Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
27-04-2024 22:27
General
-
Target
2024-04-27_34c4254e235fc7eec9583e60f9caa6aa_ryuk.exe
-
Size
3.7MB
-
MD5
34c4254e235fc7eec9583e60f9caa6aa
-
SHA1
9618ce799603ab29f6bcf6ad6980cc9fb9ca61ac
-
SHA256
db1d66eed8459ce1b7c72d2c4e1326a1cc5bed50e4535679b8e7890fe3106d91
-
SHA512
992043000c63a9ce9cfe0f3cae0a64f161500727e49debdf70969291c4c03921fd34920bba3743f8aa0df3a5f9653b4367496ef54112ad6a87d4ce929bc79a04
-
SSDEEP
49152:LFg351Jg2TDu3Smqh7U91MWbkujdGXEBj3liyBteB9hFtYdqlMMNPFd1YMGyNNAW:S/Gbk2GXmtdqPPFrYMzYHD527BWG
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 37 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_34c4254e235fc7eec9583e60f9caa6aa_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_34c4254e235fc7eec9583e60f9caa6aa_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5c8cf3aec09e221e4e2d2b175d1d2dec5
SHA15a98ac03be86739c48aeac2d31226736663d67ba
SHA256ee58d25cbbc5c472c21f529f9f9ff64f5fd1e8c35993097195f07a55433f27c8
SHA5129fb848d8d693c41abde851f0e20985e4d2a3d95bd2cb46cb860a2775836c676fcf1bf205b761141c0ebcc8f5d537472415b64978f3ad47a614d52fdaf9105adc
-
Filesize
797KB
MD5e17813fcd2fa9b48e91289a246a3b94b
SHA178e9390e20ab228394a4a842a170362b16e8c99d
SHA25638bd05d3a367ec89836be6601575ce4758620a8a83065309400012161bd90cc0
SHA512b52462eaaac9336b664f92af334b15effcdf2661235cb4da101742f0f5c8a35fbb6fe57630e99f8809289dd4f7e5c45136cb14c59c5cea5a62cb1eab2e14535c
-
Filesize
1.1MB
MD5b2a0375968837843493d89001fd74fcb
SHA1dad2a5c699e5d4781f061e4cef127814ee77b95e
SHA2568913d75855b4b1b0299e100014c4ab29a3b9112487a52cf1a9eae2f3dd55868d
SHA51250606a0a5e48b1cfb9723eee280f9a622130e3f4ce4cfcfbdac5289a8e2ccd10c785dd29a42b8525d0dfc1a8840cb437463285e0feed6e78e9f325057d951cb1
-
Filesize
1.5MB
MD5b381bf83dad9fcb10154385c13264ac4
SHA1ac0b92db8858e7aa3eada258c6f1236fdf3e7241
SHA256416732a83226b90adf89544b8f1d02097eded85efd22817e09253d1d64fbe52f
SHA512c4dfd03e8f25dd4b21f824fbcce8b9a6fbce6bcb5ec8f2d0c933272c1260ea5bcf82f7ea0ca7e9dcf8d246dd90930570c82ad88aac4935496237aa255e5b407a
-
Filesize
1.2MB
MD5115d02a072d3ed0f39afdb60c657a1d8
SHA1d6f38bc15c04fb85bd16cd4efb9976bac10c55ca
SHA256d0b0d84784e592d13a802702b36882f9c8f0d3f8de247f89b7df92825a9019a0
SHA5120612aca235732ca2074733b6345d1fcc4e095c145c8f006c0ca8aaf9c416771b6cc4c9b734d67858b5fa944e902ba07d6cfd5b7aa778d425511fb962bac020cb
-
Filesize
582KB
MD56f3aa3e20bc0e3ca6e4c48ed2fa02ead
SHA1ade4120a5fe2d92e7d80fe09ea7343603786bba9
SHA25621663b14f20673cc410c97138acfed47c1a1450e2078cefa51b3e54b1ca5cdeb
SHA51292645660980669af4b1700582349654d7b1214465905212f071589e011c426dc84a939f388aab0ac3381d5f2ff15dfbb45954d0a8f856e356fcc5042f013614d
-
Filesize
840KB
MD516f3a559da29014d0a4601c8749a19c4
SHA1a38966a8d9078266e2059f6562ecbf3c6b825364
SHA2568207036100dc93cf08af24752d61cb5188718207581c3ae7389193621c00612e
SHA512f3df27ef2a63d3d9f3db5defb5f1680cb8cea6f554d82633040f16ff4493575d4ac08e8d376f60923b90d3ed05ca6652f811fab925fe7cf7659e3c6129f323bf
-
Filesize
4.6MB
MD53f53664d7989b21972195db8bdc10bd1
SHA131894ec43a780abf772a9ebe914f9560415baa9c
SHA256288b74ffca6413786b0fc6f9737e4d722df0f39850601e7d303666a4abb0c457
SHA512662752de6c2f37c491b61740e60610ac9baca4c93d873011c9c29a494292e6b7816e5c3a65d11ab4ed65f93e66c684d7e28175f6084179640bc466ad57337e60
-
Filesize
910KB
MD53155f80b5603994eaf3540eea7702f85
SHA11b4e7002c8a061725583bebd57f2e87ccc13e914
SHA25655a1f4fe8abea21332474f337d4000077df05f520777cb632abe9ea67a32e181
SHA512112e719f00a189b42694cc56d5442aa82d14235e92928d12d1208178ad7210cb1bb0745b9040336ac971ae37bc6aa50504517c9bd0369b78083641daee88a4a3
-
Filesize
24.0MB
MD56d80833304edf89996038a88d6151e4c
SHA17ce58f58fb35f174ba801f4b66ba8bc0f68a06b5
SHA25619863e35b0dc5ed0d4ee1bfa89685d7965fc15c79c1d53d28f4fcb1f990c0d6a
SHA512a222bd7d228cdca8bee16db5b1ec828904a7e747a62bcfaaa3c0c96347cde00a1c5c9004324991e950c519f2e091b37a022b798319cdcd4b1ee2de1c77af7e5f
-
Filesize
2.7MB
MD50d7f78f588f414d43484d046e74feb3b
SHA18fa17ec1a393db993c181247f3b099b9f3fc15ad
SHA256c81c41b3e42e9cf050ed14962b82bac83b22853acbb7eec6d510f492496c07f9
SHA51243649993fc7b2b4ae6e6eb6c7167a0cf432c6dd3950b6630a9f3c5b49f2cecc41a214c3e317323e84a6b1dfae1377beae711908e493a92ff3b66b1e442e6266d
-
Filesize
1.1MB
MD5daa49ad18e7fe52134411230faa45834
SHA142a75e5a50d73b8cf1e8048faeffef3a0c74023b
SHA25638741a03075f57aa2f9da019e57c833b8bf6cbc524436e9d3bc9c87149bd707f
SHA512dacdc1a4bf15f4468096e0f3f6fb4bd24b0abe95cf10113ac0f472b5fda53d859d2984aed06b1f4f72ee2f83fcacc1679fc4b1ebc5561ca2d5c1639a1a3da808
-
Filesize
805KB
MD53a25bafc6a98393fb2246b48d3ac7465
SHA10bf5943259c4cdcccb5ec2bdab47ac234b6e6489
SHA256cd40495f2c1857c9cfd7b397fb524bb5ba5ddcbec97335bb4742d1a1b5a4c004
SHA5128e7a6207cecf6dc6f06ead669c6e7a2ecef88094233701fd33c66f834a0d03323a4041a07b09e69a59fe3775ca224a78e0c153bccb73600b92a2cd08d30c9cbc
-
Filesize
656KB
MD566cafc984dc953e8470f1da18682594a
SHA178e4069a6560c77766cf8b72c0f0e4e60c68fd47
SHA25676847a3f40bccfb41b25ebe64234b156ba4ebb661f0a76807329b7d2df8ca560
SHA512277c60abf8e980144f6347923aec355d876d2abb096070f21fb7633a72b5814b49394101d7a9675c9f133c450e7f8e5d42a3190f4688f0290ef4a0d0192bbc0c
-
Filesize
5.4MB
MD5e674698f815c57fc01b12ae32c84c958
SHA1e82c78cc10c4ca0eab29a9ef5b3be8c9c10c15ca
SHA256312bdc7fbc31fa62282914c81531a72a4c60bd9a678aa8565fd53fad033c3997
SHA512e2528ec95a2eadba82bc58c70740bd69f91934156daace829cf96c1bb497e4589c2b2329f2beeea1a178e9c90260b8c880d59910263805f9a880ebd5062212b0
-
Filesize
5.4MB
MD59336cede46f54b032b61dcbfe286c55a
SHA19e6290170f110eb9ecafab0f8c59c277dc238370
SHA2565e83b389293dbd654d08abc6d306b84916619ca3fc16cff0e1f938081db80864
SHA51201836098ddfc2dde63ed7a231e41faff197410b65c409df25f6929641878f9be46bab33b48e6be26684db99ab3cda4c744c368d1153871e492900c6c5d8cc6a9
-
Filesize
2.0MB
MD54772efe784e85c49615f318288e55e85
SHA155c3271572320d68d9a19e275b3070354e8a54ac
SHA256837a2eba6ae7eb7bcc86cca7275f9096f3c2ef931dc39f8428a9d39c3da88a5d
SHA512cda6ee9a8493d866249b14cd4b7decbffa098c2b2727790c97e5afa96886b40b59d8f14f6f1bae1cf9d952cc3af04a39883d42f0d0fe4f346bd7904c4bcb4876
-
Filesize
2.2MB
MD596e18a91c206f3507c605cc21253ed49
SHA14c7795409c1cffef47030066a87e5c620960536f
SHA2567f2adbbc7c0e5492082796e5f628f613a1bc546583ffa85cab4cceab4a1c5e0f
SHA512d5db05266dd45f90b2fbe2bc20710d57f26752213a65525b1ccbc3c42cc53a2e527c697280d8a546f02bab3bdca0316612b0a508c4dfb60d65f575a5fcacd270
-
Filesize
1.8MB
MD595bec7455b3571f84646d4d106cdce93
SHA1e226b39f1c85fb3dddb54cc048b56397125f6fdb
SHA25650e555c081f6daf01b8be1e2bf252622d1e086ae9077e020b52d85aa331c0c5d
SHA51248e6fc237d0b6585601bf17c00d38a86e6b82d84ba264c82761683f4eb026020faf63453a7e61bd66828d86b8448f1b0dbcbbf27f37117808d95734b7be4bc68
-
Filesize
1.7MB
MD5f227acd08e01a98b83b61e43cdb345db
SHA1975cb81b3d2b53ef1065286062b3ad682d57e7e6
SHA2567a2928fb8024946c7e26e9091abbb6be035c73d9df143a8b568aabac1b93c50b
SHA5126f9e8af54bad5b25e33a00bc6485d2e65a7f54e32190415c647f41e8cc09a21800eded9a104c68d07de0b4e1ab8e55276b230b183c80a052ba34b7bd8b5a3488
-
Filesize
581KB
MD568d227a813ab2888ec69f21551caa829
SHA1869b46abc3c4e8bb789378be1071e38665dcc617
SHA256b7a898c95e8f6981628a2846f089fc447d3c92228292da243983951be1e68762
SHA512a340ad1e618be74ce7d5d60f2651aa5c785d2a0dd4061dbeb964c1cddccc7e8a8f685c1b2015c75588ebc216b62813fafb5e24ae9d5df076f088e863655b2ea1
-
Filesize
581KB
MD5824fbe0d03811a0688fda9a485b8d131
SHA12dfdb0a6aa9da0a3934dc806bf1ba84a01be1d79
SHA256d934bb207a7dad935cee9aacf38357402a9f3963050d2bd9a452de82bde17e64
SHA512cf858ba723d52d9d6d28e79c526196eccb1083570823374499825114d60e18a102d22f2aa5baaaae7c357933881eb86ec3a324b256db1ca91b9cb472652d7666
-
Filesize
581KB
MD53d8a8b92152e725c1da4ac8b9efb4845
SHA17e07428befb55a9e3604bfb42cf3da62284424a9
SHA256e5cfa031b497738ffcc57868b8d2bca93575bde70a43e472387d4a37296c0416
SHA512fae26f9f970fb7308fd95f835f295429b7bec469a615dc5240fcb06910d94a6c4b2665baad50d275d59a995d1b1df9140c8825fc5ca94ab170c708ce9fe79b33
-
Filesize
601KB
MD5f6ae1ebfad8c204ae7df127db4a57544
SHA13e92dce5c0e6f0579ab6ca316a6652b8978fb60c
SHA2566aa1c1d3f65e61cb66788c0afecc7d32d5d490c202dc1e4fd1daf09812160fb2
SHA512f5582af1f4c1d541f7dcfeb73e6237444b2faaf62c3e73306e90b18bb7f27e97bdbf0043401b3e442048a567dde513914be919a9d995cbb98d42742ee47f54e2
-
Filesize
581KB
MD5e9ba853978ce142ee487712f20fa40a4
SHA1dc1540a85f31bc23e7d02da300adcabb55b0d619
SHA2568fe30da8aa8c676f26c5735343d7290ebd9f5d24d6a1a58651cea0002299113f
SHA512cb6d3b280552d915ae99e129c0594fd4e1dbb0fd1b04996891aabeb2759a012a222cc1cd91086d7d054963e337a02704052a1e5d43120ea029c5bce1cd7e92ef
-
Filesize
581KB
MD536266df2160e5055d6fbdb6425c49e56
SHA16b2cb491ee04865236c656f8e2068fae9796e603
SHA256ec03618b46004a6e662a61330d1831b2dd5f02548454d428a07db1008c5553da
SHA512e8f39d367ca84ba43fcac5ea00a9f8d78ac37745b1112ee9994e03217de96d457df2e56de87c088ff83be5227be0032d30d3078e321129269d1debe8f3614780
-
Filesize
581KB
MD54a19c188a351a859a3bbeb161fd2c9aa
SHA1ce181c150de0c92460e1ae3621cbc206913bffb8
SHA2567883698bd576bf76db364677c0a3139be9262b5f3e79fa73e7887ebee701f611
SHA5126f19cde05dae569210081d2a832601bfd2af7e5ae0d79c81503fc2f33d8f9eb13540db5b9a9ed401395841b109fc8d74097e142c6977b28fa14a37809846ad0c
-
Filesize
841KB
MD50badba147a5e86dec705dde7137353fe
SHA11deee6dca4d04309e2601b8d9832833beedb8ac0
SHA256e51ee31607ea1da964eb422c252590f56f0b67ada9a00d35237886672e8c0fa6
SHA512f7a8d7e318d11b921d5af33aeadf567a44bb5f57bd1f68f13ff28412528976fb36e39eff3676c87c3964e51f164c52dc3d07937b579afada2f733087a5f6488d
-
Filesize
581KB
MD5c9777b6dcf3aa2d788f54dad8b346b47
SHA13b38e1fff4d34607b49b8ff5974ea48e1fb75732
SHA256fc54640cef96fe16daeecdfa6a48b1e63909ed686a6552256d7328a677b33817
SHA512565669bd19fcef037a77bc16f251871d72bb90eb72cbb9af885ef9bcfeaf1e54180f4f26044c8a5de03133819c1ce4e04a3ae92dabf14b4a6519916fb30a477a
-
Filesize
581KB
MD5c80c19e7bdf07f1e3504bf6bcce6cdfb
SHA1002ad76bf82543b4567dbda2a208a6c18abf90b5
SHA256299ff850330f6648e6e83ead9771efe16171ab05a028699bb24275165ff8adca
SHA512f7f8946869df16759c22ea45f28903033faedf1163cb1e12437016fd2cba3e42fc36dafeb564abc4a1ed7cde58cb019f3766d89c43314b622ce05b98585254e8
-
Filesize
581KB
MD5487cf63b955cf05abc9d7eb8474c4c6a
SHA1d4762cbadf6bf24baf227b40898549c157a6281b
SHA25619ecd696c3cc07f233644f78e14fa5184a5e09c8f253172c2b490afefce809ed
SHA5126864534aee082a047b4d57d06d9dcf080ae034f458d5b7ecea5c63c54789b85667b49e4ed8f009ca61d4935f36f4882dee4fa2c242183e4e08a42cd496d03b04
-
Filesize
581KB
MD57ffc40ea65cece1a1cdfdd691c6c6d8d
SHA1c44de35186133c2b117f9900c2be51c88b8faff0
SHA2564fcc051ab5f97eeb13c0345256e56a7e180538ea1ca8350052acb7e02ff9b0d2
SHA5122825efa2a5c1213540272867a46e2b0e447e72b6ee34b3b971995e13fc98c79763ab610f5cd4ce39b74e291adc6f92fdd223b8481525ce9624dbeb55a04725ef
-
Filesize
717KB
MD53ffd0df2f814c74446b642a6a073d470
SHA1075f5a2491f564ad79e4135e55267f85470f6b41
SHA2560f45d6c765d1e46ba203db822286067dc43f508bb038bf27b03e076d09ac031f
SHA512d3b9e6c7dfc17606c672297be582044fd8548b96200f25256c9224d2e461cd7a7b2a5e6fd2bbaae1ee9e3c511fe69af1d445b14417c241ab0f791bccc4f90d18
-
Filesize
841KB
MD572d941bb75f28d9eab7bd6816e11b4f0
SHA1a9fc1874a0d483c617785e288b1fdedb80b3eb72
SHA2560e9f9f7f37ed4a9b232952abd35aa620998e10935d416bb2082d2603f74b4092
SHA512199ec20a1834df96b1a050367d3ffb96a48835534beb70b8fb227e9b988087e7ca6950c6cacafe43a72ed71cca8e1ee1936c45da9f918679b5f8c7a3113c0b88
-
Filesize
1020KB
MD535b2d28c322e36064d19cf1b2c97ba8a
SHA19c6b9d23fc6889f5891849550c56f4f4f1d72bde
SHA256ea5a4bbce04be1a1fd4bcf52bb7cada85e953d29b8cc22e2906b351345faf605
SHA512a895d7f6c4d44bd610b150b3c56b37f1c3f82cfd24a70310f1f4399657fa39d6102a4ed7678f82bfe5962b2570ccaa38c9c165a058a31e7f0616d89b1a4d2798
-
Filesize
581KB
MD50605126288728036e7d44160a4102651
SHA1da184b7d1d512b15fd9acd955dd10b9d3e5c30d2
SHA256b6cde6c8764647ca364c9d3b145d90db72c1c935a31c690b4e38619873268e0d
SHA512dbeccf777fe24321254d6e0693c592ea9470835625ffc07f3a1ae3dc1ed6f1f1ed43e720dfd03f80bfce2f0c36a3b6cc44b4b5a7756f6f583ca35866cb0271ea
-
Filesize
1.5MB
MD5c4078ff310814dde4166ae49ceba3fe1
SHA1aa123493ed8f6f7fc35b2087870648c71a38e687
SHA2564fedd82517d701d6f9824d6caf6478664c09f68609430841d776676e34bf19d0
SHA512146dde9af3e1b22c3a6da805f785f8d55a68f9d3901ac1c9620c520ab98be1a86c769036e7b0b0bde10b7fa93f31d198d79dea0767980f441c889577a7a2e402
-
Filesize
701KB
MD517e4851b6f304d3801bc88e842238f34
SHA1e912b4780b3945b1467976a21a0c4c7007bdb10c
SHA2564388d3af05d3977f78d26de723b7135761c97f063fd3f6835ae0c9290716562f
SHA51277400d44a41a96e8fb25cf8de0d837c741fa8c62486cde5950c3afc593b4e440abd1f3c4fe94c7978b71bcbfe977202f9daa4a1d1e75971ca87a3b3c446c2421
-
Filesize
588KB
MD51b440f807a36da5d4443f50a1ae3fd93
SHA1206a268261918810860e5a07a49c01a9ba4cb5e3
SHA256e4b418a8387ebc4aff9550dc92083adb57aa249d32ab0fc30bf885fa7eaf8a5c
SHA512e4db6d911f45ddfcb02c94a5001312fb0d7dad10eed1b04285ac1494e5f4ebd3d0abc40b360852d0e54b0f3e371261136cc1ea003bd5a4d3b951b0b8f86df381
-
Filesize
1.7MB
MD5e3ca37d0d25ee9a37b21384a4b807dd2
SHA15a79cd73a3bd8e01f7d55f6ffeffc761b977a4a1
SHA2568f2c71b26773a0eaf6697ac5e4efeb8d76d61610ff11439c4401373c8bc5bec9
SHA5126123dbc20d0b7ba824d73f15d0ed3d00edf45b9c7f88e6e29f7c52a537e90fb2937a8be3252f627cbfbbcdf5a68d1cfd146185ad0dfcbcdee75144c4542f87a1
-
Filesize
659KB
MD573a0d17e1fde7e3695957cdda11ee803
SHA1b93c645b8ed398a6a88a5f1fa2b5c1c153be967e
SHA2569f162d6499e4d4350739897b5e253f833ffa91d537f76accc690bdc498ea3e14
SHA51231ce6b74d9bac5154c171573e53a374d2853bba4c8789f5aa5df4349e4b3f5da2c927ef38c94c12c442b98aafba2f390810ee52da77387f578681c4925a31248
-
Filesize
1.2MB
MD57f88b24b1e9605df9328750f7c5ac125
SHA1f8c5f39c2e48cd3d29d0f5b9118c2e5388951260
SHA256d83411602ef2dd975e87c44f519a2c74e076b6c5a2bbdd8f53d7bfb8206072f0
SHA51246decec31358d2222fbca8982a8afea3dddbb1f68ab7dd01703f80efbc2861489406e673d1e4f10e11d3fda78ce204f0ad71321f09d88e06bd31ca46414b8ad6
-
Filesize
578KB
MD55e1a4c8de8817812e3fb889b143121a9
SHA1deeda27cfdacec5d4ac9153f155e72bb88e6517c
SHA2560bff431524de9a8a32865fc70ec2db4492f74b0b67c9af3012a091ed838fb441
SHA512f30306744c95f019ae54dd7a35e71ad219f538760195aea44a17aa6f22bf013a711f4ada3890da883d651977c9ceae918e43d5b491d20aecb93f202da6a2e314
-
Filesize
940KB
MD5a851ff35ff8bcc0a94d81758f16737fa
SHA10dfb65be761254a445fd2265593317ae706be31e
SHA256a7db5bd6cda7af7a020d365d2dc00d7228538709dd79f7b71da374f6052d5277
SHA5124e090c05be7aa1496eee8bbca8762beced318dfdd25f7e562006f5f8c08991c5ec3514af49506df8e17542b2cdb7339dc36bc46a6107623777cf685665657105
-
Filesize
671KB
MD5cdc1fa081f02fc0eaeba21ee7b409039
SHA13f379584d0df47c35893c3090d2e5a3978a8da52
SHA256df18bade26f51e5bb2e030cd460ece29825e3318b0693cd919202480917e14c5
SHA512bd3c07a6e4792d9f534ea1c3ec810bddf1a52598bc4a485f79dbf0b282350601996e2b9a5661dd70d667ee5d98c50dcb7def5a25523d28c7d055d440da65a6f2
-
Filesize
1.4MB
MD58443580326c25494dc81e91837209b25
SHA1b1cc40cbaf10b0ed37791b3f1087b0a135be6d32
SHA256c74ddf7684c270355ac74465ec133cc0131469bd12fccd20f7ecd5c9c9b5d257
SHA512c5facfbd29882a627b5a98879345ab91ae1b6d132995ed985a881a7787161c9192a413e9c707d599afab6ee5b0e62bb7fec6d35918df6ea0c492075f55382336
-
Filesize
1.8MB
MD595c0972d5e4de25e520fce5ed86c8f8c
SHA11893dfff66601c9e9e9764732134fe6b2ea7c608
SHA2563322b4601865e1aed62670bcf682eb1c6e738789d07277f8f9ca9d7816246db2
SHA512a2004679ee9461acfce9e44a901c3807a51ede0ac54ed9d303379e0e925d37af6697948333fd30a1de9f4299d6e6b666a5f3f22e7b897d3fd41844ffb443ce68
-
Filesize
1.4MB
MD5a2203142529978f0677df5dcec013b66
SHA17c449d40bef7c07f86666ce808ab0ec74fbabe8d
SHA256865e8ee6e08a281c0bbc50011bad697b58dff08d7aea949769b81c1b937bca49
SHA51264a4becff8da09b2f72860fd61488685f75dc2a9ff0fc1745599d2c0fc01a3df82655a38b4457ffea4853fe180cb356d52034ff98f37c98f44eb6495659e3a01
-
Filesize
885KB
MD5b9d5788b3a268be1a755ddf9b15a2e3b
SHA13f992e47f53d5153677c9258f76a66604020e20f
SHA25632650bb054b7c3c0471f657cf221986fa57a0aed0bcf6574306ec5295c86ff9d
SHA5124c0e706aa48df16b8389828cedffd707be669cd3601aec81263b5e2de410cf93887ec3746669119aac118139eafa701bf1a7118e7f033bc5443a667bcd0d7362
-
Filesize
2.0MB
MD5038dbcab5605be40035c1abe6c030ac5
SHA104061446bccd65d8fd62a6a4d85961bff75529d2
SHA256f56594bdb829bd33663d31280a2eaababa789f09583fc7b0b3458d9eba0d291c
SHA512985aa3c8455e250d97a2460e686d8848ea8aa0b77ef845f20f3985a38b4fa40f4713e97d1655462d4a6e3bd4f4e28724eadd4896dcf5fff118bd7473bf0cabb2
-
Filesize
661KB
MD54cac867cfdde55d9f88cbb6593a782a0
SHA1bce8af27689c5d2b02369a950090c8c3f961088a
SHA2566f448d4bd54b53e2a9470ee785452280ebd7929dfa87e98cfe1ee601b2f89fdf
SHA5129406f7992c37cee5ea7b3a87c8d6983b3be5dc4ea9ee72422a5933ef620dc10a67ae55a31a3dcf3c63fee5c5b5330434b81169a239952db59fc53b07a4db9a65
-
Filesize
712KB
MD579202fdb27a3b3589badddbee65adf91
SHA1fb4f6a67f9f5d80878decd9a361d024706fb6ef1
SHA25696a8708dc236bc123f81d43e6d9239cb7e142c67d1c02b02ba91086de3ac01cc
SHA5124b0b6d3e1be318c5e145f5fbeb0e61dd477b652a518d8e1d23770a8da77cd0e295415c78267633b6c55e5d0b8a2bc662fdba3c219017f7e29609a403a60b09e0
-
Filesize
584KB
MD5a9751ac6983770305f96093c102ad56c
SHA1b294946fe2bbc57605af7467b7de5b5507a7f5db
SHA256ab3718873ba4e8565e701e697591a3e03d5134c6268d7c7356e905ff52ac9203
SHA5125e638a1bfd758e6cf826eb345cf50ab45a396798d823009f13e07f88c7d2ba34cabd5d94a625760ced14a1908597a0e4735226898c54ca9a1e9cc9304ebb24d8
-
Filesize
1.3MB
MD50a2d15f8d47ea9da0e69885f0f3db909
SHA16fb78da80a7b83eea6fd53d5e2894064648c3d03
SHA2568b376fe8106d07131b3e42c0e3442048bd8ae65ef621456edc2c8545a8263cd0
SHA51272d82619e9e8d41f8ba38e862f09abbecec6bb62d0168c9f10baac1c7e3de87ee11b72e3d625cc4784be9c6a3113af1955fe25e2228627c920d073bb6312669a
-
Filesize
772KB
MD56a1bd2f61b2874a1efd1adf65ccedbdf
SHA1b0a05a9aac9a449a24096a9aaf6ccface5f14595
SHA256a9e384cfaa21be042db9be927fdd7ef5a5d406b8aed5790c0865a699c8d8dc7a
SHA512a15dbf1fc6ff04d823329660a86d6440ecf916d627125a803dc0966efa289d15e40b05fb7fc4156a243d9483dcca3ae1803cde01cc5028715114cc4469046d85
-
Filesize
2.1MB
MD58489f8ea7ace9e2b97da823f56f5d539
SHA1b0e124b975c87652e49642558c81e8130fbbb332
SHA25666941301e93bfd429d8796415ee7bf2a3ae848e2be9edd46514ed00f5aa8fa56
SHA512f78b8d125c33cc75d769532089e6deacb6083425c3d1a7234f900efa5d053d05416c0b3394c566e8510a1935c4b9db7fcac30dbca00cdb9c1425781e822c1760
-
Filesize
1.3MB
MD56a504750a814514a47c8e6cecc3c38f8
SHA110f999a4958806f1a70fdc7c5b06ea5e742f4d27
SHA256a123da062e0c3b940da90ce2ec91aaf1b87b96d07ef7f54526737cdb4bb10cba
SHA512d3c8e980c8739ae2203b474446a7e4e8a7d5feb8c481d270e4519cefcee302b7598dc1d8d8003749b978555da9bc42158ae4095ee119a10d537eb53122a6dddc
-
Filesize
877KB
MD5f17c217747b640e2f618c695cbe5c31a
SHA19cd3aa1716e8987e2715a0243104af75ec1a30cc
SHA256579d84cf0db291d45d680f0e959f90ccbc85203956d8f4082542e20f64903ed4
SHA512cc66b8bef00540cc85a509c64998267db4e9d603132b6739a508d08e771b9ef5479494502f092d8c9e641f204318bd8ff07608e6b2a3e5dc955a6b951c9c3de8
-
Filesize
635KB
MD54e9ce478aba8871c618395b21cb6f9a1
SHA1a53f78e7f21d3ebd118b4a57344900aa5735da09
SHA25624170257d2f1f5189725431213aabc81fe64092967ed57640dbd57142756fb95
SHA5126bf9d8fc278fe87927b7bfad912a2b2ca58aa96cdb102d7f308c9066f879d9c38f3b9a4623b0fb6ba3bac49b937c30006b128092eb9012276f5cf65632adc3d4
-
Filesize
740KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
600KB
-
Filesize
600KB
-
Filesize
676KB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
3.8MB
-
Filesize
384KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
596KB
-
Filesize
596KB