Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
08/05/2024, 04:43
General
-
Target
2024-05-08_9bf57d63052b2a30c327abe84aca7486_ryuk.exe
-
Size
1.7MB
-
MD5
9bf57d63052b2a30c327abe84aca7486
-
SHA1
8ad528e9db2e56843b2ad10f71f8f8070fc45049
-
SHA256
310c21b842cd5f92385e8690979d71e385017119d9c38dba45614884d3bb432a
-
SHA512
0fbbc04bf0c5bf9e81c909954fb78ca89113b0212af7c0623cea4abfddec6eb583985529fd5f3ac065d08b34a683f41a881932eb030d613b629c1294571ec3ca
-
SSDEEP
24576:66V6nC/AyqGizWCaFbyW+22gmTSSNR+2dN:66cNGizWCaFb822gONNRldN
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-08_9bf57d63052b2a30c327abe84aca7486_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-08_9bf57d63052b2a30c327abe84aca7486_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 9002⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD51b8aa3ce5ddc9f9ea99a4ba2fa6a7b3c
SHA164b421030270aa8feffccd789cab321f7dd0e54f
SHA256ac2990e5c20daf5f1f657c9e9746cbd4941cf0f4ae7fbb3ef8fdb156b8023f9f
SHA5129c143c01a08da49ae1d4c753b57debe55f3d4d9ba18245753885f052ca578db858a6a6924d56e208cc353972b65118d77b959f247d42112e0b94cc54ae35d158
-
Filesize
1.4MB
MD534b376ecf748aa4d036bd742cc9c07ba
SHA197d19f57e2ca740e2d4e0bc5fa46ef837a38fbe0
SHA2566e94286560b6f8face473b7c18174ec311d74e907d004c2aecec850b3ce2aa89
SHA5129d3054878c2c8ed466ccefe3e4845960fa5d5170ea57a4096ff39a3ce49c56901b86917420a8fc88ee8ccfb26a321a9be69e166ceec48a52d50141cf5711d6ff
-
Filesize
1.7MB
MD508d52ea7afa419ca69d792afad48002d
SHA1b6fdd696397b1880f5390bee74486b8089e5c52e
SHA2569a1a3c4a250f241e7a66e7b32954f1fd2c5e2538616858f5d3456e3ab8b3fef6
SHA512b2da496507c4c990c0e7aa7b4a7af6723082568689e8490bf1befffaa45d82b2cc03282ddc6149f82f8b61c08c64f01132368c024944f8dc9ba8d13b90e5866a
-
Filesize
1.5MB
MD54ce4be3481c8bf3fb8b74e919cb98aad
SHA10bc8d904afa285ccbfffc51479309d31dae5159c
SHA256ca3553eeeab57e2544a16adbf99be3079adf487a083acb3ef05f35a27b051657
SHA5121f61e4d7ed535f5ca31a02207b36f0074e60dc64f2b5c74680d20961871b1cbaf5551cf9b8890c56570bf8fcdfcb310174dfb481e9586fa30d6674307c5de73b
-
Filesize
1.2MB
MD5e01962ba9933eac4887fe747b0a37502
SHA1a923f0236131aa4f8429cb72e4a0ee0a194fbbd3
SHA25610be376680c1e325c76bf9aef0f9755f3f82173bb1dd02d6a7d618f86f7eb45b
SHA5121372f9d8521b8acf2b59a3378762a4d05fa05aa05ef0d42d37e33d44119809f32739d0e27594f0a7b479b7dad1fa58e1b4eb295035f5d453091a07f4bc2b2781
-
Filesize
1.2MB
MD55dfc2a6d2659437bfe3643f2c6089367
SHA1529f9bc307fcd3c2e7d200575e46f7ee93b9694a
SHA256aafbed233ce57cccdba27dc520e7e196697fbb98d2d91e1a604ae48b614826f8
SHA512095926af437065a87b49c7c067c708e3947d55c78b54d70df91fc23a5fe32f6d0cb7504b0cc1e266e078e24e24f9cb0119ab191e979bbe284dc6d7230db8a17f
-
Filesize
1.4MB
MD5bf226be367a4e286203ac6af4d023404
SHA1d2d0a5d1bb1ff0565eb0fb26b2b7b49546e6cdc0
SHA256a7ef99afcb6217cf75c59d65b5918b4304c222bfe7cf10f4d7bbff0889d6256e
SHA512bd1d11156bb7bcf0990d17c72e8ef92bdd2f5eb07087fd13cd90127f0d7ea55433aeeacbdc2102b5948e21c9f24a628ddf333e3f43abb30eb32262ec8722e068
-
Filesize
4.6MB
MD5b7dcc21991e5ad41f35c1a555f35ae6c
SHA1c9db9618a19f17d40f67b27892a7519eeb25dab8
SHA25671384c5ab7f233957649eff80ab045bea3b1d7023103764b863aea6b7efd23f5
SHA5128e37cbf08e7dfaf8414b38090b726c23f3235654ae0db2bf8a51d8acf9557b38db755adbab306f9327f479332a95c16b99d414837d6cd48b38f48ed197cd9e0e
-
Filesize
1.5MB
MD5b51a72a5487e5f14cfd5c50d1e5d7568
SHA10a4e329eb1a03e2245849716ca66fa76808d2a7a
SHA2563f14f7dc029d1858a76424ea44fc0cbea8e80e57b9b32d7ab91f86156f1c2a76
SHA5127abd3e915fff9e2c0ae796829ad619ad4fa58d7443aef28214b533086a56f18f74da15e6e4ebe4d2ca2be89dbfaf2593c124fd46810f760975fa670ec32235d6
-
Filesize
24.0MB
MD5619e852730aa0e960b7076750bb26d13
SHA11943f9dfeaf0e47ed7909801fae2e858108dfadb
SHA2561e6ffb8446201432bd03a2e9ab2cf808977f96aca7e0dfcbc1bd52903a596c68
SHA512c79d683c8686b352de455ba118b9352b3fa8dc6dd2b61edddd66f6285877b35c8435d4fb866219e3cabdff1f6effcad3e00f834abd59835637a51439818df068
-
Filesize
2.7MB
MD5cd91d2cc5fed32b5b867066589552da2
SHA1ef425fd0d4c5c0463dc36d9c235735abcff10593
SHA256cba281e301fe9b47a75a548ffb887dc23353677ed7706d247e48bff5e1a63a09
SHA512c993e0a9537776ff9d618d46897c949e241619c8d095d142bf1b803ef6147e51bdd5821061abd2df9c29198626f0888d0282caefd400f2839b16d804dc32b1fc
-
Filesize
1.1MB
MD53624ba6b35bd565ed5fdc45e7c2aa58a
SHA13f32d03eb3c110cf79df8bdb09747d0a77d0df8a
SHA256b24dd761e8bd8b237b9687f1e6dcc877e14942f4411058e00b7fd4578c4538e5
SHA5126da9174e9ed960f64cf28dc8fb909663227aa67a35cc7ff431c11f4005786b61648ea096ab328f4046260374ec7b7a709cd4e1218d74aaa902063583273f6b5a
-
Filesize
1.4MB
MD511141af8afb88bfe6afa091819bbb114
SHA194e9cbec27bc3e9d66fbb437eb0eb9d2e335f5ed
SHA256a06e6b7ea60b4ea45a466de92115d4a38f67e0819c4bb9f4692da1b85ca30e80
SHA512bf34033af4d9b1997992d55657d7758abd6c276f403e7a63c06294f74ba425e263522f3097c0196b8d6cc4000da860c23d05ad957874c81effed731c5a76e7b7
-
Filesize
1.3MB
MD566e9a194951de29baeeb42cc42370821
SHA11b2cacd7f103469e9d3e043667e83b243398dcc1
SHA256af216f7b3427f28342dc3dc9429587653fe631016b19e24789ed574514b33c30
SHA512352f3f15f4ba12be1d4181bb1064561e2180ddc0b1caa3c7e2261b62d9080ee51266759fc6680c5710a48388b6efecfbda44ca6cb32f344c25776cf8eaef4a50
-
Filesize
5.4MB
MD5dbcc230c344c2c245b87c7f94dfc5e1e
SHA1e0a067b7e87ea1b398c40607f7ced60ba11d681b
SHA256864081d6e4361ff02f028b0820191a002f662fa82a4c7398e3c8cbce20af92f2
SHA51293a25acb41c9315b4ca3e788eb3fea345a7220eee4c3153200f2f6b6ed5929e1c300c94f31b9dd4e8060d11ce29ce53f9213c5b036f1bcdc6378c4378ba36840
-
Filesize
5.4MB
MD59dcef32d156c2f7693a2f41756242ea4
SHA11664f5ad32827ab2c56424a7eb6b7da175a59748
SHA256b6fff5631598df832a2ab17c4701b9c90e66331283600efce8046a6821cd505e
SHA512ca57ecc3166e2ff16d2842bbb091da2db26995f1ed94ca8c327628c14ca6d73023fbbb367a4e4704555759241c6ca8c0dfbb07c42038b27c81dc4f7682a754b8
-
Filesize
2.0MB
MD58267c87b81fa02109c5cebd501028880
SHA19967f60ea1753efac992435f58152b297305596b
SHA256ffc2495ea76b05df7828d342d7e6ac2354e6a5df627bfa52f7fcd1ef4d5a8bc5
SHA5127846f78c37bd2413182fb6a1e0a915217ced36fce10f5f35701d4cb28ec3734dafd78a86045429f1ef676a196b381ec86c04d154bcbd3a770c0d0d44ac4f80ba
-
Filesize
2.2MB
MD5fd93aadde16e0230afae579e409e8ba6
SHA16d67e84b3db1019df5b47ec7c23b3920539dd0bd
SHA256b59db27894d69a3da91844843d6d1384139d348b58b44f00c0a6bdbeaae2a09b
SHA512635bc44f0240cc4214ec07a4d50cd65ea7995046c996a269e7da51f57fb272edb09346e1b10e180fcabf200c6397cb844ef4025a037a486852ecc6c3523e3c8f
-
Filesize
1.8MB
MD538d79397eb546e36037dfb97efb75b4a
SHA1fc0ef813b4e75e1e7733da9fea46ed00360c9a52
SHA256a3ec392486c493b3fab51af1c9ab73f3be95b0cd375df98a815c1eb68c82b41b
SHA51293d9c7140886a1c833e8ad9aaf358ab2eec1710101de38a94bf5aa747670e79c82c8b7c1f44a6bd478fd766903f528020fbb2a686db63bb3fb8d8c4d121ab1a6
-
Filesize
1.7MB
MD53eec62919f61a0fbf04612facdafb430
SHA171e00f0c5cd33fba2e7e55e496b5c4667461a935
SHA256f3326a3ba08ef91cdbe22da5fa7b8d3b54831c07663c59c52f46eb5a4d5eb5dd
SHA512adb038290afe4ee4ab057e135c6e02e38a9bcb0b17484efefb9e9d7659ed8c5a197963c36806f8a1e7c6acd793ba4b78923381cadc3ba137e497cb9aaf97eaee
-
Filesize
1.2MB
MD55f46b69112b0a7c4c173ab0951f76ba2
SHA1c39baf13cadb962bffbbd715442c6df618cf0353
SHA2565358ec9b1b37132f6a5147832d6ef2701e73c3a48982e230a9601ef3d609163c
SHA512056a688a2c972a63785c7343156f414362c560baee87f0b1b7b734678513134186410fd6c4b1b3a24e2d0bcfdf82e7aa2b8aa31e8d1ccd8a455b5cba70536b78
-
Filesize
1.2MB
MD5d115ea6213c93576da9ddb05953b89a1
SHA1eaabaf7ca0180f4c72447112b74869dee2373635
SHA2560c0c3203c4cf479a90b77ce7f334cf2e151b3efcd1d371ad67afb7529997d1d9
SHA51211cd72a30b6e0d9313036c7dea7b1890b278682d31f896261a8662144b6a80eb21d81be3bdb47b8d5df0c5e7e365cdb84affaeda322af17c2ba1ee5bd1971767
-
Filesize
1.2MB
MD5a44d0cebf4a819862ccd9727fdfc91dc
SHA1f3f171fec6bff2bc499089660895f47bc3cef7f4
SHA2562a1d29f31645cfb422829c168dd8c6137e592dc3a8e9cf54c8ebdf9d5dbe7f4c
SHA5122a5b7e2c1132362d8260334c3383aacd9a0de1db9d68c16cd27540ecf1faef634f82220d624ff66356f4659defe3c106d8a5528ce44f258baf14897003b71b6b
-
Filesize
1.2MB
MD507fc43a3ce05ba2095dfd7237a27e260
SHA12520b92c2bf021dfb670b53511d6640549607544
SHA25607373cb5c74588e2dbfc59d19636df34c1d8174add2425f49dbc270f2e6aa96b
SHA51277bdd5b876035afc8fe630f90a220b8fdbd9f17fa138d6faba0f2ad41961f440deddb0fb7ca2a79766b5c478b0f55882503a00faa6b881b9b14b2053349b90bd
-
Filesize
1.2MB
MD547b5ffe8e0c3462eb5f8fd79f2b13349
SHA199353488919a8b8e3ebe222b8d44f11d79cd4b98
SHA2562b48fde4a6d0066c75563197ec5a828e2f5c7b1bb206c516e97607e734be1730
SHA512d561066af17baac968517a321a98c8f7ff535a57f46fc5e3e41526449c9806a6def5bd124f06616092edbbc0fe04f047bc12b3a545b923d092a4055eff5c6a6a
-
Filesize
1.2MB
MD56ccf2556bd8de3b37c1fb5a765b68c90
SHA145dce46fb5833cae39bd1051675fda5f43d85fb5
SHA256f936712d0ddb9f3f09ba458676ab84ab951ca0c1d6713820c27033135fe5a6b7
SHA512cf127f4bdea510c9b03439d19d8023750ee89b11cd54bcd919fa8fedbc423e5535534675179da8e5044cfc5c1303378cb2a17b40587087df92d1502c5d2f2a62
-
Filesize
1.2MB
MD554d87ad90bd3d2be5f913669e9381f1d
SHA183d299bf46ef31081d92d71b1e2ca9fccb15bdfe
SHA256350ae6d8221c5da086a1e25ff5bca821e45c30a49c9119c3a4eb92ba65a443dd
SHA512cef771f4253fb1482dcbae3f95ea30335936c7acccbeaa6bfb2e739e499772c956da7a16aea822db414e581f12319bf97f39a3c1fa71135d79df8c020eda4f40
-
Filesize
1.4MB
MD557d2dc86396339bc43e571da2fdbb5ba
SHA16e96a765dac7a5fd864952552c728f2b7ed892df
SHA256f1a20e28b98383b22e89fc2069238da2ae02e7e222f6a3c854817d6795dc0aed
SHA51210c78634cbea80c10b74976964e1026c05f3435302a886c56605cd9db306744f697b1eba195368e7ee37ea742542e0a79885cedf284d48542886ddc99e950d50
-
Filesize
1.2MB
MD5f5bb51e2891988adb046d6accb44cce2
SHA15190860f61d81efb63602d64e603ef59bdf6005d
SHA25690b10df73ca72d34308fa7dd53c1708c40389a3e1aa8174ac1e1af96657d204b
SHA512d0187dbcaea307d19d38e392e8d251dedcba25c48b4bc3f04bed5af1880c6e6ce73a7f5bf2e842292f37a1efe068f749a16d88b11f5240dc954bc0d10af259f6
-
Filesize
1.2MB
MD5e8b3fca142e2f44c13c22bcee225f2d9
SHA18d1b6ae5f81106c950e207d1e7e6b722d38f4b93
SHA256cc11ac0489585a61963b9566d6bcf61f23e61db37f1402eacf22fb00e7b0486b
SHA5120764a0436ae242cb6da58f8e0aecdbcec8860207be5fd764ebc574aab140598c95e183d30f70b6a658ebc84720abcfbe7a2a33739554a36c3dcbef0220f72e97
-
Filesize
1.3MB
MD5ee9f6954b37dec2240a1069032a1a4d4
SHA113ee15bdb97ff86ac675699faeb90d1fff1e391a
SHA25649b5ba7975766e496fb404a86bbf7aa8aea489d8fef9121d78dc392bbb994599
SHA51286da2d4c9c6500a71eb8b4b08c019e1f2c8ca876cdac335b566446c77acaada9bdb3f2e03c07536d7dc34d996e23871581cc77e856169d381915fd2371644e83
-
Filesize
1.2MB
MD5b331b568f579c5db3cd81763a7254dee
SHA14ca885028fcdf726d25b57f045144ae31d4c1f37
SHA256a6d3d6aee1d181599a1c2328827972511fb34a643b8a8576d44409aa19133bbe
SHA512c80213f25f83182c2bed5749cb211714a6e50eca67d0b35bc2c0370629dcb45fdd56951b79d1b114c338f1c5ca3e111511b314c1190c29d8c0a17d2f666ddba9
-
Filesize
1.2MB
MD5a64c0b3d7ec973abd7031fcc75650f10
SHA1aadbcbd80bf8605787f56a6d3f71ea77d2a30f5f
SHA25670378347af9480f1d04c5b6eb143d1d33bd7a3d69944af4867f29b3089b656b3
SHA51247f6dcd71725d30a2fbef77658bcdac05e641777f6ab61c544b5ef87e44bbf57260fefafafd2377b4625e629e1a778cfec7cce698f6f82828782bf02fcad5bfe
-
Filesize
1.3MB
MD51e31b01f708539fc0c029dd4e4535fe6
SHA19333dbecab4c74717c54fa73a8e197dc36ee915f
SHA2560a40281111392f3d7cbf8e0c79cffdbcecee64633772b48b19a5c5f994b21bc7
SHA51274e913decca7016b492ffcf1868112918a378a97bcc064ca71f67e2b2e7a1dc69073410b86142eed1e9e718f081cb280e6f711b675ebad953e14954c549d36bb
-
Filesize
1.4MB
MD57120e14ab70ba73ac3677d3399022d8b
SHA12b7f8ab41d0ba6a9d0c79f97edf5506e3fe854f0
SHA256569f7b1099ff6e7081815068cd68b569c8e99cc08e7c911bb1637de4d23ffe92
SHA5129657648eae4504954c0261e0e7893fb7776790935ae050dd13b5e7ada9a667ca7855ed0bdec9017084ec19ab17d9a2fc07c50f102e233d99ea2a377852caaa05
-
Filesize
1.6MB
MD530b9ab802f6f262101b0990d918e432a
SHA178f94148d40026d2eedd67128c3166946cab5952
SHA2567f91aa92743e5351ff5d7a72d0c965c445f452f985baea316c445403b498aeeb
SHA512bff29b2fd8090eeb2c58a6fbba9acdbed1ebbaa800f08cb106da40bb0c6cfb28afcf4d369e89b235910338b6c8d648f217aa0a9149c9bd6ebcfd77afcdf3568e
-
Filesize
1.2MB
MD5f61d34c10e129561cb4e045c4edfc7a8
SHA12f198504fa68a41b9b302e2f6a6a9cd05901dcf3
SHA256c8e777e37079b2f3f17ccac136b80a8d42f097bcd180a80de8c160b76998cb4a
SHA51288d10634bb448b0932bceb4eb7b9888b432f84868d2cfdf3454f59ae6e7278f335e932c66796c7ada06d0587b68deb166e4b2d7729127c1ad7cb757c86e1f38a
-
Filesize
1.2MB
MD5b12e3aee14563e0fa3d192ed5cd4f597
SHA1f282c2f749fbf11f19257baceba02f749424c921
SHA2567b03bfff9cacad0c7a9598e356386bfa63374cd1fffdfb3c6d7eab55d9088759
SHA512d25c803dffda06c76f0047c4b9a11d78e2c14c86241f58a0abce5a6844425f2a5efba2f54aa5eacbfbce4c22e445f6916db4c14a023574ef0e7e120fbbbfe2bd
-
Filesize
1.2MB
MD59997eb4d4fd0fa2852d7b32de44e644a
SHA13df2187476c88cee1f3f3e0aa8b23e22b913ab43
SHA2565ad5d11205585ab8380961a0872ef98252deacd85220bb4193fdc54c25ac344d
SHA512e803bd0ea0e3a72ad063d5854f8443a0d29145243f95eb50c5326b0b09db5f24bb9ba11064b23b99017d189bb010f7b30e28d420be75a9e2c2d2acd3ba409134
-
Filesize
1.2MB
MD5f8a8c60ba62cc2c2e02cd9c44c3e2637
SHA16168b0d931fb4b8cc3e1ed360699efb25e15f42b
SHA256134dd7b788e1c3541c2bae34adb2d7f131befc155387bdc736df898d18733df3
SHA51227871e55c77ecb838f7348cc7e16dc5d4f75336c28d82ccb66b108e584cad00816f3919b2e1508e518e71cb4b2095050336ce547ac257c514471e2c397f2610b
-
Filesize
1.2MB
MD5966d90b2f34fc9bf1d1860d0d183f361
SHA131c21f47b6c07e22a7e7f010a6f9d8cd9271ee33
SHA2563a86f38878a1746ce33d35ca605c3735636545a76d92e23a8bad13e9dcf45086
SHA51209b7269d256c007ed01bd90db729165eb0ba008d27a37a959bc47242f9190c8628e7d5128bad260f41c1b4dcb874361d1c1af221c5914d40dc6a16d8d16200a8
-
Filesize
1.2MB
MD579b85d5c2da050a8c9491d39499171e7
SHA192bd7176b9c7f42e241a08223c8f6389bf493c4f
SHA256f0d2bd9e60eaa105f6e0ae34daa40a4f4fcd408467c64ab0dc77003686446cbe
SHA5128c3da905aa1c91e6501e4901a1cc842800440517191ac16ec86c3b5d8c301e29af11ed187d6655763901c9ce8e29c739c52e6270f560b6e278d2e8c54c2c89dd
-
Filesize
1.2MB
MD5221cd65c46bf8b5505f807e21229a14c
SHA1efccc086af7663e03fa3aad2309cedb9648e6056
SHA256d8719e3614fd3fe6aff5f8c924f42180b57ffde79e65522bac06f7f4a648062e
SHA51286f2b2f7cf039df3bb01e40d3105142ef2d97556da29a312142e3c73804f4cce596aa5b80bb418de4c632817ac3c06c0a8977d1301736e88b8f5c43e7d4bea28
-
Filesize
1.3MB
MD567b297cc15d1fb13ad231aeaa65a69e5
SHA16d14ec806c3364ab0e6ef31dbde9b301b72c009a
SHA256cfd560c4a66c19536340b63b55945b62e595acf0911661c62f5a3d838225d595
SHA512764ec762cc1147cdff37a5d234c03ff2e663a58b3746b9129827da778d1762eefc2193bfe13fab68ee1310f6bc669c95718686e691d770417b16fac8306b64cc
-
Filesize
1.2MB
MD535685a522356cc65c80f327e9079cd13
SHA1bd002a1f7915bab020682d24380f962c09c28cc1
SHA256d078a10c31e211ae66471bc98928e668d499223039897e2defa99e6caed00d20
SHA5120b60c547e7f10c7769575cd01c4d14621ec2f266385d104c91c1c90fa7fed54166e50af68ad8ac22483fba2e144969256751f9f29c147113004754568a013dc7
-
Filesize
1.7MB
MD5ca4165c3e11ef65e8ebba939d9aa0c1f
SHA1a48824619bd8de10a18e9e1b254a1f1fb24fe413
SHA256b2c0936e29f395626c1eb9d59c8cb759cae29aa5d0087cb0e898b8f82c50f4fa
SHA5128bd435f0465566b3de95dc9ad01cf9a0eb0f3372a701fbf6f170a808f91682eb90171f534e41acb591c79fdb10dd6bc55d951d9aefc6742c2ddb51b4ad5a3b6b
-
Filesize
1.3MB
MD5d955be713c1cac3c3a53728dfba35617
SHA190814ae9a0ba610fd5bdb91dca8a24da1348a38f
SHA25617b6621c38821059a72fe5346db100477254b3583be01a86b2d5e7b2b9cb10eb
SHA51230d085765b23fdd739a266a3696ec55f2f4159856f71526bac0cf24ec0cfbfbc29879712426c258880bf094844fed3a6f5a777dd21c6aef856893a5b7b9c0f4a
-
Filesize
1.2MB
MD55380e8e814eb64247f938bc54125aa44
SHA1edc739754b4b776f93a0e2e1d6757e343af681e7
SHA256f80207d483e3a1d16f29a4fbc63f656619117ff6bd7f0d261525779721a5c434
SHA512552bbfdeb9c6c0cfd78faf37da18ce57b59321bcb717f62ad9c394e6e06b735fa6f70689b7ce12b1c204f808bf55b892d41d19c73182a25c004922e2dde6ae5c
-
Filesize
1.2MB
MD54f8023b525b21b1eb6ea6f24af3e1590
SHA15fad621fd1a6d8e94ba0dd2b8be32764d3dabc1f
SHA25633ed1575e9b97d6a3a8b6e27cf81183ad7bcb212776c449d20cfdf0febe124d2
SHA51272bb2cf630a30363ae2700052a0ede7b448d6d72c0121c7a1a646fa172816d3823489156cfce8028a8d53877e52db1bb9e5995588480dac4f17c66a46ba3e1a3
-
Filesize
1.5MB
MD53a59fe6cd11031fadcce796e313d40d3
SHA1aa45b68c5fcf10aa68d1970a4d11ec0c9ad13fd0
SHA25614c3f9b930a11ce772855f0304a8029584dbcacec1b48f35c45a92c7e5234407
SHA512b8044f386aef6fb101ea385f07786cee3d96735aa425d8f49d524a74f1a4cad7d9a5b9de048f0a8f9bb6473cde0aa41fa031b8c7d5cabed71ce5e2acf0f57824
-
Filesize
1.3MB
MD546115c4eeb9b9b61923d52c32d0f5020
SHA12e637e017758e014abb08f4e96663c34bf88afcf
SHA25678123d9e78f20d26618eb0dd929366e4ce0773914f84f401945a4e7e750bade8
SHA512439cfabd2dd0ce09ca630524e6915f5aa0caa16c8666d734e60a49490a0ac28279e0719672012b78b793dedaeca32df5e28324b93c8646a4472de62e86a0cefc
-
Filesize
1.4MB
MD5a5c207e79b0e3d0d2265e996276153db
SHA1701c2b5a1035d8a1922ec9128e22d658e9cfac12
SHA25677596035767bae7e202861c1f0231c044ae5ad0d2c68d5e506d02bcc19c6fb01
SHA5125e29947df8412af258b6ba49eefe82ffbe578603f2ffd46c3259129e46d8d10f7b30eb4064c66c5f4eb20366911df6e3cfac3bbf43905f83e929285a7ee91d10
-
Filesize
1.8MB
MD5f320eace575b7acef375799600555a8e
SHA15555a9575126efe996713cdcbfc22342450aa638
SHA256868a5ba5ce760c1f94791f1bf03a45f514b4388ffef2519bb02a762170487054
SHA5123c2290b4b0775dc98d7cefa3978bb63dba665da01441083bfd83fb5b23c566b2ca32b8b6f27f118c79d3a89a923369e160887e76d0c091d54a92c917267c45db
-
Filesize
1.4MB
MD59245f0bd5de7641d69557b6dc5f63663
SHA17e7d16cc663653e6db381d6c67c20b302697a9e3
SHA2564d7dbcd96b57450ec8d66792f714bfc6be41115d53dada936e8877e59b646943
SHA51279505ec3ecdef67e0c1b6b48819955ceff1d91a894d911ad2f3f36b27b53a4920a48d65154bf707590636db8217f579e3e06321baa93bed7e5d8375847c89b6a
-
Filesize
1.5MB
MD5e54305c943bfc5e5b260186c86e3a296
SHA14e9678073aec08d28ddabd94726c07137ec1749c
SHA256b8abec47568876544028d51cf9d13d1758c904a5dc3544eb7d8d9d5fe74405b2
SHA5129da358ca8de21c853d4e67f9a6fc639224f9a3d9ba71db994f8fc33eb3c9d1027ea7c3e986b528eaca2a1027576cfae902e174a0b194a3e24d907a5a596dab9e
-
Filesize
2.0MB
MD5c478d32e0c2289bb02b498390d2443ac
SHA1804ea7114fc18b3286e30cb56855420e68ac5d89
SHA256d49f7c3cbb5097c90e7fb4bae99677a4c562d51f051ea5f999b247c0b757c52a
SHA512e52e50d234bd514081ec9217ff3f5a4d3cd2f513d0af4036adeafaaecd667bdc43cf8cc6cec7389952bab352093a0ed43e50397ad2ff0adab4d49ee5af94abaf
-
Filesize
1.3MB
MD54c14cc8b9a5bedd7ee30f23dc4b83a4c
SHA18ce59ad70c108a087f98c3155b26f5db190a0a6a
SHA2564e161b1f59189fe3a03433ac7744b991e883e18506d93fa4f31f34e9404d4206
SHA512d3b4ceacdefbabbb47ecde13ba7f3a5566d83bb5ed6209b35423e26de24f57fac91abf1c087b27bef9b8cf888e092cc371021581a657754e800d6badf08cbcf6
-
Filesize
1.3MB
MD5d8eb23a8abf412c69daf72904c3037fb
SHA1a204eb32c338c0fba704ad4b51ea1414ec202ef5
SHA256d0e04653096c22ba2cc0e03d6243604686037380364cc9ec80fa743389662136
SHA512a7304b9259800ce6d0f57300ecc25462c8d782833840fd1716676dad0b64533ca267b76f0c0b91f36821d6cb673b6708c71d03632f99af8fa770f9192872264f
-
Filesize
1.2MB
MD57d95c8a740192491993f9455949cc5ab
SHA1aaa7cbb7c06295f5f436d19ead0891aab397540a
SHA256cb378faa76443ba0018453508f5b94dd5fadbe1377ab60bebc88e4f05d16696b
SHA5128fe1e755267f487813130febb26f58c19e5cecf548ca68991a0ab8663431be466e1be366a3947dcb1f0da240d4a5d9a8f7309d71085cb6ae19ccd2ec8f8de9b3
-
Filesize
1.3MB
MD555334051b1ceb42e5ea3c774741e1fe6
SHA1108a9e2451a5280cb18c885bf5e40e072483ba4d
SHA256cfff18665bb67666afec64748bb33dc9830c6734a1bb9893a3f13e048002b024
SHA512f2355ee5e8b82baf67e2e58cec0c56f429536e57ef27a118d58b57a9734d22fcaff6a2b171af04dde77495c63d7aecc8dee2b798d03484a73d9ad5fdfdcb5d81
-
Filesize
1.4MB
MD5589e17767c37a4ce40ecc6558f77308e
SHA11c2973bc71e70d3e3eef78765c1bfa0931a9641d
SHA256c8193892e649f82e5e70d167c1ec813d6e055b3a265de5fc4a33742b1854632e
SHA512de5f3ff0421d9b109de02e7701f0691cfa7292718748fd56a46837acb4a83291b680116caf680e96ebbc16a6ad5304317daf4499460ef4b39ea08c3e31e43408
-
Filesize
2.1MB
MD58b715c15794d2a292f8251075112b147
SHA1d4d284689afe1d626f758e8343637e31891cba95
SHA256ba364944a025a12cb96a513cf008964de10514723ab9d7abf2b66f25c0157429
SHA512caea4a0cbcb883ab1c689dbfdb15b0dda4cc28ad4149039aeaedce30be499b66b277c7702959ebd1bb9d22fa62071de2832926f9b1c7559bb0d2e2cb5f89ff38
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.3MB
-
Filesize
1.3MB