Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
21-05-2024 16:31
General
-
Target
2024-05-21_1cf791df36bbf686b8130cd9b73e6621_ryuk.exe
-
Size
2.2MB
-
MD5
1cf791df36bbf686b8130cd9b73e6621
-
SHA1
85cc65c0e5bbd0a608b504d77496026e3d998112
-
SHA256
172b77123de36721e8b15e6d656a57b114e88b920e3e399e8d8b94a584fc65d2
-
SHA512
0305d51a7994658d0a35627ad17930bb1aad802798a364ab2f73169f5dbd0969f32366b09c22dcb9c4e03edeb433c49e2224f80f571077cb204eb85509a59722
-
SSDEEP
49152:pNl7soq7sQCr1kyG2xHywRfHIO2Ts4bvDs9RoUSVqSY9:ZD23S1kaxp9qszS
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_1cf791df36bbf686b8130cd9b73e6621_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_1cf791df36bbf686b8130cd9b73e6621_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5cc195472913ab49d12e8fd85907ead7a
SHA13c92b78555e611246e78fa9b67d8ba19c36c0986
SHA2568813c2c4842337692cfe1a99be021e76349390a4c88fa368a43f33bc4e46047c
SHA5121f2c9ad7d8e46fc815f89eca35a99a7c8833dbd63e00271ebfe15d15943b51e6237ec3fd19554a936b9a30e11b3df8498bd6b2f5381405a2ce404a16d5e00503
-
Filesize
1.4MB
MD54c7aecac2817a9754b412ede22074a64
SHA18b7ec3416bcf285073c3c7e508ddae90a1ff4620
SHA25689e2856085501ee54da0833cc0318e0f6b6ed21684f51e9f70368940cd67e5d8
SHA51268615501c4c2920be698b22c39befa59d6fe4ca0e5637f61884d0167b6539e732542ca4a35b321f1d424dc0136e8b26d303f63ee0bd440fecc06fb8eb9d27352
-
Filesize
1.7MB
MD5629e1a4387d2afbd6bfc086786cc25e3
SHA1a2bcf2a9ec2968f1b65881bdcaadf412452e5c97
SHA256d56c66ba023a8ac77cf19d5cd6b34bd01804867cc3ee096fc5e7d6d4ce44e0ec
SHA512275103c97c1db8d6e5fd27604ed67c5cc10ce35b665283f187b66db4ba133048de16f4f81b5e89643035cc38f32be8bbfceeeed3c2476dca116de2bdcf10ff15
-
Filesize
1.5MB
MD5a5383b693d6fa645e54d3c3d1243f506
SHA1705847bed917f917f2c3b5c0303cd6f4ff5378e0
SHA2565fb5d5ba14c315298485b61bc9adda5517160d0a802ac8eeee3434016d164128
SHA51258eab7ff8383e40bca6e20d68c5479fcea437b7574768027f88bfb0336a4f0e308f3e247036ce477c838aff53562c2edb088327fa818bb46a9d5c61b458d12c2
-
Filesize
1.2MB
MD58f0074dec0bbcaf6312878f9687b9908
SHA1ff00c861d9a74c06186201139d9f30740aa5023e
SHA256d651eaf3f71186fa278ba3fa9f19a78c272d42ee20744636008cf4bb490a84dd
SHA5125309aa6dfcdf7185ce380438a093c583af89186876da2c21498adb036da6147fa934285ce6e1e9ec291fa25a7042c77508314c174f203b43ca79c5d60229941d
-
Filesize
1.2MB
MD58e6cbf677754f80596b278a799173bf1
SHA1ba2603c116c643a2f9fc0c8a33a2d26d4ebb5393
SHA256cae5234f7449348fa01b47bf64ac321aeb177c30cc3442d58e9364648f3eb177
SHA512faa55a29842ef5c95dd0d6f09e376e42cea185b662e6a6d14a62fa32ce0f77a06dc7491bc8c75134ac167faeec013bf657ba062889b45ea214c05dec65eb6c62
-
Filesize
1.4MB
MD555b06ebd8ea7398803bf91bfb8236314
SHA139b27535bbbcebf9bd7f6f3508f26555d6679ae2
SHA256c1ec998a6622ec271821a4c299d92314a9a3321803668be315329f6cddaaee49
SHA512bbca88bde32401b0503052d0fdf050370ddab105e25fab2a7cac39dc445fd3ef914c82241c1c6dfed63b2ae7fa5e1a15efbfa9b159d92310b1b41de91066b0f8
-
Filesize
4.6MB
MD56e7a23674839137bef090e052d80e546
SHA1d913fc174feb23df43abbd6dd58ebe2c09fa49ac
SHA256556e31e2cf755af8218c7634bd970c5963145c47e7742c0576b6618484beb3f3
SHA5122d247f543c74ba190b0d16591e4156182fc9c25ee38a642583fdb7e772f93854fd551edff633a0c734531ea8fe88ab0b0384ef66c9bb8005ab6e641d712a1a10
-
Filesize
1.5MB
MD5a918a4243c937928e5996e9b7313245f
SHA15f1a3778233c1d2924c6bd86be4c3b387aa44085
SHA2563e028433d049988c481ade0126471b6e448e51ea473ba85d94833cec3ff50f7f
SHA5126efc4e7826ead7069e0cf924b6173aad21d29992abb8a2794b5f861d75cf531073d9cbe1edbe37a95955dd4f8cce327760604d861ae9d17da00f26ee25cbb458
-
Filesize
24.0MB
MD59424bf1320f575064af0c7bc01d27f92
SHA1258fe88de0987b675f3d91fb26f0dabc5a334d02
SHA256c208e5440bbf91a4acc5bb498f32a53622735f690cee904e2b7dd0476bfe5fed
SHA5125387c222c8bebe42d22607c6066836d398a33ffd4f882ce08f79efe812b6edfa9d8d47cf4ef1039cd47eba163332e298c43dfbc5ddf60f87cdc8d5ecc5f8b080
-
Filesize
2.7MB
MD54d194b00ce162545b9590bd62fe54f19
SHA13b2279fefe89e55103a8ecc98667312e905f3018
SHA2567ee7a0908b191b609bcea74ba6d96973017c3df1b91a0a1f8d320f42183811b6
SHA512f2738666eedbd5a20100cf1e24760cfad03981a0af7c53d2b92d7f095a646c8ae38c720429ed1e995d33d735a4c213b6817224fe873e5c16357ce36f0af6532d
-
Filesize
1.1MB
MD5b0f9fdcd15de8b2069b8d98e590e0202
SHA1a2e7d18177451ad96698ff18dd70e2cec3d9c7e9
SHA25605d12ab20bf744cd616a619b3ffe1bed82c483e08b3270cc92abd0d9ec5d3801
SHA51203029266ddf8b2f3c4ff4a8e4436873de8be21bfdbc735a33df5bbfeb4faa06024ab9c2ad15375ddedacb95734d05a43425db417f6f975a8f7f1f1220873595e
-
Filesize
1.4MB
MD50998364fe19e6a4d3042cc67708ef703
SHA10a045f0b026197c4d7f00d5070ef3af51f776625
SHA256ec799ec7baac040bb36277ff23606ed6dbf8efd2feecf29b69b1695a779d5159
SHA512a9dbf1486af222fa75d289fd88f0449137f2b3664e71a6d0e6425c4737064ad5a14fcb01929054a7ad5957c350538c0f4baa0fa707405ec83a6f79ed9d31a1b3
-
Filesize
1.3MB
MD5e666bed91f5430fc10034534b5ecac52
SHA1edce7500baa1fdf8c0074fdad1ade44997af20c3
SHA25695c3fc4a44a55fb3fc4a6a9d3b628186d6d77db98fd790a7e87c904063d3a95a
SHA512d9074345bb61860452af0c036bf16e69dff3c9320b6da5cee9aad58c72aa145e184427c8d2b366a442b610413aea3acfb999f41becc223b377d4f4197d7c4116
-
Filesize
5.4MB
MD57d4d91b811db6c51c1827d40f516a818
SHA185f4aa0d5ebbc4dd17480dbda521958bf26cf8cb
SHA256ed2aa6ebedf3289f16064d258b2f6ee2d402ef868686e004ae9b350485622327
SHA5125071a41c8e9fdbe58461e4180a1b376651e0cf6047a5813328bb109a3fbb895f3a2712e097b688438f5fccc55ddeb8d090c26efaaf51c7a25930da7f937ec50b
-
Filesize
5.4MB
MD5b3042f75b02496b3ab907f86e120a194
SHA1111434cc912ea9a01db1f27fbb8f7189125ca3b9
SHA256d2835f8e16f6ea61020afd431db425a8f053fdf9fe8594d4bf037ad35a949abd
SHA5122a940eeea5a0ab0e8cb3edb526166d9972d08a317027f0f39d4f03dd58687a50f6c973b5f34151b9f9b2870bf6acf4a29c78eed37f95faae4b32dbe3ea968f30
-
Filesize
2.0MB
MD5d8a704b2e88d9c4059e57b9754e05693
SHA1fa08982d4867cc691e8b01e6f702fdb41e608e11
SHA2564221da8dc8104c172a66ef16f901fbd198f67380f3d47f7f3c06c23475900f98
SHA512fbd33561ba6f2a7e23b820669ed368a559d77fe0bfffce0114e6e44af1dc3bf09cfd73a94ffe3ce96566354f45e81f2efa4266a642fde6c95bc0ed3b4b506786
-
Filesize
2.2MB
MD58efcd38885cb7b8b4709ed167825e439
SHA11770781f39d16e3091ecc33ac29dfe60442e4dad
SHA25630ff5bc3e8f0c796b2982a2ddb452c6db58eac1e0688e92b87179532624a8edc
SHA5126883037c62d33f2cf105aa45a74164e3bce3c85e1be6737957508b32861b77e2b7439e45cca414153bffe6be614bd903ca2e2f9467a439df30a1362b76fed18f
-
Filesize
1.8MB
MD546ae02c0e67874edd4b1fe64070626d5
SHA1bdcd20208479e501c44c608d5d2a86f8f4430a13
SHA256a4fe3d68d1d3164555b2adcec4e0b87e4347cdc49cd7e6f25c53f028504444b0
SHA512c1c4918c955bb8165ebdeca99b3bdf3f802967204350791bbdb3ebd32811b2b2c1899ffd90872292f2a17b583b019112287eca4ad382f182b839f2a6f641d52e
-
Filesize
1.7MB
MD5c4b578cbe69a74e0f19d4e658760a764
SHA164f6ad561c40a07d048a20b522c5d25d07d67058
SHA2569c91c0e9d4b5ce3d8bd21251e20393e1acdc3d65b11587dc5696889ac1c27132
SHA51233bdad5dfb9100d9cd33cae67bc23b26c2ac2669c8e8addc697e78743971916755c9a705e49afa69830d32fea39eb8a9594f03c62ca093cadd2c4c173b90b939
-
Filesize
1.2MB
MD538480cc7b011eb83527014e16a630947
SHA1f946b802f4f3f74b748c255e8214a8b8b6432c67
SHA25678b04cb21febc9e546927a91e595004d32d62e3be95903469a75e91c75176624
SHA512a5efb84bacbfe564ecc31db57dcf50bcc3bbf8fd5bc78f45e1d2c8e1a482e7c31fd5442a985395a2dc24e943e4a886a39a93532c7dcf2cdbb70e562ab75fa7ca
-
Filesize
1.2MB
MD5e055bdc617fbdd971cc9d63f5da60232
SHA1aecd26d18a20dabbb18b447a7e8990db03b535e1
SHA256baefb7d540d16200aeae211ed853148d05f0eabbfe44d689a3ffa119d23f99ce
SHA512b1b3f24f58401a49bdf4f298e614b7742aa97d520c3f556536a92a295e42fdc77ce82ddbdff49ff7eeba6491b79ff3085258d3f1cd8d9bcc1d04a02495d4c8f2
-
Filesize
1.2MB
MD5fbcd8ee8102318a64e3eeb6d38d399d1
SHA18843dfb39ad9940435db463336d440421af13a5a
SHA256e9403304e4bd0ab1d1f3600c8e5512e965a46eed51d233bda0f23fe7143787d6
SHA5126c1976c5a1fe344f712f5bdcb473d3f8a17dc7116efe146dd4b6891818af36b960ecad0258695b9a9106301897c6c3060858bdef1350838fca4c29802f77f618
-
Filesize
1.2MB
MD5b32e00cb7562eef88fdbb2beb45e47a7
SHA1e4145dc05a2d56f72ff692ac6d854be5065304ce
SHA256c88291b75832aac22972471aad3405a367dcd66050df7a2e57613ce877eba073
SHA512dee56cf2a94d8d6ac2aab5cc489f829b7c03bb31bc04781121c4e783cf62f64d97e5597ce468fff74b3528e1f924d32b4af665294796700f7a72e9d059902354
-
Filesize
1.2MB
MD5d37e3cb7b0c2b74f486258acf0dc349b
SHA19a78bb96b3532e91377b8363f04224f3a362ef07
SHA256ead26002a19ae11157414213131d4f5dca6bca8c886d84454ab45721ab3e90dc
SHA512123e148ed402f931bec1dd8c921f9ac505cb645af8d3e20c9f233158b94778da0b346cbc3b12ff28a2e9071187d03cd917a74ef63397c806b2cc497ad22b1211
-
Filesize
1.2MB
MD5b13c27396ac5802df85641c9d4ee5f96
SHA1efdf6e0b7140c59458a082a0d534cea58d0847a4
SHA2561ac14cd8d00243f031ace37e7e5fca1d1f3f568b434a3f9822f69a57dea5e370
SHA512e9a2a01a999ada9030b6dece03d68016e56d4283bb30782776761231a9652d650eb2ac1a4a8008bb9a66095034de489847a6e3258eb4d78b0070a003a6298996
-
Filesize
1.2MB
MD5f8e3a2028e31579f755b0050d69f42be
SHA107934540559af63ac0c829b03aaa918d569b6094
SHA256bd504f04d8c24287304816045380ce8c7b0ec75cc1715e2ec69fbde1d288d9cb
SHA512c6ffe72da87e6c66788a460b05e967e1287e86c37224e20c8b661b5d48047f9b38adc15419ed4cec08701aeae4692d4c811d8c80b8eecd068acdb97371a51748
-
Filesize
1.4MB
MD59461c1405904709fcfaf7f0649044ad7
SHA10d60c8efc8640d9f0126cd3e409ea6b88c8f6a12
SHA256af10cb1881ef478fefe034a9b34f45a9d05e1af3d4d6047a40832fd60b26adb7
SHA51250adf50673988851f68f6a25247299771bdf8209bb8f9840b7c8a74c7f749e9233059cdbf77cf85caf429b17cd2795783ed759f05cc0807acffb1c83a2f2d05d
-
Filesize
1.2MB
MD5fe5961e76ae6d415ad4c51f6a1a0d6da
SHA18383f09148b3653a327f1e2a985c96cdfffb5c53
SHA25631a42684485a361c83caa5cf30313e7444088664c1f3801dde673ee7cef68daa
SHA512746224bc4176332623e1c7b960d4f03e49c1c1593117961ec35e45b978d74381e8552cb6ec10ea2b0f97870f8ee2be204d6467bf87c25c6146f2e37500d0dd9e
-
Filesize
1.2MB
MD509f0e963b4c1d4885b36c048daa6855f
SHA1dcb4b210318155e845acab54d91ac21c9bccaf1f
SHA2561f591c93838cf691d9610ed154efebea3f105393ee963d0cacd7dea2299ced08
SHA5125b7044e8b77576309c9bcb4896ddbb58e131042f543963d76bbdbb24dc8e96bb5e4425bc81203eef248aac779ef9da7cc02f3d2c7681a5887ea8818175da7789
-
Filesize
1.3MB
MD5271415e765ba3c36a844f5b0bf8c9324
SHA16e3b12904aead78091a23fab4d6517de57f00ef8
SHA256886da8d267d19a7ab4148d5f0abcc184c20a039254f5cfa66f13cc192e001ac4
SHA5129ab9b01f9f745358972619eaf99ec1b8e7db2e56be308d243e3564eedea32b314019cdf54ebd981204b405e4401b122fdba2502898e782ef4e1c458e4423da7a
-
Filesize
1.2MB
MD548dfed2d609140d874d1cdbe097da70a
SHA193f772e6e4822f8b0a9df6d6075a236356a50f0d
SHA256c9bed0da081580acdca11d36a4d34ee9c1ee65121e4784830bf7af6446ddf10c
SHA512e3fb163dcab048ea47ebda66f55f59fa0a8194ad32cc0bbbdba7412df6d7b96cfc6077cb2eed59b0f2b34d56a8dae38d0ef3db37dd3024b5b1a44f7e944e3536
-
Filesize
1.2MB
MD5f859f9072ffa5d575508a87a30c5e385
SHA15942d4294ec2994966c056329f6d7ff44096ee1f
SHA2562629384d0d1ea6c99a8780c33a4e7c7bbcbd9860a3ea1d82024e12e23ef625a0
SHA512ca7e7177d976d25b5dca62da6c6ce0e6704b8331dfd3438fd825c2034cabf0ad69b050b53b7c4299fee68f97f575d89da6664f9501f01fcbdf6aa963d77b5071
-
Filesize
1.3MB
MD583ffc2823dd26a4e1c9a92b81dafd986
SHA194e9b1a28254038fc6f38748a1dec4bfc479ec35
SHA256a33d4e5adafa195e0f79dbfa168131940eaa8a17f56ee48937d155b6e5d57899
SHA512b0bab23dfb440c0a47f7a1a110a9fb9e75970f9f121959b066109fac469e8d561c257b6fe1bfa9f102c32e6f5dfc9f15735dfdd7dba939f1ebb66a44905d427a
-
Filesize
1.4MB
MD5e22a5de4c3dd6ff9b702424e829017bf
SHA1ec48aad03f350d0e302dfd38a37260c2c3640ce9
SHA25609ac07b5e56cc14d5b7e55e11895fc36ef4e89cdb8613dca37dcdc1d94523e0f
SHA5126fbba3505c521c1f4226e7e2ee2e638ad9c8c4481e67d262a66f230bd3d12653824bbd4c534d793868416369673c85a9b4f69017a2d61cb25a81695d336fdefb
-
Filesize
1.6MB
MD57ae2d34e3b30de7d537bde991ff78a74
SHA14dad4041aec0254639605d14fe146aef64a50af1
SHA2569a0c76d993e4ab9f0e0cd1a825ed9e4cb1caa98cce59a4a18db99c66eb3c3156
SHA5122f138e1ab1461e8f0257b630d430dc0729cff97d4cb9b8182c9c96b8b293b27ecab1bc10dfe59b581ad14b2a210a0b417d66f9e5e442d7133b5d13b19d874672
-
Filesize
1.2MB
MD57c0613fb4eb35e4a8e64d0656ac5c426
SHA11da1671035670f7f7d52b2cf5b2d894f45ef7a03
SHA256bb8b0d01994c4429793061daf669c25ac02960a98f954c876eb92bb05aa960f0
SHA5121023c21308af0beead5e1d06b687803fc0e5305ae024eac7a6f272257a8a7da18be5c08cbec6f53032957e7a4b5cf591ae26a95bbcea96b87423e5bdc88c298c
-
Filesize
1.2MB
MD51a6d932fc6cadf7e7872f2c606952175
SHA105d9d9713075c9aefd74f0cea5ecd4890d3e40f3
SHA2567bd2956f13423f2f5f50ad52b4d0e284eb3a3f2777aae0a16d45c40cd0b9d172
SHA51256d745a172d1b20acd28059b2d8c378b53215034304bb67b07ca008c48fe87a413261699e1e923cc4cb379d94934bd330ca1f2ed8bb14e88c26c360942b44b87
-
Filesize
1.2MB
MD555d9a6c9add991742e76f2e6398b3b0b
SHA1d44751c011829f0c86a66d41086adb8e8f377fb7
SHA2560cb73d006583a7cfc972c35d259bebb8c6f9609cc457a484c3b6a5d4894e8c49
SHA512d1aa4e98d2ff42b0df4ec3b845fb1716f9fa82e6b8d33b4025e35c866678ce9331115293e8a606651e4a0f7b55572c68a597d0fc5fb5d901f58f6270a5ca84f0
-
Filesize
1.2MB
MD523a9ebef62a1af076a002e1e2ccecfd6
SHA18ad66b8d500babf23a06099756424adce5753166
SHA2568fb262120f4b35e21bf0505eae8d23ba10a555ebba991805d6ce2954e0d4fc75
SHA512515b54c75933de6eb16e090ce490c0ad8ac9e3dc7c143370d84802d991d6555f0c766d5f56ea6375426f13d3923a83c1df2493529663e84332bca744d3e75c0c
-
Filesize
1.2MB
MD59d5b2a8c8058037dcda71f4d4fc66a24
SHA156dc5fb12c7b17a3c48eec741290c735e9802f03
SHA25622635069869296b28d86a5459c81da0e82349431c5782237ec38f056522203a8
SHA5125b1ff7dacdb935451d35fa0f057b1eda5e6e64120ade63f8f51cc308a24a44fddbb20ecb9158a31c97b75b6e3f8f2458e9da13c8cbd7420bda69f52e5cb007b4
-
Filesize
1.2MB
MD50159abc29d6bf0c5742fca099da084e6
SHA1db9d9a00fadcb3e6e271a5fed262bdc0744a4dd7
SHA2569565e2ec05dc0c5d2d96f07fba1c5e6cb699b892a82842f4e43dadd86930e28d
SHA512ee3f0afa286e434c5238c27711f1bb4cb622562f0226e3e3940f5aa0be8e2689a7191f1d9fd80de405a48ac235a729455c181525962a1e8eb5261b44f7777f4b
-
Filesize
1.2MB
MD5d9ba8d2f8d2fd6e2a8c7f695aba9f38c
SHA1b738249caf9ae96c6ee99852e1f7de617cd059d0
SHA256f0087344568e05fc7668d24e38a9671442cd8c1b13ca0793d1c02ec6957957a9
SHA5127910df8a2e866c915f6a034ca26613c98b4ad5dc1fc7ff56f4a6297c68485627bafee8c1549da827058ae0533269cbd5bf49aaedbd9c3f9658616dd94c3fa9b0
-
Filesize
1.3MB
MD5486fa52e45b0330d5097de897384c1b4
SHA16dbd8ae2468fd043db433977f4a5ddf2c00ad71b
SHA25621e28c664e2bafe9d140e6eadc74e11ac07d542df996ac047eea607a2ff7e303
SHA5125ad95c5c8f009b0bde91f3006e2eca77a011f4d1f5e12063f5f637e90ce52833092f6f6d61f33865911915afc9c81e38757c01b34c24704e395d0d0338c10c0b
-
Filesize
1.2MB
MD59f0ed9d84f9260a269e5494ebe74e459
SHA15e0c174db768e04a9b616338f63579379ee3937b
SHA256c99e52d8588e296e1b4bc14ada0553f0726e96c7b0ef4fc92766dcb634348afa
SHA512e48881120dfb156e56943b67e2c36f7425a52b93081676cb8ddf817ba239b1d30a30ad0710077161a084764b12995830298094b1b9a50166f3823f70dfab72ad
-
Filesize
1.7MB
MD56281e7df2d9d24cbc266bb2a68d9c6af
SHA14f30253be598490a5e678caee367d21c5b9b09af
SHA25674421bb1fc468eb5e485bffff590f6a14b5fa92f925b80f9495f41a8cb339069
SHA512ede8de12ba7ddb04837d16e3eb966768d503ea839cc6c00c10e8044f50a2e19734e4af1df8375e4b7d8b2648573cd45ab196903a399bc4656086c6a4596c5c80
-
Filesize
1.3MB
MD50ec47873b58793976e2577ea8b9ea052
SHA1fdff9d0c847682fa922d979e43c7e8773a6a3acf
SHA2561718b82bd3d56061805873165a7836fab2b1016688cc10a9d9db99bf03364813
SHA5126a47021c89694f611b1bfa7271e5e0bb2e48bf4b2433c03f683b57d1334bdc15f931443ed4cf01ba589c00afa55bdb859239cec876f7d1d3e15aca082668c840
-
Filesize
1.2MB
MD5c4c0933cb78b67db06893d1b89ce127c
SHA17e1aeaffb7f00ad23489b80312658d1a3512b89d
SHA2566a292a809ce0bf13fc00f42c0322283e8072160ede2ad939bab69930e356f687
SHA51228a7cdb6500b6d9ac560acfe48af47675a7533363bfbf78be3401c790b9053fca9fb17c2f2f9e5cb7603287b588499f570c7c38342b675c8fb16d3b6cbf6c605
-
Filesize
1.2MB
MD527e71096a53def52a26a06570991a52d
SHA1671274b20f722896862efe46164ec97b4cd5a189
SHA2562d53d819564359d7752b61ee5e348c3cc57c7e79efcce036b835a5693c0016ed
SHA512807f4f1a31e130ea77b6e105569980e5bf0c1b07963dc3e5ac8d4a0945d4a11576cdda624c0040a66b90eda268b2175c5a18fb7eb656a651d35da5c31f67a878
-
Filesize
1.5MB
MD59b24a6f695329df7a34d7fd0c71ae548
SHA15ba222cdf512a73303c81c5ecff93cb877280165
SHA256fbf965768d721e019efcbe4276504b12956b7edf430ca6784ec5c072179e2880
SHA512ef1c3d044befe99bdb2ac00268dac71a01141c7aa03d7ec44840d1c35ad4f37c30165cf1193f7918c04d6cbd0b4b6fc28f77512dfebaa9edf2f7423da3b2d2fd
-
Filesize
1.3MB
MD59fda245adcf6d46646fbc2012c89c9c8
SHA113d8dbba36cf847abda28b38ce352618a6d9bde1
SHA2561dfbf6974bdbb8fda484c16e58d2057015cf0571bd2760d3bbe97039005eaf6e
SHA512ccb3b393bc47a57ecee0640e052bb7d23b1cd6e29735f71e28d2fa75f773f994546aeb532a5a8d210568095f027efb02774abf2c75d41d4936975bb55311e9d7
-
Filesize
1.4MB
MD5e25fc438fefba48ba3e1181174e47170
SHA1e851da908821f6b41d39a2a8290c26168ae50efd
SHA256be59563f5db40a30fef09ca1c6f61245ce5bdea2dd1954feb5608bab505e9a45
SHA512873be8bacb4ff3ddaecccd6372909d4531137c99484825fa0faab767577505da3c3b9b08263a6a0676418c0fa382abcdacf16773dae5702b74f194f0e57e2b39
-
Filesize
1.8MB
MD5f9c9c5991a06ec40ee6f7268fc1eeabb
SHA10181136eeb902d84367ee03c8d1db03b313d03b5
SHA256215d7669a718d37a85c8ee299ce02b8c0df15e8ac60d4f5690c3db63fcd21622
SHA512db478b383d592929fbdb67733ac195883cb4d48d323b047c56b2730f2be501f132ae495b2869fdba38ff719e2bd65d9d4729a722f810f2f471dbdd7c35ef4f8b
-
Filesize
1.4MB
MD5543e91921bd14c0a9231536622c9f98d
SHA15329edc0e9e1c9853e701ce254138e7ebd1d27d6
SHA256ec5410f4b1a77a49e5bfc3ad0348a6dab7607b70caf01e7f9a73870bb7dda754
SHA5127b403cf30f23b23b85a509976505ce138f4f68b3e96ac91c70e541e557a9bac55d6ca686b425abf38fce26eee100689454cc8d65fecd0252e9c36640431cc43d
-
Filesize
1.5MB
MD54dc09994888026090043be489a1e6564
SHA1138e28c1b9e801c94d6e712a075216380853e9d7
SHA256d9181a1c875dda4223d4793d055e65f9109b62853008c2d7edbda89c74d250c1
SHA512706d36a903ec553f2810e8b3ec1c95f4b2eb0b0a4f018a174b1ede16754140ecb47a3fb6f8c74f11db8e923e8c5dd269be2d066202619ed5416e39be61199559
-
Filesize
2.0MB
MD5f14397fe7edac8570d92bdc4cf1edea0
SHA1aa9888d81ffbb7209f7ab61041a01d149b8551d9
SHA256a8b34a55e23dbb82568944eeb1540c85d6c66727b4aff5c39dd112571cd8a9be
SHA512865fde2038fa7961f69560ac50307c879803203be051d9106dcbb88038a79759fe89df78b411f54893654842428fe26bc2853c6aeb00931c128e44603d79aa82
-
Filesize
1.3MB
MD53ebc09bcef7cb247521886fecccac0ba
SHA191f3f775af76641afb3fa806c1c4678870c0acaf
SHA2564ae0e8c7e797c581f8302f0529a3d347bd689b5d29a59366fb60ec3afa382d01
SHA51299b23020818144c304fa75ac654ecb41bd6155800e80c6226c7d85d9a1686decabda615834d02ec276c4d8f940ba9ac528a1b64cf96b01725a48617af39fdc5b
-
Filesize
1.3MB
MD5c2a7664245fadcfb12c231c9c00fd4d6
SHA1a4b90b179ec0e47c23378dae144abed89834117c
SHA256fcb81c82a1ab10154309748496efeadb23ea0975f27125b88fc50baf13fb560c
SHA512fa5bec1c0b98848bd8e198c3a6433897863883ccf03a92a1cc22b490aa3542f26d187e3e2bf5cee9745aa57277b16ce703144f7da411674ecc63ca401732bd4f
-
Filesize
1.2MB
MD50679590caf55d09287894fec22047fb0
SHA1fe972b0dcb373886da37f188d25c6ef276d21ce6
SHA25633fee0cef8d0299878cacab7251bb389073a639d0c39c5cc444806b030d33827
SHA512207ab00c0b34af0b3b87c7ac56b8cf5fc7c9f1becb19b71c6cd13d0462151c7594c255fc59b76a22e0adebae02c73906c3e5c7890454bbb0da3a026b132c2fc9
-
Filesize
1.3MB
MD5a4800932237a8a6d031147c0c3427142
SHA1ef53c20bc9a8ab080b367a4f65c6bfaf48bfc1ec
SHA256f9b73e5d112ec69714004f0ce9ce47adfb53765e2a0249c6bfe03a35e22f3723
SHA5125e2b275f6c1195652daa2545c44e4e929748c0a08b2c3bb4732a578b7a1948b89f45242fe05a5614de5471cad60a0abdf6f2fa0bc6902d372d20e1083e1b0b64
-
Filesize
1.4MB
MD59736d40d0285afe787549ac39f28faef
SHA1d5ae9d51ed3ce84e43fe9bc8d7f676876e6b5cd9
SHA256faf270bf7b1eb5811124303ae8808d71bf740e37d0a508e314616d464653eb35
SHA512c6396480d4c15debfdcda590cd0ed01efe2c6cafa6dd1e5683a92ee5e95583dbd5c9255abef39ac2cca51cb369b696b00d6294e3cd13b152ec7d0b3122460f18
-
Filesize
2.1MB
MD5cd15f73f92f1b2b49f054b03a9b2ae08
SHA174edde54d07f4f82b96ae64a4a868d6a1f60995d
SHA2566c82de91ee053a5317cf8a36eb721fec17ac72760bd8cdd66dc3cb2fd35bb769
SHA512aa1d578441093214c3d5e7390b965d8dcf390a3379e9dcc237a7579543c39d74161573855250235154e78669bcd269cc53836c8dc337b0b15a286cc78692ffed
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB