bc00
SHA1bc8440465f148ff3d9ea125bbd2c396c3ad2cb17
SHA256678ebcdc87061d5bd4908533509cd836d77126b730c9ee4cd325247feb4c0143
SHA5129d733e083877264a49f8800cdba16dea8a6a24c517c6260d8f0f56e395d90c212ec334c4ddd8d5bd46112fad03a3f393f56b91a536af2d7a3514b685de564ec0
-
Filesize
1.7MB
MD53770feaa9372a0959de02e9eaf7dd3f2
SHA16c4e123875951ee06e75ca38d686e7a9a3fed217
SHA25694ea51bb05134d9787b7c917464162da694949dc35d5bad4cb9bba1c4d83a5a8
SHA512369d782ba6166648c67dfca1bf08840159398b828d8e61f565df0f25fab4b3e0d1ac95dc21807237cf9d4d4a0a407706d726f8e976ef68e1cba2701cd0e640a7
-
Filesize
2.0MB
MD59c4ffc82889305190e0168d75119541e
SHA1ec2fd1eade6df5105b8b80c2925793d15e3cc989
SHA2567afbff4f520e4f3fc1879549187633fa93125a3610901a8391cae7463650fd8d
SHA512dc6a2712042234075b0f333cb7a5a402b91d46baab2c5a681eb16c6f96eb2b4ecb077562283237b13a0f420947c41406d258c541d5a1322801ff37c1b9e3c089
-
Filesize
1.5MB
MD52ad3408f51565132a23411cf4d9fbee6
SHA10a7ed8f69a6b4dea8a295c7ce268674f050cc648
SHA256b3842112e7ae3173b0a40fa317096f6ec49d44eaf8a3601544c9005d663444c2
SHA5126718bab4858b92f82034a8bd5c3a152f14be433dd9742bdd3308230ba437aee7f60e9bed97e36d5c0c58eb4280bd3b0bb46f4791a0dcd0f3d92257f3fa3b2bb6
-
Filesize
1.2MB
MD59d75e81b3aab00c9cb5a6d17e40d5b51
SHA1fa2a626d05b612986be7bbf367eed90a2a5623e5
SHA2562005451ba54f1f8b678dcac9830d9548adc2ecadd1ec18b0ba3956e033953c45
SHA5126f85be4f857515aaf7d55bb2d4cf09b17101926218833577962bc7e3d716c7f070d6c3e0f388a34f9be14eeb454060c13650fd540ae1027412a7f5152ce14b8b
-
Filesize
1.4MB
MD520d961395ca9c7f67d5ea51e6b9a54c1
SHA128c8d1322db5f9abf1f7c3b3d63ba1f7e07cc2dd
SHA256436ce4516ec842d43dc9310ce1b9665a3855aa284e76f4b64b6aea9739a10d49
SHA51239b1579b719b281cb830590fc22bb8fe30cf79d48783ee885104f74809486e3268f483fad3dab158e7c21506c30f2149ccb5a996136826f2923518ffb929a165
-
Filesize
1.7MB
MD56b32804133e67fafc00e8bb9478c7efb
SHA15ad59899e64a2b5552075fc275fdf13526747d54
SHA256505faec63c8b0ab4c3154749db85c8b3d10d25a48049bba3e8db3698697a7c58
SHA512ea822b8b865fa71b178c59145575733bd79709f5788b76b21ad20c7d71f01d5f7f9fa697d0a3e2e681ad3c559c7663447d43384380dbae3ac84915e453645026
-
Filesize
4.6MB
MD5c58809c17141a628420745a2d19f2b54
SHA10387f739e56b4b267025838544b50e82c07d6513
SHA2563122fab064b51f3e109196732a02dd068df915cc02de082a9c0f1af4374bd1fc
SHA5124eae8450ac0d24da900a73a8ee84937ea59717ff512f9f4a48f0c46f6b29ff41d4c6e32367449e49ffcd57645a1595aab1d337551856a108fda180fa0cb65445
-
Filesize
1.8MB
MD5ece4087591d30fdd2bbd007c61422635
SHA16f8649f1716461757ab355724b05b7a8b3855af6
SHA256b9a6fc0eac1d7c1a1b585fad01059aa5a75d43d61d2421af2fb30ee23ac3068b
SHA512091dcd195aed94b364450f99eeb3d40b796f895c1d3c7196c93adfd4a4e84c719354c955ceff37dc1dc8476d5da03ca74f522994d2274943f347f1da04a7afdb
-
Filesize
24.0MB
MD54fb76bbcb1490fdd877abfda2e8df61d
SHA1471224b47e0d14d5496d9fa25fcbe9fcd96fe922
SHA25639660e32aac0c9a61e3b2759ec3b7b2ca8aada277d843e1c392da457a5bcaafe
SHA512620fb7aa6043813c886f24857adda3f018552325e4e83463d4ac9558ec480215ee9eeff5cc7fc47e35e6c4263c5a92e15f2a86c690da2d5b1ee373da346e0eda
-
Filesize
2.7MB
MD5c821a22436859f359d9273ffb13d71d6
SHA12656f22dad6ecaaaeae7011c27e94c8544cdb48e
SHA25668f77aca609d039274996630dcb2ca02df38d070b0aa6d7e797f7f7cc040b49f
SHA5127c3a1db6f8d354eab83437286c9df24d410bdbbbe09ef3764954bb0696130285aef80aff2c638d61ccb2b90285bdd1c3cfe47f6b9a98cf0de37cf3c7dc92e099
-
Filesize
1.1MB
MD5c7f8664997e9de33c9910abedc5ac836
SHA1782dbed77dccfee33a17e436fb2617f9881378e3
SHA25666e870f156b3682cdf10bae7b8fdb7f8086a8073c6d8935218dd7f8f74c3967d
SHA5125db5db2007929480531183eed01bfee9d1449fb9ff6b270aaf8775f08c1def2d78f0ef2c2b522617363fa66d0f7bfd5cf0a039e44c4c8e4f859de157d5a88595
-
Filesize
1.7MB
MD51075fdbb8023851a393ce7e3b65d1401
SHA1e4a33159655aa6dacf201557a13266ca214a2e68
SHA256bbc2dea4ade9779da7d20f3b955772cc8760625dbda69b774b863d6ef25e2bf7
SHA5121d7e3055684fb3e3c1abf68d9f287b45e4ae71b34ad50979ea8da47d4cbdbe7d3072013da4160410cc05505edc9b702e52d46cb4e5d16a028901b1b98c72a948
-
Filesize
1.5MB
MD5983d6e1575a7e72b00761abbe6086960
SHA1c2e30e2dfffb656623ff57cb4e9b2bd8cf7a6954
SHA25671bfd69a13a0a20914c361df6e92cfc3a6a0e6eb212b4981883496a20894155d
SHA51298c34e28e35e17efc23d93e8068b30be87e88f33df267eef0af80fe4ee8eaf398b2b710f067f59611ebb8b8909e7fcdbe520d5b6ec512eedd11285c76be237d3
-
Filesize
5.4MB
MD5bc63a698244c4a9e2b325eb47a7b451c
SHA144a00bbf201438f20366500f5680559943c63295
SHA25670d12f22a0df173dfb922da303d160ab25b158ea466fd7d3965169771a90e057
SHA512cc8eb0cb56bad466ab63ae508544dfcae14677d35d9fcf60b79b38de016211e599ac51bdc318a08c742db03ab6f42298bb002585d2d8b3496263f9e21f59d2b4
-
Filesize
5.4MB
MD5be643cf487e8dbe7f72fbfe07700884c
SHA19a8ce92aad8856d8591172ff2a5669655881adb7
SHA256833f933a70e48231c496ec251ddc6457acf32fc5ff665af052b7e3780440ecf7
SHA512bef9415a4023c8ed29ce944d19e53fb28c1b3618ff414712d7ba8fa6185c414f512f5cc5064988ae6a568182eea4f9dceaf0f3ba1d508483b08819b6c4099bcd
-
Filesize
2.0MB
MD5bd7f6f837c36e0b28dcccb6cfa3ab823
SHA127b13ab3d51490229e55cb6de5e9ba65c3e90a9e
SHA25688a2d8fbf16315a6351e9867559f7ac496927bebfc183000e30fc681088d6cc8
SHA51244bb7b327722c1aecda1b59d50772b5475c8dac4de8593fe4249015da5e60abed30b5df3403b63f6e8be9b4bded1033651f5f045928e26825aa172ecfa003e94
-
Filesize
2.2MB
MD5beeb821f17e17329597af7439888a2e9
SHA1ae9d5d173a1256312c85b5f243372938cc463745
SHA256f153162d403be59bd973491086cfc38df1c825d34c998c28b2927c6a21280a0e
SHA51239cad6dcd08e97662a2fdac91f4f1d82b98d4009a60194a57a9048a3e9b3aa7871f36f30d1fe9465a2b4454dc49b2bfb02068085bf7fabc4d266552187360624
-
Filesize
1.8MB
MD56d6821ae375d0858b9f377b12704759d
SHA1eed7db41204d5a9b9ca67e29a8b9dfd65baac13f
SHA256ba955a12ad807e805f25e46170cf08ea65446e89370ddb918cbb2e43404fa187
SHA5129c7564bf1cfde98e079d2cc092eced4b449550b3e96bea1c81164deac5be6f8eb03d5e6faf4e03a64ae6053764f5c31999e1400f5afd0e8340a3aba00ae59cbe
-
Filesize
1.7MB
MD5cf4a1867cda5912c24cb64e2d96195a2
SHA172233029732faff826dbe10a5c35dbde1fd693c5
SHA2562be83ee10be333a848bba4d321de8c75a79e6eb9ffba6818a79eac4ee884c868
SHA51216ee80d5dd2c5123a20dfa1447a7040e1f87b59d574c3d9f850c2798bb1895c006112df1fd88d37e6add34ed8335dc6a9e1e42bf9f33500a03f7ca3f12db99bc
-
Filesize
1.4MB
MD5913ab8194cebd5225ab5c430b340d9b2
SHA124c6bc6768ce981b786e0bf3661c2cd5d9981ad3
SHA25676e3d5f8589b23a9d89bf29328a68f2a0c122e4f5cac68b395767eda875eabb4
SHA512113176037a04e2faa8cd169aa7ed7c68229db548009f3b63378f7a9a62013ebaec63f65565cfd3d32f4c002ebf67f73b489afd0d97fb8078b8b13ec50322293d
-
Filesize
1.4MB
MD592b33aebe0dda1f766180d8044cb10c4
SHA18b170e2df6552685593feb369a26f8ae31559b48
SHA256c0c245b7e1a6233a50ce8bf63509a92ccb5a016ba1018b033747a63e5a959703
SHA512e73f69f7906c4c3db8bcb28bb8c347edbff0d802a0fa9459705d7eac233babc1def48fdbaebb6ffd28bfdf1535458bfb17fef302ddda588bf51c52e8f7ada41a
-
Filesize
1.4MB
MD5b06536dde6cc3965f73062b75e888c13
SHA1116ccff9b3266522eb911af9eec74dd82bea3aa3
SHA2569867ee3ec17770408a9c1f4af8e53e8192941a3238a943aea72e71076a56d283
SHA512a0201b2701ca44ed6b2776390ffbb1a58e221c714d2f6707f7cee4fb876e8a4bb477b39360484326f319e265d990a970dfab66c86c9b652e31d7d643adfc11bf
-
Filesize
1.5MB
MD55ca299358371dee867967d512e2ba377
SHA119f282c1ef55f859b2e5e23a346834f4a6eaf4af
SHA256721a98677e5699ed564174fa8df777012c37e7132949f724a7a754b8c2af1d54
SHA51285f192758099d84e124f3f36b68d116c3ac5b897a4baf040fa7f58e8dd317958ec27f5e26775e108c50fc2087a426b1cff3937e1f5a42789a6907259cec1ba56
-
Filesize
1.4MB
MD53bfa430d6d2e7c7483612835b624026e
SHA1047a378385bdfe9f96c6d37a3e7c918008d0c1fe
SHA25605f753a8b1e858fecd5f5814941024c442025a2c36c172b45d0ce68a4b99bd93
SHA512d8ff7ce4531496178d0252b050b29837af7b59e5158473b0c24bb75fc05eda6b85a8ef70c53c3aa759cc696a7126a0cb1168fb9a04303bce0bdda89ed752c12e
-
Filesize
1.4MB
MD573667fce8ec3e36b12b0bd58876c06bb
SHA11571ea8a373314c6c0f14eee69d175424c2be656
SHA2568ea46792cdd7bd95e6af93f18bf0f4958b9c5017a2b88d149a44110d175db185
SHA512b3e00ed76d9007655b576653e853aee5c563de64bc3fab73c1774a6746fc2630bcceab671ea0fb41627d725476a1a2454c6716f25e08054e65209f268d4d3e15
-
Filesize
1.4MB
MD5b7ad82d20f18faf7979256f1699688e8
SHA137311e1381a4a4cc7aa975eb4e8f3a72f8376b9a
SHA256fec62c90e587ce181446221991ba802abd3d05500db359627fecd0f3d38efe71
SHA5121120715529046fef1bc8841c1a9203e1daf992df34e1aca6043f681d454f5428ee42a28ac1b6400d642dbf7fb61112069685f71e19ea824b5e5feee0e360a569
-
Filesize
1.7MB
MD593fe4807adf7b10f5ab4e8b8d2afd66f
SHA115f2043764871e5bf7920083430d077d8c440f32
SHA256934a21e371d40def10d4949e0741c2dedc4f845396f112ecee1961720b66c03a
SHA5120b191bc04a3d14c502033dbfb4552eda4a2a992fc0776526ee5ac4601adf17a9a44aaebf2a54c2b7d8885a2ffbecb8480fe7e11dea9963a1fe4e9ea9b27baae8
-
Filesize
1.4MB
MD50c42f4cd383ef5a6c7133323cb40ac71
SHA177c13fabdca293d6fdcf0b7b6ac08d4ff57f05a1
SHA25624def91963d04580ed48c5301678843a458a87e15074a1c5329bcc19d2270c0e
SHA5129e8d00eca22a01f41f9a9f4005e1733ca221b205d385cd301809022ec0d366c1a6231a6725f955e8bd5677bc9163126f644d3e29ae80683051f242b76e783378
-
Filesize
1.4MB
MD53b0bd33e156c02038eb5742d5e01c154
SHA14071cd37c4378b2eee62f6435b21e2869438f74f
SHA256d7370683355212a9d45fc8f1a3ebe598849ea2e6fa2fe42d804cf2b3919151e4
SHA512fc84c4ee3348779ac14c8340933a2f388716dcb3055cde973098fc7c40a3dc5e02b4fa6ec41ebe5ab3f5725d6975e6efdc4246632a22c7c58fc0157831d16341
-
Filesize
1.6MB
MD57762c96888294e6411dca7ff0d736e3c
SHA10296da48bbb00828105338700e3b8b4ea582b08f
SHA256b97dc69ecf2b25a16c2791470695fa4cda03605e397b3f0aae5123fae330a344
SHA5120afdb4edec75c0677b1a6b243a1b3d05918a32cbf0d973fad6715bba50c8929fbb5423042530d9bb41a2585405b79cf4115b67e90a1b8f212832d4c395abd8e3
-
Filesize
1.4MB
MD50c792b546e0183534d5624777270b1da
SHA1c205a5b7fe357369a090871e6be62e9259c4204f
SHA256ce6816361f5ed9340f1769b3958cd08622bfbc914cd2a5422146c003001fb613
SHA5122126e17502415aaba244a7a542b2175da50c98b1d9402c65603d2137c99b247d7dbe2cb0d33108f57df4484b4e8144d466868835585d1440b96ae6eb24a46e10
-
Filesize
1.4MB
MD5971d79efca5699983a6f2de87f08a002
SHA182d7888babf35999fb1d7e72be52a0e26b352d87
SHA2562faca6bdd1f0ca46a8711cc0d49e881f9182c35c5886f244997680878c7ba1a4
SHA5124b3df6c36bbec363048b61268f043df824a78509813dd54348887dfd05e75929c4e6941e5934f5208dc9bf8447be568172ac54889e762d9ea909c971c3f69dce
-
Filesize
1.6MB
MD5c76287da7b4e2c148bd1388a2380375a
SHA1297ae0c5205c57c7456a06ab80bc73879974b166
SHA2565511bd614d5a9ae29c141e1ff99b852951ac5c28f305e72383a55138c4ebe87b
SHA5129c26fd07c0a8f18f686f07c1b507988654be59fced2e020384dd28cbd17735f18a1ce4288366fd5d3cf39bae54c4ad9e5acb8d5e20e3449543eea7851d904b66
-
Filesize
1.7MB
MD5a4f1fc9d233782fd1dade50889cbab39
SHA175f2a52aeee0d888a7c11c4e34427618300cc567
SHA2567002e32a4b6467357fcf7dc6cf7aa40908511a3d567b53e7e5a1abc6dc8bfb43
SHA5122e7514531df723bd2d9e733eaee45d25652a90b711afca98a758e9ebe4aa38d57f89368815798fa699593dfa0a02a499723c62cec4c86b35e630c54f34f18b73
-
Filesize
1.9MB
MD5a19590305122bba84828cc71984229ef
SHA107eca01738895416162fc9818288fa8f712e39cd
SHA256faaf927188051c865535fd1c2bf1e8e02c5e456baa95c05c97cb71ddee4b0022
SHA5128504dd4cd7bfe3f84f9c53091e3936fe29249f6ce81fe21db18f5a386655fcad71d5b6904de420e415adad07ec59820edae4be34eefcdd97f76f5229a31b7284
-
Filesize
1.4MB
MD576d336a9146aeba7276a0d64e96d8e51
SHA1157c0836c6ae899496fbc69b9a85d4a274699e36
SHA2569f35fd8dffeccc091841a613bd199bd50b6980e5f5f84b4c752216ce5febe0cb
SHA5121f539d4a6712bf204d21c218316b138f05fce5d102eaf8b4b0138be5cef028f0044fb86fe71ded4831457a28b393ba263d71b3220b1c95cfbae6b4acb8c72ee6
-
Filesize
1.4MB
MD53cbd8e84e0099e79c631ab9ea7cdd772
SHA1ae5f430b28f753c8b5d41d6e80f6f8e8357efa0e
SHA2561b7b883a972aad622b7514e610196c9813ad6bd8fe89242b36b269cf4bd579e9
SHA512834965babad150ccf391b67ff055c4b5eb2ed28d38155810692c4ff85cd1001d51406ce4b35b3035ffe6b023b2dc8e46f7e70decea203dce96b02dafcc431e10
-
Filesize
1.4MB
MD5081b982366917da5d064feeb80cc1c9f
SHA133016ff404a958697ea94921349acb9491bc690f
SHA2561b6c88134012c73f133342a50033935d9fb0d4a3029cb733bfdff06298f18fe2
SHA512bfceddc30da3b8f9d6662b624a81bc6e4868c61fd81c8f9b7782dfcf8c89352e6799c974b9f430c2ca887ebb602476f1bb6e76f1abd62b2d127d18d92e3783c8
-
Filesize
1.4MB
MD5a0a82750e7b33e6e42ce523564e0207e
SHA14828e127b373b9500a8efe82827f64a5ac2a96ce
SHA2568f931b8987dd419d4d2b699c5986444547c43f64f0555091e6b84cf3f03e03ff
SHA51286807ca7a0b7c0d6a7fdcef79486cb9d251b23560d67bea0920261a04638ef3be27266389acdcc63d5a6a57820d51f5a1f38173916d844e33685a579b0fb2ed2
-
Filesize
1.4MB
MD5c96e1255aaccbd02a6177fb9e85af76a
SHA1663064b78bf792ad97fc915a119ea0a9502e5a98
SHA256db84facf1ea8995cca87a666ae3ff4fb12dd18085ecfe50ea90a3f66260deee9
SHA512f89840cff848eebb50d4b6311c29d9667770919c92782e06e4b1ede95c07d105ea2f15ab1408f7abcc8e25c934e527ff56ceafc00a7b93d96cee8d895c5478d0
-
Filesize
1.4MB
MD542eeeb65e7b8d21532c655c0a4690ee6
SHA1558076826488a93b39736e9e750fcf11f01d6d01
SHA256446622ddf604ff1d5b17cb5ce9faeff39b1feb59c9cfad8f5e2d8c29be3023e3
SHA5123353d9305f31b81589002c375cbd4d8afc065e0c4a2a595c38507b182d9fb5582c7f3c53754d65ffd1b400101cd17681eb0797e9041ee1a45db0f04b831ea597
-
Filesize
1.4MB
MD58a5a2524188ee7862ac7c30d0a44488a
SHA1e1d32c43d43bca30ff9965b93d3a052cd1b02d1b
SHA256d708123272c228c79e0a037f81d29b531c7ab22f87167ec33333135abe47af51
SHA51296bda0ac249267edc4239b56b29607e2254362016fe221d5c0ab7289630ad7b308af869c612f4baf9bfa9a1f248d714b3d8e4080c8d408576458191bbb8777f6
-
Filesize
1.6MB
MD5969d8b0745c18fcdc513f3cc3da88c7f
SHA144d2dc8800c5b4805d17a049df702275fd7e9e5c
SHA25631655a8bf336e367ddfc2fdb6c475b03b3c3fb2a38e03f93c4c349f73df05633
SHA512f03e3bac0a816e2efdf420e63906aba39e67543ced3719fa00fbf23f62439db4fe61449db229a68620e0479485161e8eea07cbfd25f9fc9c8a471e66fabed4cc
-
Filesize
1.5MB
MD51063305e5a3b6166b529047f509eb751
SHA157806f4d52c4386839d226f10bb660dbfe733642
SHA2562c7d6621e986516232ce48f3be92a4bf2c4659a5507d863565a6e9508b5363ad
SHA512e4cf1162a035375b41935c8269d976b485fde8ce842c5443d9a5f29d8d49d04337a9cf61dec55e38009f76cca00235a1fa7bae5a92b4b87fb8065ec7819297e5
-
Filesize
1.7MB
MD5eb5d28654b5a141ef8c7674dc7f1d67d
SHA1133a698ddd798c9fe1b76aa7856d2fd458eb61eb
SHA2568c0f01829e7c72edbf2e84c7e9b0669fcc0bca5de32ac56517b4620c59e08fbc
SHA512587764fc5791b062cc127419f4b4e074e86039e6627fadcc571c8b253e76207d792816da61891652be9b025d1ba9b919343e236d26a2402d39280b193dc24648
-
Filesize
1.5MB
MD5ef6cfe9612cc8e9813579181d47b23a4
SHA134d426ef9c3c169fe8da8d8835dac0dffe923807
SHA2563efd6d08bc8b8b7ac5df6626d7f3fc20176307c7136aa65fe9ff6843e4f5743d
SHA512de3931fe4c5e0088d2460e28d66b74cf6adb73b2e262f3c70f2fd62caceb24b8bea2fc0010565efd21726b632d963c980e3b5b812fdca596741fab649777a6ab
-
Filesize
1.2MB
MD503edbb7d533b3e1839978d2fbcf4559e
SHA11a1e1e4c50b348b18f88d50f767383c436d9aa57
SHA256d1462a7a79f802c061e2cec2cd363a717be2ce4008f3ad989375ada4434722ff
SHA51296bb712abd45207a08280c4ccebb56b9a692695af8347a46438c9eb3bbfc2a75201a789f4bf9bb54a51782b08e8b253ca9c93dd9b607c0122e44bbbb76b6a36c
-
Filesize
1.4MB
MD5d7e8a8c7c2395ddea210ee86f2ba3248
SHA1addef970d802e69dc12e3768abb2ced42134c3d3
SHA256f91350b6c5b27e377c534e7e3b18746b8f85ae93ed347d07da1b1d92536ba5b8
SHA512f9411e79d0a970ae71cc96a2b235859c07c94652b32e7c4c6e0b722ac79e0de1f55cdb4d406e5bb4c0116d91398b57496d7fe210bff469a87b84762fe50d18b1
-
Filesize
1.8MB
MD547486ea7667940b1a3a81dc08cdd58c3
SHA1d782b97e435c7e866ed168bb34717ff19651dede
SHA256bed9148e80516ffd6ab3967606a64cbcf04727f031590f40564b2f1832ebad72
SHA5123bb1dc3b1b64e97233bc4cb70670fa9186a888ae344f0efcc46afbf543f636e683ef7db752053038edc1b06dbc32a1af718e9c2ca150f4ea5750ebc4d5ae9261
-
Filesize
1.5MB
MD570d97d2c87ec05ae0b4febf7014f6b16
SHA11c6a258a230426e6ee8378758f412dd7d4cdb75d
SHA256e1b8e24a68dd33133bc7d8caec5e0214bd51e424cba8f2294099888ec02baf0b
SHA512c003ddada276dfad009401f8609b4c66d115b6aa410459e8b8bde38fe89f3a01556bd3e39eeca55c1ec4d0af246a09acaa6464968e07a73043abc334c3bec87f
-
Filesize
1.4MB
MD5e4b90ed427da79d376ab137945e70357
SHA1b21dc06c3f5d798646dbb6f8a5026a9b2c8f127e
SHA2565e672fdff2041480e7a46daa6dddf7efd9a8b2a1da8ec2469df5ed8da606ad9b
SHA5123bcaa5ee02da40ae14a3f0c335b30b49ae19ae3a4b0be796f7d5f2b6ea9df23a3451411f34d4e00163c20c45567268513d28149fda1dfd5c30a02ae5d5398610
-
Filesize
1.8MB
MD5aa85a7f9a0eb81b791c44c56d44322eb
SHA1dd577332ab29d17425bc01119fadd567879cc4c3
SHA256fd497278ca67831644863b6cf928cd0ba8fa1241ec5f14dc9451f065b474f3d4
SHA512363c5d599f3bdb95493399e0e5ff0bfd9aeb9540920a595961dbda24721ce2f7d004395299848af54acf6dd0b4f4c16d3a0b137fe69174cb266fa874587184e2
-
Filesize
1.4MB
MD5bcbf16e1d28dcad02047eb2cc0845cac
SHA1f117825639ea3e19b0616ff13b13124a0eced57a
SHA256357504a791bba961dbea5cbcf5df9944d74b1ad4f27438111b45bbe9f56b8f1b
SHA5124c9c6e4a3bde8a3f4afed5cd0f4f0b629527763e9c3135824dc6690fda948df21d74f8c00e151d78828c3b1c012f4b7b3611d8ab49639324a76f8601787d036b
-
Filesize
1.7MB
MD5601f72129d783614a1a7d5761c945df8
SHA16db8808cee0ede3d8365ec8af68f0b8cb4671e65
SHA256bbac3fbe29f683a047b6d20bfaa4a613ee59f785bce5d92e4418518f15505884
SHA512cff4bc20d40ab48b83102e1858af05aca44b10eed4023fe0a25378df7e62d9ef2716b8913f0356322fe117e4cc0f0b5b6718f9351846deeae25629ad92ebe901
-
Filesize
2.0MB
MD57580eae5efce41f48498c9fedfefcbb2
SHA111223cc57b2e92ea961afc8b54f1af1d4a6bbdab
SHA256bd954ce43b8ac01fcd37cc401762a62dda9e81fff6b5ca08c765a8896b5b1195
SHA512326e17387d9d4fadb98df7feb7f8abf8deb084ff38046c8799cb030d67ddd722638637fc0d9e888ec06b29ab843f41bff0ae735d45a2e82d9d24de6e421e6dee
-
Filesize
1.5MB
MD5e6fdff21bd2fa56fdd133a3f629d5001
SHA1d01a7f3d19269096e0d2281115eac059e971bb16
SHA2566abc498cd18267f0595737db9623bd466a708a5caf6cbcff02cde48d0d4b2cce
SHA51275c7acbeffde137dbcbb12bf39357eb3d41b21f0f7d9260c8e6393c079f876a49743a5171abd4327c3d5e1608f3f2ac083c16b259afaa9091d742ca42780d29c
-
Filesize
1.6MB
MD54c23553909f09be032a769e880a25fd9
SHA199ec52feff9ff724b005d62ac627a858d504bbbb
SHA256f0ae03f783a12c59b3ce9a24518d862e79812e1e2b4a63b1fd6e6437370aeb9f
SHA512344ca64a89320a231e5a59f74a87c28b0adb1d665a82e0e9d83828e9699b4439cbdfc2a7ffac4b7d614082fd16fd6611b42b7603c2dd10532672dae2459c349b
-
Filesize
1.4MB
MD522c2ef7b5a4025fa6a9ead29d9d2155a
SHA1de474db00d6faa179ca849b435c44abeaf6a7316
SHA25691eadda59794c0fdab0f43a8de187ed049469c2cc6f0283513e66ac7ff43bd4d
SHA512bd39c6abcbfa6f3b7b71870d245e572490f29129ac71f844141e3736133a7a508bea1c2613ddd1a40c4125be7c0bf4b32fd40b72e29c750fd492be365252086b
-
Filesize
1.3MB
MD56279e0870b82c61493779f1c14b471fd
SHA119e0916c40ac992d0a349338f72fa64c5ddeae08
SHA256361843856eab682d4efa5d5d530513d232ef3cd5889b0596af5b0fe480dba073
SHA5125a093a5d7ae64b9980b6c7ae4183694139abdb75063032542131f27affde1ba4d339a290d18b13c3e09fe556c12a4993af8016885b6dc92d6e4d27f881b8439f
-
Filesize
1.6MB
MD54173b9c248d09e375e20b3cf49dc98a6
SHA110c63054fe8cbd50856c47d86083cd0ec23d1429
SHA256f08fb932c6759d37845824fcac9279e37b1422050c71dc08165f8b4be359eef0
SHA512eaefd9dab3396071af7d869a1548b7dac9c28560e159ebb261ab813a26f71c57e8497edfb21c96d704ed5fe82aaca7ef558e85dccebbb7137cb00dc0aa036bd6
-
Filesize
2.1MB
MD54ec1149e76378545a861b717e03d9ec6
SHA1199f74a9620c4728218d998b817a5679cb7f472e
SHA2561b0362f982c83147bb3be6d61afc92b94df710286ba9b1f33376a264cf0882e7
SHA512756f0d1695a6c604ebd5a0736d9ad8265eae4210d3c0a855f0c468ba03b9ba3e6304ea9d8468b48ef4338f475c75636fe1fcde2c3b733b89af93ddd767c57019
-
Filesize
2.6MB
-
Filesize
384KB
-
Filesize
2.6MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
2.5MB
-
Filesize
384KB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.3MB
-
Filesize
412KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
2.4MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
2.8MB
-
Filesize
384KB
-
Filesize
2.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB