Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
24-05-2024 03:46
General
-
Target
2024-05-24_7999d52228cfa710c9fd959e005a0784_ryuk.exe
-
Size
2.8MB
-
MD5
7999d52228cfa710c9fd959e005a0784
-
SHA1
57a82a4403f69e36bf0e6b4775ea11e0f5b2312b
-
SHA256
2e128acd3454653f7ea7256d5c6dbc65dc7e134c386449f31e701cbda6ea257a
-
SHA512
dcc4d7ad0ab45d886079817995c127f43c441a07b22d36a0ff9e74d9a4a9c283f650f90dcf2bc8061f21b2929a88b6ca7393af66ed889812b51d76cf4fc0b31d
-
SSDEEP
49152:ZCVBvcQxMKUDkqMfRW9Ecc2u243a01TItTbzGi2fDzNDNui0hBdH3eT6ZU6CENl0:k9chOOuiP6DtNuTBpOT69CEN6rV
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Modifies system executable filetype association 2 TTPs 8 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 37 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_7999d52228cfa710c9fd959e005a0784_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_7999d52228cfa710c9fd959e005a0784_ryuk.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5c035acf6296c48cfa4d4947473aca71c
SHA1a8ef8492b6cddaf6463aadad684b929afe106aac
SHA2569fe88029e6c5a30e33bcbbe981bfa1510e0b315a9fc5bf450b5a167d96dc842c
SHA512620138535445ef162cd49e12a2a888db31cabcf17a8174d1e5a9e91ab7c55c9155e7c5467c39bd7b41b331b59bea278ed594e21adca74359f028250952a4a7e0
-
Filesize
1.4MB
MD5c763f5d7f3f592b3e2e24f2ff25e7b3a
SHA11ac9f0ac0aec2a224a3d46b0f825f3d7dac8c185
SHA256ae7fa9b4880c4e436951314a5c6114acffabd249148b776398cbac678946a5b9
SHA51212feb113f516151b92023fdde74f1e7733caed3645539646fc17b6f9b4bf6938e68bb2313c1e955940214728ef9d4f307d55cb0b1fa1492799aafeb7f76dcccf
-
Filesize
1.7MB
MD58a94b286d9de1a6c0ce5b39bb8b8d72b
SHA17db515a9ad878482d4aeadc33d90cfd906dcbc50
SHA2561136adf650779002d38ec6a21274a44cbace753c6965db777dc61e41c7ab3b2c
SHA512bb170f5c2fe603956525ae1c72bb8eb63849e349b1affd2824b453e19affb87e0fa48d0bf61036b3d91f695f57fb4bb2e6b7835272aaea3c03e408571a26fa45
-
Filesize
1.5MB
MD596fe3304672bfc96c456a095f3025915
SHA136601aaa18fe5082ce5ebd904512f23e7226de87
SHA256edea43a24d16901a6a32cbf84308300d82292838afda54fe159a555e43abaf6c
SHA512223bdcc965ecf6b9a88793be5299e57d30055cd111d87e555616681d596c3481349b1ebdfb379fe4e3633656adfd9e4bd04790bf52cf72b5a4a5abdeeb2f1762
-
Filesize
1.2MB
MD5ea6eeafca57fcac60a7a4f5ff51973bd
SHA10866300d790f1ed33c09275d856012a81c85139b
SHA256a9fd3e82ad9b1cf85a4d1c17b7ba7ce7f4d3d1a994cc9112b548bab0acbfb02c
SHA512a555eb2fe3961af676dbd17cd61b39046f97c60399c71757c421926f6fa41efab8971bcc94484fa12297d6266804d0cb763de8714508e268b125a77cb57c360e
-
Filesize
1.2MB
MD55f445ce65c6832194bcd1b9f3f6b7466
SHA1e15b5aed2624990f5824cb759a987047541fa972
SHA256edcf442e69fdf8dc249ec86ae51adf41de670018502e49c11225dcbbb4967dd7
SHA5129fc46c6989bf416b17f008dad0d4de8a499891e15ad568b2fa050132f64ea3dfd4d97f8f0fdcf3bd5d192d5d023d844f3902b784800b3f240e949abe2ca54ab0
-
Filesize
1.4MB
MD50c16976c7962febcf9a96495630ae3f9
SHA1e8c35502a38a524de818b125cb1b912b3be2043c
SHA256d3230f722cb6e54d62f696dafe8cd28995a7246161cdc267a0440ff57fe73c29
SHA5124efeb8164edad352f192352c240be8f84764073849c485cdc1066792a0e08dc324665dfa91b3a2a57c3fee49d8e4f0f66c8750e93a6679ac90655b2575e6841d
-
Filesize
4.6MB
MD577a4adb680627d6c03687fae8d823756
SHA161ea4822d7b93cb64ee927fad3021a65d6a50c87
SHA256fbe1d7d37fcee1e602d6f0f6877116dd01dd0588dfae1efd2014a12d5b8b2051
SHA512ea129ce3d7a6956f9ce64580bcf0b12e6ddcd04cc6e79f48649265e674ec04411bf1febf04c350f8cb9573ef11b5daef65d4aff20e0319c2490a12b61de16fa2
-
Filesize
1.5MB
MD5611032372204a3346b5a188a70f42e52
SHA166ee284d88259a5f67c4e1637d7b725d808881c7
SHA2561bce55314b4d6eded6e67f8fe1787026ee2d2e0157dc071aff83a8103f0819af
SHA5127e8f77fb66e8604cf1ed5e5a42316fa93f0857dd5ca500ab7349796b467d07c7157ca2a80657a5afbef5bccf4510be3a1dd5fbd7686a843e5ffa4be8bcd9a147
-
Filesize
24.0MB
MD55771f980737d085cb3deb5e03d897f2a
SHA175dbe973ae2a2f8936734a13ba0991e829075b6e
SHA256f0dc289aa4afb8fdcbd226047c27d1e5718a81d932fa99b9a4f49b628e049123
SHA512e564f5b930cb897a79e7a17a2c48edb98b1f913ec550e11d9c320fefab852bcf1db68268f981f9c9f92136c9a084da94148f428d38bfd00fdfbb5beb8e5965f7
-
Filesize
2.7MB
MD57f515aa97810517ffcce907bbe75b6a6
SHA1ef9bb12a23ec32473913e276112c061de21f0689
SHA256013dffea2776214984d140150e7b4b42de5e2890d7309df659fb21c7c7be7943
SHA51286f8383331f5e5babe59d96de465366d0b62828bda80451652aa728f3e05dfef29deacd73b598fa60747fba4c02016c2155b40fcacc7f062322e61eefb2faa37
-
Filesize
1.1MB
MD5a693dc256b6a997ac1b36d34ded0fb91
SHA1d04b89b556d4a292bae1e6f02f7fa5a91f70c088
SHA25647f54417bc1e694eb2b9a4359e63cec5d05ffdb45b95f5d83bbe2e804ae85fc9
SHA512fc715efc522130aaea226004c01f7fd096db0838b9383830829957a49d1f7bd770bcf0e8fa4a58ab585b90872322cb42bfb3cc592164bd44a794e349095d3078
-
Filesize
1.4MB
MD5f92ae509559421b0cb679062f664331f
SHA1b48540c185f394bc7f687eea5b58e1d679e8b64a
SHA256f8cdff613c7a0edb0a169f399b1ed78103b28eceb46dcbfc5557062e2a19aaa2
SHA51296827d57e22e535997ba75dcf2ea2da8e52f302d63b4d68cdaeee0365a7a45f5e952ccad3a7e9f498fe7c4ebc3c278c4819339299af69c68599b3cea730f4054
-
Filesize
1.3MB
MD5ee110dc489930f7f3c7f544c1726af82
SHA1af7e2295432849c9076b903b57063c87da1a542e
SHA25697aff1da0785f55b278f8ffbb6f66337744e426a3e2014b9c80af9e6c9e7477c
SHA51234af3b70e0a4ccceacf2f3193b0fe1bfe9dd369851f6e2448bace7c7f34d36a0bb3fd6991ecbd1c80977aac42b4b2a2be7f45be10351afb9f866e688800f0a9e
-
Filesize
5.4MB
MD5dc477d904fba0a9fb90a4b2ea964997b
SHA11f71b77a75c6672f6f47afa357965322236255c6
SHA25694cbb40125c5967aeab9b75b041f6302e3fcfd9e56264b46aea00ca13c554ebd
SHA512c05f88ad444ee8a0b3995dd175bbff6f0e3a65596c18b0e7588ed97cf28f1f0eb9c0050b3f84e2514b4bee10623d669e8fd422122286b8dfc6fa6fef656381d3
-
Filesize
5.4MB
MD56324a28c4ac76d711b57e10a9090e921
SHA186910d43f58490a56e629c25661b5f0e9082ce01
SHA2568c8911d15453308fe2ad15a383bf90fbb8e41d828f00dd2e1bea99625c4df081
SHA512e30600fae6a9b7a16e673a8c7f61367480e45fe86e3428e7b9088ed75a220040dd2e50e604175eb19d96aa60247bb2b30bd39b5685df1d4f211e632f693974a0
-
Filesize
2.0MB
MD52975a0e971348f6d6902eafcee4b966d
SHA124a4217f78e21f86ec020b909f1871e6fe5fbd44
SHA256d4eadcc3afbb2711ed6ae644cc6aaf5a23dcca8edaa4e62ecc1aaebbd403487d
SHA5128b449729b69214e52add5a5c9c6852e80bf01c4b821a526c5713d9b265bf9bb13d66f53922535780134b3c4c855988b1cca3038237f0c9c84396b6ce4dde6fee
-
Filesize
2.2MB
MD51dfd2653a018fcd1f44760e2892431f8
SHA1164a0ba8d99c5c4320f9531609cff1e695471e8b
SHA2560aa3fddf0568cbd2f2892318c24869e6f8e3843ad830d326fc4b3adae34e2ff9
SHA512ecd4dd4d4f280728798d260f5c87f9ff5c942180892961eb72883a26c997e25be602411c38b50ce769eb9df586c32f879a7bacc4ac1dd326393f245df313c93e
-
Filesize
1.8MB
MD511e8657ea763d19aeb3255585436a5d8
SHA18bce71547a17391556a580b6e88bd916dcebdb16
SHA25683519f336d42bcfe3e9896a83f422ad59986adedef8939e952f121e9b4c66df8
SHA5126de8c601abcac4bf923b362869315921bc75e5ca2e78daf650fdb18ad4658e1947449a69d54bb8afa5d35cb1c1af066a03cc10e4078471e6d87e9c88976e5195
-
Filesize
1.7MB
MD54fed2d2a04de673cb6765be385446d3d
SHA1b8dfd40313a215323ae0081ac8c37a0f1ae20264
SHA25613fd920980ce377b18302caac496213801954301c7ab8fd43305f78ee76692b8
SHA5120ff9161420c3722464ffd951e6f697567774034aecabde12221525bc59b3a6e6d75e869561ea557f0f31bf2952179bd71a897248ed2e5d87f354d4a24d1d250f
-
Filesize
1.2MB
MD591587b618a205cdd636796dd686a2fcd
SHA17e3a25d4e8ebd7ccf794167800aababb0abc9b3a
SHA2563caadad7e5ab12a8ba035d756ba930635370df99beda4bd51de40afbb8cde06b
SHA512a03d8d3b14133b26dffc9d34f6a36a44c7de5ce328eb4284150ca5f0281f7bb540c284b491704259dca38628b6cc6f641c9d716f76f157a585c28f3dc1f39c87
-
Filesize
1.2MB
MD575cde0bfd78f6baeaa36e5d428b9256f
SHA115ea975caadda0661fdd362db8066752bcd70bc9
SHA256beefa483693b34ee9a9e475702924454b7a2d138073bfafc4a1b41d472dcf027
SHA512ad1a9073814d53e562e7ee1fd7aa8f2d104adbf788aea2d52c9895e638cafe64d08730e676e79393a73a6a68bfe0ae8c05fad47b3498d73a7022a1960bf8f81f
-
Filesize
1.2MB
MD5bebdcede0714b4fa423efb2cc22f6eb0
SHA17919040741b3d3132f7d65a7bd973b2aec8fd22c
SHA256d64b2e50ea6756d5b96ecfa60c77dadab59565d84d4ab35ec6d824f0cd2c39f6
SHA512ed75220089d0a88a22ea5087e7e3f44f98b8c3a71a501b0fe2b56009397a5db20dc33b09ad414dcf03e014bb58d2fce540086739394dc8f3805e9847836b6255
-
Filesize
1.2MB
MD5eaeb0f1f80f8c2e75ee0de8fa7ec8332
SHA1b13cd2176240cb17c6201685e379a555f9ad09fc
SHA25628626e96630639b6f766bb455e19853efd2ccd4d058e9d7fa12f0dbf8abeec8b
SHA5121c902de432529ee2310d99bc87feb127912a4d4669844eedd8a68cd58d956eddaa4439fc5379db161adf4bc45e21068a11d48eee3a68960094ab1c0165dca0ab
-
Filesize
1.2MB
MD50bb372b6fad3c3de7cf30fc576446851
SHA1b1d59e3cd74016fbbe845738a6a6218df40352fb
SHA2565134cd3112b402f9720d3bdf15bd544b73dc3ac2396529648be701a41e2ee256
SHA512a51cf787c310d78650a2da4b0f2c1f722df567ba051d76d60ea9ef667dd49e745d8a996bee96b87224e8721464499ddb6edfde21eac866b12bb5495c7cbf00e0
-
Filesize
1.2MB
MD5e68aa218c8733782575fe1ad42b5cecd
SHA1dcdad39aaccacb9b71cc73371c8c099c9e465d7d
SHA25606ac1c7fa854296cbb46a419cdf3d556e0678bb6e3f958fd5eaac5e3be4a8000
SHA5122cf900f417b30271f73527815fc24ce2f8fb150b9ea9b50fdf241f7447da0e9ef3692d61b0d2cb4221d3a3db33dea58b6807c4b64c9a062936fc95ee1e996d06
-
Filesize
1.2MB
MD51281257c4ac03efc01c731b5974f9a94
SHA1f1b8482c4ba07e289ae6d28fbbf8188b829a12cd
SHA256fb2b6ab6cbec7609f19b592ced61b29e7450c683765367c7b211688d28f185e1
SHA5126dfd249a59ca8dd08910c861ec725632c2327d3a6137f80f1a3a4079f385352682098f9d2efdf61d3656421d45269df7c689f6975c4374606e86132a37985614
-
Filesize
1.4MB
MD5b5201d7fbd8f8d0d72ff7174a2635530
SHA1123dba4080e09533e89f1dca454e45ffeb19d1f6
SHA256bef58ee8b90952d9745c6e50d099bb86dc325ccfb835c5c1f3e244ffbfc5c0b8
SHA51271dae7515577422892fa9a451fccd553402cfc5223583108cf552e6a008d3742847dbc6fc11156a70e6356f45e97d91d13e7e05b0d885052caa97c1817c25042
-
Filesize
1.2MB
MD50e572dc9243f9130bbacb611ab0d26b1
SHA144ca66440ae6b80a8d7e7220fc86f4a8dd1ef2e6
SHA256cadad9d113be24b3ab77687e7edee2dfd82eca2d0355b59631e7844c3341f5ff
SHA51244be1044cab4c0d68f2fb4add17f644b0de71d76d9f641647a20d86b05cd48a508de06a4270fa312c6bcd050fff252fd42ce73e2ea548c9b0aa234715050a44d
-
Filesize
1.2MB
MD592b40d16725b0aaf08c4f46a9af78f23
SHA159e52dfb6df80fb6ee627727e610bb8a08f01a11
SHA256d640d455778433097eeb7bdc461428396f0f3b3354eba3ed119ae6f07f732b03
SHA51232d2a5ea98898d648eec35b8ddf91b88ffc8258e62133250a07808a323a74a0588cb9b27885c9064686e95c261277ad05318e43528e1f98bc37363f97837f09b
-
Filesize
1.3MB
MD52a18f2bcabc7e5b9ce76749dbe7fca13
SHA10beafc400efab594f310329d86016aadfbc1a93e
SHA25674308a3275d5fa9c9243581058b51a9fae5ba6ab675605840c5f2fae871d640a
SHA51250f3dc9969fcd87dc06c3a1377a44951ccd8d366d4d787c91e972f405599a93219b6accdf64005bfb8311dab0449a849c5fb2e31204774bbc18adf221b90422d
-
Filesize
1.2MB
MD56bea0a19084e3e8a05a5beed51e834ca
SHA1ca28a502f2c47b84d72a40258ae5cfe27962d2bd
SHA25650b1507f43703c8dbb2ea4956dc0d687174fbbe2484ff434fd6bfb4c7eae1207
SHA512287ef977b25349e53c74284829a7825b0196883eacc4e356888418318b4a5895b2ccf638501dfee819262558fbdddf53bd6d684e2e6c6509bcd4b2961a8b7ec3
-
Filesize
1.2MB
MD5eacee90988fee310827613fb6d04e069
SHA1c274aafc8a4c8b3d9429cc3f1294b751f0c0f107
SHA25688a7deaf7c96663d076a046428f0c7f848ed80e78a0743dcb300c624da686fa2
SHA5122b3b0c0e2c5d147e3725f20f4d4b30eb35ecc4b25c5d4fc3352f6b8a5d2db451e3483d47cb849597e919d21a522a4cc46ed09bbf5762a91ea78957a925665d73
-
Filesize
1.3MB
MD5ab9cf22b338a30f6bec95ea62f4defe4
SHA1bb98f0563dcd851804e268e7cffe8984920aaeff
SHA2567dd86f68fb4f81f91483b3687f920195d3aefa178876ff4ba20bde403bb71277
SHA512ef893fe8ffc531024f35313e2746f27f7e47c3f61db7ed47eeb7406b3e43447ed44c7f52c3278753fdbf6ceac7a6027b9bfe224217968ae49659f5b2dee9afb4
-
Filesize
1.4MB
MD547d61d111e66c7869775e24e010be697
SHA1a6d17f7a490c77254ea8f54c7472e06f0d7e8106
SHA256240e756c233920414523067a9e462fa4dc16a932609cee24779233c003e161e6
SHA512cf014f120b73d19509fcc826bc8b0bf22ac9f26fa44d6fddb4baf296b247204dde5a02fd81054b32092f017f983ef75872ffc4e6056e0305f3168dd7f48b00be
-
Filesize
1.6MB
MD5e647fe195d29f12511c43fe0768303d6
SHA10916d19ef43aa215518b85598593ecd70a52d245
SHA256df7c95a4766f37c771b29ed99ee69ad8830bccfd34b5241b4e075854e56b01ed
SHA512e730e095c052c83de5983f65e40be6cde9c9178013396ac7453f1350f5807d36353038fd8046a380492f68838ebe39799be65d05d33e606d765b4eb84d9e5021
-
Filesize
1.2MB
MD5c76a8b13b87e6b62eb1a663117e8ee50
SHA1957e92c5c7be1874dcbdf850aff4f725079bf75a
SHA25655833875870b7b088bc879331352917f01a0d356282e8f91e4d7d19dc53950f1
SHA51285f6136130dd497a6133012b05f19b4cede43de42d07aea14eb50824a25a7f0d43debe7972f10adaf57f78787da68ca7ee35283667f56d2937bdfb84a80c7138
-
Filesize
1.5MB
MD58d66d5c08ca160254a25e9317118dd95
SHA11cd80c3455ba9f1b02ecb13685e1b3f29396dad0
SHA2561a66335d53fc4e878e6d6c68935c1d25e2f5a6930910613905533c562fa05015
SHA51295f4d0e6a404d1d92b25101095c9ec25c4bf1e19557f0bac6ec491648268e473481d2e16d3bb75a629b537b66dd6f9be2a9d48656139b71e5a7f5528bbeac107
-
Filesize
1.3MB
MD5855f047ed0daeaa1a5733faeb920fdab
SHA1aaae7b4de8bcf7cddf3584c27643e40c4d3dc86a
SHA256789481688204c3268054fb20de2de267bcf83be6e70574a5725de0edb41d70d2
SHA512b31b70c54aa5b843416672472f01d4c2ec7ca6796487e585a91e89c9baa550997782dabf7014a07f04b531349827e4cad60da1852402e9f203276433e80fcf25
-
Filesize
1.2MB
MD5332df8c4f079ecb53ea042fa051b4be1
SHA1cf8fe5e4e9c001961cbf7f0f602c57b222af8774
SHA2567c7991566d4819ce19ba4ef8d0740c82ed29a58f5dc10188afaf65fa86a38c48
SHA5125af82eea307b2e21539b9193ba26630120216012234f62309d026b6dcaa59a45548e14dbae351fb9f0f3887b0241390931cbda2bfbbc7707d02d0375358af7c5
-
Filesize
1.7MB
MD52496fe0e0ecf0006f3148102d52c855e
SHA1d17981cabdf183a21c9e463e70171cf71af9939d
SHA25680b64198f990fde30cb3f3ae8e3b1022e26e93046857d36f6f734f6baae70c51
SHA51213d1e0d9d4eafe0f1e19d60b9d1609ffc4ea5387fad9b98ec96456dfccc1944a00825ba2d3e6d8235542539218a181ad436c44e2a8f7abbdf9c281fa46b25b2a
-
Filesize
1.3MB
MD5998a99987ac0c76ca80ba987dbe4b4c2
SHA11eb117f65ad87adf99a7b1b370086ce1fedb9da5
SHA25684c882ae704181f0137d9b06796bf8821bd8e8e619f4c98428abfb8a7e2f196e
SHA512b80025564b8ae9a7447d38a3bf4c4a9b8c9b7a3579f2057fe63d17abcdfbb379fab1666821b8dd5603669d36f9f8613c017588d7920a345be449adc20fb0d69a
-
Filesize
1.2MB
MD50b2a263560a91ebaf49b7d1ba17692ce
SHA1803121c9b6b05894ee5a282f737a9476942829a3
SHA256a779864cad0b64d08238ee7d8b83fc38e194cc3d035124a1c8fc3f9ae9e40472
SHA512f47a07e8249f361a83176d501246b759d22ad78c87d48e2fb6f527c27d6b23e768ebe04d8bebaf8f0b193e885834b0cb68ee0d55e3d834a40d5b02c111858999
-
Filesize
1.2MB
MD5b1d97cb90e42c137e4aa853945a9f430
SHA1a9d3a766a59ad7ce190ec94c2afb0231a507f9ad
SHA25681cea457c467f4098edb948e93361122c5ed41f7b35dcb14ec3aa1c4284b9a51
SHA512b1dddee49a4b2b8da1b7dbb0de59c41dd97f547398cea6519a0c93fc12001fa41b14ea053f581161199e21fc8627e5aec4cd9f0b86792919c9f959a33f23f184
-
Filesize
1.5MB
MD56242b637dc21236d12f0add6e04392e3
SHA1607a81719b1db8d47d26ca9c32b186bb84a23d1d
SHA256138207d98d94b76f16f1da8630454c49b3b5675fd4234438a3e8a7873c8ed9b2
SHA51251862c144299c0bc1029c189d2018f831d55160fe44e93ef491800b0a8468a28e889990549c36308343a15748c694a2261dca1e76b80fdf6f45d212b0f486816
-
Filesize
1.3MB
MD5a9011ca0bfe7d2d5cceebfdb6ef57daf
SHA1108305843a4c15c09d574651c1cbbb93529270f0
SHA256e7740670e2a181c641afc002118fc047aa5efde4232b51b276c05af545ba1c67
SHA512f7a10ddf4c9e26a0c2aa38b923706fa129c1eaf028cb43be9b404414502ad7509d8a024dc2e04b01387fe484cc0fd109f6e57dc9b7cb2ed59f3ba326530acda3
-
Filesize
1.4MB
MD52bea685d29ba211056cd256953d9e815
SHA18dd2c6561271bfc09256b87264755debe8c8f27d
SHA256bd46329108ac2f70eabd7a6c927c2e0f22ff268923b45408e1d3322980ac0ea7
SHA512f35edfbec00a3cb31539fc4ad27cd297436c2ce6eda1cf27725e24d3795ab5e0890c688a4800be40c577f325ec341a54932c3f9e4992f1dccc6bbf796582e097
-
Filesize
1.8MB
MD5a15dd0f48c62fcaa44172a5dd706f9ba
SHA14028effa78b727a47f97656d919112915e0c0010
SHA25633965ea93f189d50acef68c9e2144663f26277aa07ab0bc3119687ad5cd34c47
SHA51218cdf00da9181c4306dd5c14761ff07bfff7bfe3930554b67d1de7fa99e63d33b7483f918cc8883ccc63037d19d46784372d93ba7fa0ef1614d8ae970545b63c
-
Filesize
1.4MB
MD56af6012dc5529b9d65cc12defd02d74c
SHA100db387b25d2d0dac2bda22e32d7b661b9a9e986
SHA2568c8d4e17099d068f9f15fc4c69f58f3a93aa6df0b782c22fa824bf870bb65075
SHA512936423acf5a29160a339e899d16379f5b1af831659ec36ac57ed04118e6148948a90416d2a0b1827c57b8b9573657ce8114f4f96e6940fec82efd463104854ee
-
Filesize
1.5MB
MD58e38e1dc64c03f42b1641f120aa4d6eb
SHA1dc4b0ee2a672bd91ea467ae3bcb5a285f760da60
SHA256938822f045e5a65ae629c9c6e6a7bfaa414a854c0c6d73db10ff462059c8823a
SHA5123c4fdd98b4ff5de14a3935b708a3d194168487af05e2ce9a044848e98874467405f275f4e059e15e870f0bef75383a07df4ff96a520af251aebda99f41026e0f
-
Filesize
2.0MB
MD5678d0d9ea8633703c653c58412a67b11
SHA1a975a35498c028d6089ddd439496409552524293
SHA2561b85abc4cde86d5220e5ede0ec146243766dd14db8d01ac9e31bb3f0658d6ae6
SHA5129b5cbeaa640c1ca7d5cc464a712d8f70be5ec6cfc831c953db5f2c730c6bc93d3326c97a75e3cdc4af35a957cbfd53ac5b1eccd504dc859f7c588c70bdab6a36
-
Filesize
1.3MB
MD51fab00aca62ad810264350fbaaf6b9ad
SHA1ab540d5a3a31b8901cd8f126feee917dc2ce86dc
SHA25619585cada408e84035654785c5f469463be9107c3a9354e2475dfa432bfb52c0
SHA5129fc8946abfa3a3630c22a3cce52c3c72ae96e01bd10a35da06c095e2a6cb8b62ceb4e9f1419c7ef9a2d6f3680bd5b465534cbac2aa5025f9d6c978f612b87293
-
Filesize
1.3MB
MD5a2d1f594529da0afcfef52d9a7a2e42b
SHA180a1cd6496912e54bbcbbb0488efa88269d8b79c
SHA256d279d5c3e3cf7dcaa880412a0d31055a0edfbaf46d544e84e7c4b146a1736153
SHA512ab34d0ab136e1f465964ff24fecebdfbe27c15f6fce818d89288af8a724ea883dc34e302b2e252bac7f6ee44be32500c5853deaff84f9c22bb60282dd4765097
-
Filesize
1.2MB
MD560ecc3430b4b6e3c441886926f2f9658
SHA115b0d624d49902e7da8f179d47a1606791198fdf
SHA256f23083642b6fcfcadc2d0a70dca68f7e5ac74959aea58e63934d2ba15b72994c
SHA5120ba18f7fadd02fdf4f2dc67e39f10e01ddc64022fb4fdd9aad3412c02abfd96c0e6380375320010660b705bde8fe3b3317fc7e1e44997ed5b42ae2a29e9c581a
-
Filesize
1.3MB
MD5c2cc874707f5585d74429d420a024e4a
SHA119fc807e8c460741a91597b69740b9c33c014fa2
SHA256a106ace886edce106d894a7f9c87bd82b7bc32fb942576d3c35373f3203d34ba
SHA512d5e277c31577b6ff1e30c57c729ed661ab474a29e8c11679c69f4e9193237ff6d22cbab6b0918d7e9a9a681169bc346bd73c02e9e87a48c3637864b7c81ab641
-
Filesize
1.4MB
MD532bdc9264582be77a9655d989a85c4c1
SHA183cd1505d00927b18c1cf342346d607d1286584e
SHA256e212fa0f569e1fb4dfa948b6a850aa3e811ef67f2c9c40f121b1da8a1f29815f
SHA512d9e87fc03de5d5cc38bd89bffd46d7da15bbd69125ace6d9f7ee27ee40b909e05480895c6934807604b3e8dd564ed7ee30373d8ec532fbb0bb8af9407d17a4e3
-
Filesize
2.1MB
MD552754ac023086294ee5e339ab7395d9f
SHA16e2267a94ee58619bb31418ec5fbb1054c0deb5b
SHA256e747c4d16fdb9933ae53bc0e86bd7517477a225986c781ad8e9aa50416e583fa
SHA512ec9393db138502a9114b2fbf052585d10183ccbc9aa69390a4993ff6edc4a456459287638f03d81fb47096807208c663001437cd2df133d3d03f9781f95f608d
-
Filesize
1.3MB
MD59eec1f8c006366d10514e1be5dee1895
SHA171fd84e07aa32008ddb55deda554372fb0b63d05
SHA256d6b7fb884c628165404358e3f36c80e6f14478904d4ef6c7f01d9a34b5866642
SHA512c460e0830a31013442a652ad350602a01ad2bcbeb7b7def9f0ac6f5f88b8e701a4be169e32ff50140d9c1c2f32ea87b8076c0665b226dd438c2a5c735d81436f
-
Filesize
1.5MB
MD56b066512c3f1792aaf4575d6d28874a9
SHA1730a7556fe0c5068a37ca79bf7da57673f85047d
SHA25682e4ebb624170ea9675a9366f47a8121f10e26b5eaf42c13930173ed7dea2e77
SHA51236f331c95ea6d697b190caed3e7e51e94f064f05de9ec037a8b49542afedfab2d77353bce910434b2e5ed77ffad5d50f5b7e97575a40c12dddb3de850a8f55a3
-
Filesize
1.2MB
MD5c64ae769c82bbf11bfc6cd5de8acf301
SHA1888d09cf20bef20316e445784fbebc8c1ab6554b
SHA2564a28afc6b5f197d4bf5b4eba71d5eafc42fff79d83396e361996094fba4c7d4e
SHA512edbcae685cd4ac66ee0e08dd773e2be2a07e76e00593ec512f84a713ff41693bdc269850a0f345e17708cd25ca6fb1370215cd9e27380f13953a6a7e85f44fea
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB