Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
15-06-2024 19:02
General
-
Target
2024-06-15_c496f160ec54f9a8ed6f43b4fe45bac4_ryuk.exe
-
Size
1.6MB
-
MD5
c496f160ec54f9a8ed6f43b4fe45bac4
-
SHA1
1c5cdb30fc6c02971486b14fb7a249162bba65c6
-
SHA256
3196109052c16c2a59834f9b99b85eff0ec3e0c549c790fbb686eb8f3c3980f7
-
SHA512
7c8b98db3884279d2114514c67c2b4c91558040c45f2c038cab0072f3f125f4de7f4988a3969ff346aa5a5b8fb88f95cf0c2aa05c6a7248a428b9ed30ff69998
-
SSDEEP
12288:2+0r6a0Nl0JVDgEZXIBaxqCKi60RoaItZICRtjch0Kp2H3HqFShkPUzlZjOJ:ZbK+EiAkbwRobfHRFcbK3eUKUzy
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 31 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 45 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-15_c496f160ec54f9a8ed6f43b4fe45bac4_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-15_c496f160ec54f9a8ed6f43b4fe45bac4_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5a51ed18b9c67caf4908a330f612a7c01
SHA1744cd9fa403901f91e31046227bae98237e54df4
SHA256c13e0dcfed02d18725586c2acbf4cf6e5066e12d940c2f8eccacc20f3d216524
SHA512b144ab2908e32c82481fe5b1310344f8d0cf1eb4b3e04f89d6cfa94511397501a2b0fb41201bc98a3ce2911e0ce1ad311920a9aeea6a20b5e247ffa6b2ecc3f7
-
Filesize
1.7MB
MD5c27a2d428da77d5ceedca64b1b94664f
SHA1e630b75f9417701b88dd8b661005590d753c384b
SHA2562b8ca0c696dec222f3b65f00a6ba6c4bf1491c409031765777a5e6b42aba6537
SHA512f221e309e4c298230b5d1d66237c1ced15ac18e0a4570f20a52d9fa4b392d5aefc6a54ba1694bb11570462db8313e2972f95e7387710facbc174e2128bb31d65
-
Filesize
2.0MB
MD5f2c47bb40afe2a7e58dbec725948b970
SHA1c74d05a07676631016e04e06738b9f3ce84140cb
SHA256dd21874a1a449725872638711401df9fb490f5eed35db9c01c6bf4ed97e5778d
SHA512e560675ea3bd1a88697c37178a4371f88307b22119f4fc2721b1661681d6e53daf0974df42378f1bd0af8a437bf793232be7fa8026dd6edcfa678490a4c06e57
-
Filesize
1.5MB
MD51108cccad3cd27022ed423114098fc2c
SHA11f6248132971e97c88583db483ed40ebd69400a5
SHA2565f11fb75c94efa28b0b9e018b809ca14ec89c4a97ab761587486f9c8ad5b1116
SHA512271833daae64e68a3b1e387f16d3e94c5271e75d26b2fbfc362caeb9658510483989b2e29c4943129eb91aaa14cabbfca61c8c0560d4294968d19d82f8ec9bf9
-
Filesize
1.2MB
MD517d61863f40a1ebdc6e04c3346f53eed
SHA10a9045e21cd00eb953e7484d4d730f0340093d15
SHA256fa7ea55c58aec0b153473fb16dd01d09c09788a13bc819a000851924689845d3
SHA5127e6ee7364ba42b3379366f7240a48909dc592ded6475f10d928c4cbb9512037d7ab641e3e01b5f9534c0e6dcc5f88ee8d517a90dc053a984df73f54574ec2bb6
-
Filesize
1.4MB
MD53f64a9fca1513ac3869612cb8f1ff279
SHA124897f04126fe565ef7f40a21f906e264ee4a877
SHA256dc4a7f5dd807d8a90c1806b6244a791c8ce5b32f061647c967ec72a201b0c5ff
SHA512f5c4d039365b976a154cb6f004b85513f56145b1d134b2a5ca912e186f6e7f32783d1b7ce2f9de122e9747806e487b4fc8907196c55a0056d2f72a680aca66dd
-
Filesize
1.7MB
MD520a7258abd64cc03fec865ecf09986e7
SHA139367c5b4b0eadcf87cd8bfebf42efcf8bdc29c7
SHA2567afc42d45dc3ce32050e1cc2f1ae6193e060c525e642f9d1dcfb2f46821987f6
SHA5123e94c8b9b04f62aaf39dc9f0a399df4350550c545052e0b12219d05637caa4bcdec7bd5b9d437208ec282e3a62aff7062f330267bcc41ac7efd8094cbc48b401
-
Filesize
4.6MB
MD5fbe03f56b2672c7d0f6240b856c003c4
SHA1af1ba91dbbfc4e1814b731b2f679945427e72ee8
SHA256dc20559c37465b5a9d07f8513ee34f05dc822bc4f1721cee20353b369ce47516
SHA512f5a5e04cfa63a8208d7b8d72e6825a5b3dad72df3437c6098acc53cc1ff4c43adbb3879b3f9c5bdd89653b7f0cae93cec857da0ab8bc3e4dc96a9d6ee92ae9c3
-
Filesize
1.8MB
MD5c46710d3d894d26aa4ca23a55474d334
SHA1aa2f353b69e85be239a348d075d8a429c973cfcc
SHA25684a51443ad18821b19cedeab349f6a4213139dc77673a7753eabc75ed801497e
SHA512c599c83d227ba9ad4f08a99c28c26a1d304eac6a2423923e3b5bd3e77be82cecf454b938d85faa309e02cac42081b7d81ac73c5b4d615a7c60488d2fa6700688
-
Filesize
24.0MB
MD51db203edc568cd20f2d101e32302d372
SHA1f3ed0d0a09ad0a5bd04f49e5a7fef1eaabce6a90
SHA256ccedcf87320838de52379f5ef14f21dc4d72ea90aa954f01d3fe640c0d2cb784
SHA5126b27173be1d68b0ec1b584cff5ec0bcf9ace7a3022b97a3b1eb90c55831bc18b267ab7fb8b842608c5142ce1f5ccf2b1a650ad2f6403f83a864fcd37a205f129
-
Filesize
2.7MB
MD5c5cd01e1676d954ad456631821ee8385
SHA18d05b40bedd3eb33220f271156c83a012bbb50c4
SHA2564480ed669c9e17385a08ef84833ac7f0322f372995ecaedd2e8708944d89af7f
SHA512c4fd39fc8a8e08e89b44cca691161fa15cf9671184701e2b4448c7d427011d52459b3ac197329ae3bd33499fc32f2639e47d9ef8b18cfd9415b975b5443ba92b
-
Filesize
1.1MB
MD57fda08c947ef1910b75a4765f4e8a916
SHA1c8825569bc67f82d5bbd1ebbbbeec4c51eaebb12
SHA256e7bc065ce3c658abd57b560babe935ee33c4130ec80abeaf97c7508196a13752
SHA5121efa543b7e7923a1f763faa5e0cb226185832fd8b7d55af9fcc423f0d5b5b3c63db5f9a34cdb962e2f155839986ff139cb1f82c298375ff7ae585f8ddbd11abe
-
Filesize
1.7MB
MD51d2ba9d57cc8900ffad5f78ff783883d
SHA12474d44f25ada7ac25f309c4059ebdf41c237c37
SHA256e740457e4500f80582213d63376214b79e0d0a0b69e02a44d5e21a952cd43406
SHA512f798d5d4d37766511d89335d7190d059b4c21cc21ef8f7f523f2cd791286a3ba9ed78180678de546af8382bce3616dd307f63ea27768b55f4d068fbe643602ea
-
Filesize
1.5MB
MD5bbb1fb1d8592321da16833bfee0cb170
SHA1bda178d2318cdc2ef594f64508e24a0866a1bbae
SHA25669e343a0cd9d8a4fa3e24a6a9311c39b2f9add739727f09b4dc75058727421ee
SHA5120ae489d8d92ae5536bf1c4d3ca52ee0f1d3571086f4334d7cecd7b04d6ddc5ce4a0ade24e74d9d222e6a3820d34d7d38a859e39e8743cff3cb4e04afd145544f
-
Filesize
5.4MB
MD58a8b4d706906f32cc2d922970b5129bd
SHA11b12ae96560c4e953e6d0a3f45a85581e8b65fda
SHA256262852c3112b9e467c5b7ea67880357c4abfd9f1ea446e9925c1db47f05bd94b
SHA5121ab12c2eeb56e310f20a0973a1f9fee41cf07b50445c5d55fcf426168a9c3ada413179093a7a195c6aefd50bd0b7cf246069d7bc2fe5a18b2ff3e9f604fdfba4
-
Filesize
5.4MB
MD5b92be73639e9393a36fb9fcc33999f4c
SHA1727382accf4bc52f1ce022b2abfc53516a52f2e6
SHA256d241c41b778554ffd976a094470ba081fbca3acf4b352905067a15b4ea5c9caa
SHA5127f41953ed79cbb926e3105a8502af00b1401cac290ea262a47700450b8e38ae1e548fec5e1acc9ae5dfb42efa1e7664be6ad29e32ade33301375c156468ab908
-
Filesize
2.0MB
MD59d033fe384ed0242b23aaf1685802236
SHA1a78d08fe75ff2fda5517b5da7feffed362bc5edd
SHA25688c787891b36bc3c5696b8830476be5402a7b7378199e0dcd56c697cc0cd9599
SHA51213785faa51b4f49e7db1e6aed79f497700dda2f956dc4b475191768573094dbf3abb26d879d21b9ed4aa6d03f88179340717c124d1dc0cf692ac54727e3a0edb
-
Filesize
2.2MB
MD5fc4a7459d439900b387b6cb55fd25cd0
SHA121d0102bc0817abff2d3f14e82588b339a2de75b
SHA256c94f6083826aba100d9ba135ea2d469c3d49e34835a1531fb25a9142cf7d9be3
SHA512f4d8cfa1b1af7fd9e907d2d94abbdd71efc92d7f0119193067df231bfd7fac38d3bc18c4820939c827c60b1adf11e86a47e6c0029961da6a027c16dde6509c88
-
Filesize
1.8MB
MD5fa99562424f868dc49390d039c15f0e9
SHA117a374ea6c95a5289599caf348f03c5644b70243
SHA2567fcc17883f0f5a25c0db71427539d74b1ae5a58078dfd9117291aedca73d8627
SHA51211dbe0bae273516a06db01785c3bafdc5d529dba175eda689aa4b7055d77b38cab0f0ccba8acc36ab7b88447c445fa7ba4bf1d7d8268dadbb55122e2ea560919
-
Filesize
1.7MB
MD52815fbb74e7e2ad54012274ee2124709
SHA1dc1f505b174e005cd4d4c7837066e94f1848518a
SHA256131e6d8c3832fdb72de31ab2344a135fb1e654c493dec85ccad31180836bd609
SHA5126c2cf721ec48675ab9ad997a1571102ec02b0c2c4e0cc308086040f8320d7ac96fb75e3a0624605c0519187921fc8cd113fac52c761108ebcd07bfbd7991305b
-
Filesize
1.4MB
MD5eed1440fcff27d5b5a07546092f4cfd3
SHA1e7dd5e9860ed8832cc2b5204f214948cae1b8956
SHA2569f8ace57f577f0a934ec9f02446a5458f84894fa41b37e3873c69a75b00408e8
SHA51288f85b51f74fad1d5ff6b67143ad7fbce2b44437fcb15f0cec10bd8f8222349d77509d7d4513e3e4cfe7d1d094d92615c04da257c0478f756926907866be0d66
-
Filesize
1.4MB
MD5399af11d952bb8f153082514172e5eee
SHA132c780716a21fe185cf2d9e76047dec478977f40
SHA2562946f1a943bd46268821c7eb421f863721bb09aad353a45186d3f48b92d1a0ff
SHA5124511cfdd257726051b2d4d5edd0c321d42a283353222f99d8d07116d7334ee46e5aa0be786ce0b9f26a855daacdfbd86b4f224c925a5af8584d6105657af3f93
-
Filesize
1.4MB
MD5fedbba1f713cf3059c75d94583dc5c9d
SHA1fbef310719dab8f2a1aac2ef373f2f5c54b425b0
SHA25611dce758f7f15efc63d1dc1073d1407a354193728fd47c9e9dc09ca9bc351f7d
SHA512fe9fc0b592ebed9c0e7021ddcc0e6c5d66b6a7e5c5d5448e9077cebe0bd3cd6ed745b4334354ac0a5ad3394e4e5c05abd54f1e0ca0dbf53b8f9ac0f57360032b
-
Filesize
1.5MB
MD5471e0d723c32a24ece2c60be358da1ce
SHA1bd7cb30f3ed56e0338d8404f153a76bcd640f2a5
SHA2566c6ef170e1a362f1bf6a295cfeb8a6eeff0f5d325ee848fbbed1f3065e4f4f3b
SHA512dbc0f79e8e418a67fae6512b51a7b18b3d3fcff063c9aaaf39aa0b4306cbbaa8bf3f656549149e442b7984cf837316e9d9c941b8e41c095b9548261b2e0b92ab
-
Filesize
1.4MB
MD5c0c170fb8dad1beaed04a809e683d579
SHA1d34a681ec5941ed2e2b2452332a26dfc0e92ff7e
SHA25686659ccc99238fe109bf1ef21657e5ab297bce673823324ff72d91c50d42f2ba
SHA512c2c067372339701b137698b6236a4db65f638dc54fc1aac01f9130b9f0615f6c521311b17789b0bf32ea1fb09dcd1e9186f985fa0b1a31e0fc0c06d44dd113f1
-
Filesize
1.4MB
MD5a867f85069dc404b3bc0f2a9210192f9
SHA19678cb74b7eb0c2f37f8e59e0de76fd58a8f6ed5
SHA25620bb98f42cef8bf5219b5998d53852a521872ca28ff2f6f7b8f2ae4e70b3d89a
SHA5127f58956907f33c83c1edc3427c77c467a763747f54ef16cb0523154946bdae85ca5e41225bb77576c5316dc558b1bc0adcc0223edf62b94c740c378ee5054d55
-
Filesize
1.4MB
MD5975321f1d672d5f56156e106b103222a
SHA1bb712b17d2a65f1439f1addc914648c5950ef2bb
SHA2563424281f2d52e91bce3e88393afbc0f0feb6632b30cda3d74b1adcc1c798f423
SHA512a29d2ad25ac8e789f77c963a6c182905c5d80c838937361044b69da9612034ea39cd840c81a9e524bdb8089fe02a138d0c6661d27b0515d4df3bfd64d2570a41
-
Filesize
1.7MB
MD57c543299d57f4c23e27dfb447cb921c4
SHA1e32426139a270bcbdcb6afb8c620ac9200730447
SHA2563f43a605e428c05db2546c7dc1ec53dc97376860e11f32756f8f26a75dcbdc3b
SHA512aaed813ec9a39162c5fb1cec763d9194aa497895cb1583d46eabb9f94087bc0e24c0a281ab58adc9a8d694e3bfd62b1d3b0c2c684888964493565f37c17468f3
-
Filesize
1.4MB
MD5c6914b0d3472a4d4fcf66074b3f8944b
SHA1268f92c04c2030c39a21a19a759f1cffc362dfd4
SHA25686070b574b1696ef0b78028836c09f936f3df3161d99de55502f76ed8e3c7ed0
SHA512412bfcbfd83b36829bb8b2f39e17b93fcda41a3165f2dfdbcf79f81574394f557365e40c85e93fc71ad09b8c3ccc48f48192fe59034d17a90648be4926addde5
-
Filesize
1.4MB
MD58389e833b8f2969dcfed375b74bcb755
SHA1e2d77061edd2b4433e7ee232210b4e380ae23d06
SHA256483807944e2ecbb8d5f48a1438d63e65da38c30b2c78daa0e9938774ae38fd11
SHA512c779904514c59535af4cbaf6c155b6e2473fec177829929526b7807406e0fae81039dd354b45ff8757f9f639b732c9ce7dce3f24be0b6bfac6f8bb41bf091f7d
-
Filesize
1.6MB
MD5ee92a659e720cbc56a5ed8cb2b427062
SHA18bdead6115ad64d86a3450b91188055e3e105977
SHA2566f8eec514eccdee93bad1664f723fc4c8a8a20b1020ea61b0dd34d4b61e14590
SHA512cf43a3f34aa8834a8d8252d3944d2c0832c2b0aa7bd25ad0390a691863dfd70d22ae1afff6c122121a3637f6ef3caca136c6f25f6d1f38f65e34d66215404eb1
-
Filesize
1.4MB
MD59d8e6302a62aee7f4a10b9dafd979e61
SHA1ecfdc7d7d61801e2b5b409e714eeffebe42fe33f
SHA2562ca50ee5b76a87b5c7a8babeeb7dda5ef8ade86eae2cffc6f93f6b83d961a5ff
SHA512752e9fcb49ab114d17c5341293d6164e9ed259c0854742cb60b5400932929039c4c47b511cb3628639b98431e1d5892fef2f3f1c3e8434d118375ac41818c799
-
Filesize
1.4MB
MD5fc686693802798482e63532833018bed
SHA149062d9ebe555ed483142b0e05d329903de833d8
SHA2565fcf294d31b31f1cf6ad52755028d3ec6e9859a227583fcb66f343aea9cb33a2
SHA5122c167866f7af4c75cf4761c309037620a899865bf2bb6f370ea6ee7c0e9380dcf4ce9d7694fc7e4418b81e050accfbde5f651e5c73eb2de090d5be2e0961a54d
-
Filesize
1.6MB
MD542533eae60925d6b340e91bceac367bf
SHA18fd2dfa34c89789ca63a09bf6097947f289fe982
SHA2560bd9334b85bd37abdea729be3ec7a13f1f3070d6036860ac33e56193ca56c3b0
SHA512d149dbeffa1ad6a79a5493196e815e061f5d01ef80c7f00e6cbd6331eefa584c88a51a223d632719f8c646c2dfed7c61cec4adbf756ff389b1635504e34aedb5
-
Filesize
1.7MB
MD5153e3957ce6241848fc2a42aecfaa4e4
SHA1fad606671ee2c7ab194d7cad68b3087545f0f276
SHA2569962f1c929e2c1b858f026b4c6f5f1928905bb181390800a8d1a1810646f14f2
SHA5125142e1e441ee2290eecec5af7ea1d40d483bbb384a3d6b34c28c29c1a9714b106ca720373927ffd41cbbab876a9c0c0f17ad0d6bdea1fd775d91e5fae151f4f8
-
Filesize
1.9MB
MD58241a0d189d79bc3dbbbfd0523763f63
SHA1afde319241b75e2564643be702955893d0c12942
SHA2560df4e754f9f61dc2ffecc5f2788bee57d3f1cb995c67d0650245d2a946ec52f6
SHA5126560672a02b488681fc70dd37d4529acf9c7bc9d70ed748fb7f43d9e86d7e038a2794e77cbd455955d3f40e400c83e92599f78bedf52f2d3208819a06576b14c
-
Filesize
1.5MB
MD5c99ac8e787c7c0dba40fdb2d2cbd266b
SHA167bb541b1193ec747d425766e196cafd6fd4c2d2
SHA25622edd29941806cd20571a7117001f8a905027850927683b1a97e37f53580bc12
SHA5126f572ebe1c9e0418ffea5dd30ab0d07864059a93fff3f47d6bc4099a838f78d8962ed811fe060d428731c1852c286f78191b472e86a25cd2e2c75de42d68d6cd
-
Filesize
1.6MB
MD552dda7d7af6fb85f38925d35fe63f168
SHA134cc164ce379406d633baeb53d61833ce407312d
SHA256d5ae429aeeea7aaaf14b5492b09e379266b051c601930789a936b28a81ff68bd
SHA512cf349d4c76c0bb729731ecec40f6ae451dae8fd608e9e27482254d89deb03f139485933b4e5bf05b884e3254c4c92d440e3b9b69aab2ec20e15f5c97f260f76a
-
Filesize
1.4MB
MD528913748b7903294433b9f3bc324536e
SHA1f64389cd9c67c11f5063d223eb52800f25afce1c
SHA256b3ac494054ff59902305bcc3af88fecc1ba370891e45e47107345c7991643175
SHA5124a315ae1a269da5009876c75cf01efde22f05186ae3ebe0f004b133522fb9cf1253b8bf7e0772f3e5862625d3020c02d750598f98bdbc80f174d3bc5a77cd364
-
Filesize
1.7MB
MD52fa6b3741abc5e037a8ca7db9eb672f0
SHA102cd966fde1d3eb569b40e2f856c12693001578e
SHA256641f96e911f25a5b591c9c16062ea9d1828c21c5d6c1db8aadb29de0cab9a2a0
SHA5124485d2a682d87e6338c3f17704757cb0a835bf7b77ccb05f71721934c21c82596bc40f206adeaecfd249277b5beea41b24da51a391c504b195fec2835f4e7961
-
Filesize
1.5MB
MD5ff8d43f02d9c1d1e3a5c5e0e3a9b4184
SHA16c9b65b7f82005f5fa8f5e9db124b193f9e398f4
SHA2565d76f2d70bc117b978a28b1a19757f85ed707dd1dadec91079263eaad4e95382
SHA512d90c55be75e58faaa567f9fdf2a1c4b77a33b43d9b4016da212374e0f5981bfea61d105fd6099e203921d440ff9884f31ed0c43efa3fec9cf744147ed2a4702f
-
Filesize
1.2MB
MD54753b181a56c732af91549af628e719f
SHA1b0747eff45853716497829f146339ad0995f7691
SHA25632f78b408a691fca9bb9fe7563bf40056f6c54a4fbf038880d2e75485c3c9b9e
SHA5123536cd3cfc77bd2fec3116ee1558b6cc0edff9f88ec829a0d1384566de516a0c85e309bd37bbf652adb6682fb9c16ff7f6519274f3c53dc32a23817ecfc7c8f2
-
Filesize
1.4MB
MD5167dae69325f9fe059405686210cf49a
SHA1e61ac4c1c125a9d5010dd70ad86ce56014dd6826
SHA25647d87fd396ac0264281cdd15064fb93465c7a3ee6209c48ff80de615a63c8ba7
SHA5127b04159c6d84f6c4dc9720a3d6eeedbb80c2731a71d5ac8cdcf2fc3fa37ba79dbf80d25ec5b5509004f9294770ff46396fde159a0ba7fc19c61b0c25a0599ccd
-
Filesize
1.8MB
MD5464a9b08525e2d212aa4989a75ecc5f8
SHA1f4e176651ef92d78db9bf16643da086b589951e9
SHA256773158b8e02348e301100da90c0be90a445d0988d1c40f4b3d1eb684ad3ca01e
SHA512d4c0a995298880ee3d8e146334b5a95586803ddf8d8556bf1961f6586bd73f32fba5975e7649b7422270f1acbac8a1babff39d750c9946fc9d256ae5eae5ab78
-
Filesize
1.5MB
MD56932add941866a7d19eac00f7681ee3b
SHA118a6ad2fbd386e81f206d3db9d0a230d450f97ae
SHA2565df9a9793cc6fc023cd996c76e68b92addb7efb69ffa30642a36985a96e7b644
SHA5121b7bb76f651b80f845feb425eece55e728247c9fb84c16629e69f4c6f6713a89af10394f72b3c87bf7079aab70682c465a03ad7076b0f524d69254c4e453d857
-
Filesize
1.4MB
MD5ee38afda4c97d5d0343ae446b9b3de38
SHA1064c4e963e0dbcf5c43744431d6d53a9e7b38867
SHA256b4b5ac4d644b353f18c51cc15b670028fe04e41ae981fe4b48edd4db8e91db49
SHA512669b1838f256debef595affdc29a2579b7938297c5920a8077fd2cc2d0ce4fb33baac1a5df554914e65b9b0ba35c0c56979264d7d879028bb6ec6eaffc634374
-
Filesize
1.8MB
MD54e0d4578546431d658b7e5b2e009c230
SHA172747b9472d49ca8381b4a37d5b5d1db431f4034
SHA2566e315fea5689a4f6db7f5d934640e8d5db0baccb91ebc239f754577fdc498de6
SHA51236ee532a0debd47e21669d3924ffd7f934a6812fd4d1be8094bf5360c2ce31286f57addff41fec8044f0c771da04f876401442c2ae3bb48ec3491462204aeb16
-
Filesize
1.4MB
MD5a93a779afb4942467a3f12e7f7ba8b68
SHA16fc5532ad27ab9d78e2c19fbc1578fd1b5b90ca6
SHA256d28536b1ff15bee7dfb55161e64aa87ebcdb417f2aa826fe05b290503a04cb5a
SHA51287f41bfb9c2ba3f89a5420cf535bba5e44c5fed7c6e6efe301680bb9c53e9094b1f2a533e85e2e324da4ed9ea31559a996549a138731d3c32c5413b9dd926fc9
-
Filesize
1.7MB
MD56ee241505d3c5f6243e8da986c634aef
SHA178faed900921139d954726b915812ec234ae26ee
SHA256a95533bbeef5b6166155684c957cd2f19f6337a7bf0de4dced1a68778d418b67
SHA512db2f2e59d6a8cf47638fdb79f0ac9ec3727018e214e7559bf8ca5feeac69432b16f7a7638b41dcc7c9ea153f7263874f7156ef9e5edd30521c23623c0307b10b
-
Filesize
2.0MB
MD5743af2b315d557c7b9bd3c3f41a4d222
SHA1eb3e8328e23067dc98aea2705f64cdc7c2d4af32
SHA256c80847f7b2457e8fb69ec76da97a049d70e9f5f5ac83a04734afbc49a9be7fa0
SHA51263b338aaacdf256004e1a4ce24afb4e35a27fd2d64815555ccf125fe804b2d5f2ba889794d9ca2cf4c9c3ed15f4c473b9c7e5918fca6f558ab10af93d58d4f32
-
Filesize
1.5MB
MD51a76c3a06d4902c06c2435765794a8ed
SHA1ef10286a0f8e59d568dead3046eee3c429e2ec9a
SHA256d2f3f8779f9362cbd522fb489f77841e17f8bffb323daf562f7f5e668e344f8a
SHA512a7a39e9b90544ed312a9e4b1378a5f2e1b64b14b8040f567f4e92dc694276b2a9a01eef8917032e3b3b1bde5b50801246c8cb2f045e7e8790ce602a3e02ddd2b
-
Filesize
1.6MB
MD559e3324418a4790f9e6e39641e87044a
SHA12995b87943d4d820dec1802cca371c417c5ac7dc
SHA2566af450c0677f19970d5afab640a3cf378aa220efe2468db8dc3ac8a9b4aa1224
SHA51201f3d8bc2a2e3ab512f92022ff6700a56ccbb38160543deeff7626e7f7d117521d38ec0db8f043ed668c1f422a981cced343bcaf73a57e0bdbf86f1da4c8f991
-
Filesize
1.4MB
MD571369f096ce2e3faf5f26520d911de86
SHA1810c9ec75fb4b5024d2656565005f8555c5cfecf
SHA2562ce4896a21a3919a7798c45969823f67d91292fe0193e3619835fca4633579cc
SHA512136d101ceecb40b7cc2693c59ea0d2e577c5733093580cea5ca7e65903a2fa11ac16a9a6b51dcd8901f6615e1968fdf1dbf645c97bf979918eb429160fbb4855
-
Filesize
1.3MB
MD570a6f28dcd577a6d80ba0ac887b5941a
SHA11d9d833c61b953f87e979a3a72e9b5dcc69a158a
SHA2569024f4ce95efaf522d540ca79697755ddcfe8065dd103db2ce5f010f2f4552e2
SHA5129a7200d79ae3f2cd4ce9bb053ec68da6f28548c354570287d85eddedeb4459ef1724a0abc07e3322f8b89f53f7f1ddf6bf9b4a06059534d2cea4ed9a42b8cae2
-
Filesize
1.6MB
MD50d7a7b9e9b57bb657e9f95423a55e197
SHA1fc24e3a13f62772214354449d43197c7763da727
SHA25622cce6983ffb769447aaf803bcddd3582dac6455f43f2c0db91e6d210594a10c
SHA512bc6e2a41c8595635d39689481992723447618bb4c6f54a6a493cd33dd7f35f2e5fd30774eb80100b7b09d8761d9aede9373fe2b02afc268478b658adfc1c76d7
-
Filesize
2.1MB
MD517318243ce7fdb025fd7729866788a8b
SHA1e551ae5bd77c2fed5a6f5fe712b1c28931bcade4
SHA256651942b17975e2a99ad0d73e2fc538983540115fdce8124468130d319d5e1d8e
SHA512943965f8cb1c970313575b2de54460ac79b84de55fbf78fae8ba3db27f507a4ce330fca26359f3011cea9c03775d85fab9456d27177d96e4c1fe544f24c23875
-
Filesize
1.3MB
MD52318744d01122f029399dae942fad377
SHA1c354a2ec1973eac8f4125c8e11d3d66bbb4395b6
SHA25692503c3c32299acdd3e3f2975419e0363caa5b950ddb58dc5c5ce084e56a98ad
SHA512156c6fea98bafad20dd350bfa8fa8da7be353bd7b9d93df0e1975387a10b96808d633b47fbe0a85c6d2a3416058fae4b7d60d6c4cbc9f9c8b7a8e92c474295da
-
Filesize
1.7MB
MD56f12c9d296627757828048c100cb81ef
SHA1bd0aabd892d62ffa4f1267c31928d05bf8c96fb1
SHA256faf88ba2f0d7dcb4c93ffe93c236ab7c05558ef2469c2ff77fbf30e72d895541
SHA512286f0e6914ed2d9391af88e9280af03f7fd18eb1a7b751884d4ea9c6933180159338bd91f0ff3128cdcc1484967441b4750af9e724769f8fb26a9800e22fe644
-
Filesize
1.5MB
MD5c9fb09a26254b668ae318908960b9bdb
SHA12031e51f4bd43a05a9d8415226fe834088657b3f
SHA2562e6c35771116b90d3ba407fd5b2a21741e643f8ca7eecad76af95013f2bcb613
SHA512fece2a9cd83ddb6b6b47adfb8e8984f226d620c7f2257f425f5e434cab20f8560be9638ad9a2c79db78b9bc29235e9c31094614ae0b4fccf4e1493a398490656
-
Filesize
1.7MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.7MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.3MB
-
Filesize
1.3MB