Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2024, 15:45
Static task
static1
General
-
Target
2024-08-05_65889163527f56db079869d8ddbe66a7_cobalt-strike_ryuk.exe
-
Size
1.8MB
-
MD5
65889163527f56db079869d8ddbe66a7
-
SHA1
f7b749f344959f69cfbdcfab8c5840dff9b2ea6d
-
SHA256
ab4608a62ee259ccfc98bd3a41241f09d6012ab20505eb6d83a48ae3335e986c
-
SHA512
0ccc11f6cef1a3dd7467cf9db981253aa7259a645c07dbacdb35eb89582f4a434119f45b626f60399e4f62c708dd00c558a6e8909d3ef48bb20e18e4ebf32490
-
SSDEEP
24576:ofxbo3qZCHTAFamG2DehUH4th15lYT3+Osf/lJjJScih8Qjt69:ofxbKeYAFaRmummT5lb9f/lp0ph5t6
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 748 alg.exe 1708 DiagnosticsHub.StandardCollector.Service.exe 2388 elevation_service.exe 1468 fxssvc.exe 3624 elevation_service.exe 2860 maintenanceservice.exe 5044 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2024-08-05_65889163527f56db079869d8ddbe66a7_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a9b6d4c32dbdc151.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-08-05_65889163527f56db079869d8ddbe66a7_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-08-05_65889163527f56db079869d8ddbe66a7_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-08-05_65889163527f56db079869d8ddbe66a7_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-08-05_65889163527f56db079869d8ddbe66a7_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_81359\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_81359\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_81359\javaw.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1708 DiagnosticsHub.StandardCollector.Service.exe 1708 DiagnosticsHub.StandardCollector.Service.exe 1708 DiagnosticsHub.StandardCollector.Service.exe 1708 DiagnosticsHub.StandardCollector.Service.exe 1708 DiagnosticsHub.StandardCollector.Service.exe 1708 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2308 2024-08-05_65889163527f56db079869d8ddbe66a7_cobalt-strike_ryuk.exe Token: SeAuditPrivilege 1468 fxssvc.exe Token: SeDebugPrivilege 748 alg.exe Token: SeDebugPrivilege 748 alg.exe Token: SeDebugPrivilege 748 alg.exe Token: SeDebugPrivilege 1708 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-05_65889163527f56db079869d8ddbe66a7_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-05_65889163527f56db079869d8ddbe66a7_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:748
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4140
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2388
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1468
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3624
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2860
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD51755054b19fb29bd5d09afdb631ca4d4
SHA19c02eda11e28a2f89fec30ee37787ac6435649ab
SHA2561b359bf847a3025c6a2404da57d502a44cfef557ebb4f4b11980337ffaad9f30
SHA512d929c780d64e528ccff23cd696d5b3184a63951bec81712aafc6a23353986ea5950e47172f19f104426aa3bdf5d8a2e442e31d34f98f763dfa3f5177c8370151
-
Filesize
1.4MB
MD537bd25edb6bbc44e173d6a11700e41e4
SHA113da01412814d1b0ea7212930b5ea70d85ff3318
SHA2563b19ef8c99ba0bfb430a81a73098320f29db4ca695d2cd229d309a803cd5dafd
SHA512641b80af6410aaaa6791f82af5dbdabb7500e75ad06ef211bf86c4d6a9e46987d09818e89f30dc2c77e3f818206040bac1d4806e6a00e882ec85217dd61d91c2
-
Filesize
1.7MB
MD5f7e09eb19590cb887f28e262d4e650fa
SHA1db4f5b4e3d36ac310181d38fbcd9d7e6707415ac
SHA2561dfddf535addd9d6354f996b3c2e01bbc082dd3a2aa70d5aa21877625df68faa
SHA51299756eab2d778a16f4c68b788ec0fc0a65134da8929ef51745bd6a9534d4816cbf6753c8a0e30080c956d60521f98d02bf1247382a495611db8b8fc938a7eed9
-
Filesize
1.5MB
MD5abc599fafaec4092c90601f2dafb41a7
SHA141035857c95f69b39ecb3f93b302507209411ba1
SHA25624768e45d51fa9d5bdb36633e07dc7a409e9295bd178ec30109f8a379f3e6a1d
SHA512db883dee0f846336820d0461adc98568c90ead039938f2eed0b6d3b34b9da718c3ce728f92455df69e3b7a75c6fa37b21f716ef004c8dc0fa54abd646e674f73
-
Filesize
1.2MB
MD59cbd2d0d522ca4485057a86df220ad10
SHA157566430bfa4099f7d757926e6b0288002c18514
SHA256ea5ee2179e01b8a64e02e987ddbfa09fe63e9f4dfb643d3aaa43bebade8be650
SHA5125a89f792b63284a250485bb67b5f440ca4c9bb23759cf430532dc91f1c7301404dbff3f26b0c4d94b1d5957d1dd1cf301014abe8e9d2e865f70ff1ad5076401a
-
Filesize
1.2MB
MD55b8ee4387ec5759222068f92ac887d0c
SHA1ece6d60ad6c0aa51dfebd8452b0593a29131e455
SHA2567ce27dfa2c6c228ec54ce3e3aa3d2ae60a16534de531a4da57f9d97b600c990d
SHA5123365ee982d53c195c17f525856a3b0f76e09eb470c3960cb3702d2ee87dd82a6897359cea20d11ed07d257165d481ca56445102c76bc79c871ad41badd0c9144
-
Filesize
1.4MB
MD5e4e521b5d552fe6131b43bd8e7cef4d1
SHA14e04a51757250cd2da099b859e5f948cd25e8af2
SHA2567b8c195396cede47e69d215e3c68a998f8d896273a39bc5a6888d07be2371494
SHA51263450e8601d21981daa468d2557ec0141d820f1a0fec14f6c9595f7d0372ecba7382411e6f194306c5dfa2bcb8d646f4a8e139e72f3e00abea24a008b6c6189e
-
Filesize
4.6MB
MD5a7c46435b5c3521e7251753b9c1ef54b
SHA13ac0f544a6a371ac0e3917b91c458a0132af2b56
SHA256859b339f4aa30f89035423850d5d667309d34edf0f1e0e63f96da111cc8270e0
SHA512b1de6c847e4ca9dcdc49fd1a199a73c13787be715168ee5f7c1744d59076f5a7362b4bd6dae15b697ac8c85e4198d82858962c234495b8da7abde142737b005e
-
Filesize
1.5MB
MD5719286f72dbd35804a02a6cc3cbb1a1a
SHA1387db31c9f5a291aa3ed4fca986ac7ef694ca99d
SHA256dea2d08ecb96d6c29c3d9e038d7914251b293b8273068fdf94cc8e8c9cb91ffd
SHA5126b5f3a02a9e3e099304368da133fdc7e1ac70dd77375974b360a8b3949601896a73c1f9e30b6339d9fdfb894bb30c8fd66df81e9ae9ce6e1e8e191fb4a30c715
-
Filesize
24.0MB
MD57cd8251ba6e6f714ee730fbcd0c60091
SHA1e75f303f1fbc09f73ed760163d442a56a18c0e34
SHA25673731c819d0539686f964b878bf711ccd1eb9b4169b05458d934ce32372be36e
SHA5127fa29473249eebdcf6b71b523708c9a543c0d9797133acc805ca6293195e9d564cb0db0d92c9c8515c3e22e06a98ae00ed5859f31671dd51de8c24d8612dcdd7
-
Filesize
2.7MB
MD562799775c6e5395bc4cfcca128e46d57
SHA1d5cedbaa1bb1e5f77705012e86e235ed94ecd9a2
SHA256292e4c49a1d7383104b19dc36833a138df2e477a21c4556d4508f2114b1de0b0
SHA5120f9e8eaf7cef79f8f1d3a0ab8127448dbec4b58e12b69d4594185165cd1cb8768154b347ec7faea45a32e7cef7132f8cfcb17852e2fb3b62c743a51135551fa9
-
Filesize
1.1MB
MD5d044031d70e28886907e3c3af3834fb4
SHA1377976dba4714ed28f34fdb99277bcd2e1f3955d
SHA2565c3b52ef83903c371f3ed54ac829ff7e4cac1712beed3ad94a0b26442a84350a
SHA512d7e1108919e2e653861251719cbe554370fb5f1292c706d14e437475705dbca36dc1e1b75cdb73130155e9b07599740b99d29c71af1faba9b9a0bc0432ab8246
-
Filesize
1.4MB
MD53cd7ef4ef210488d4dd572ba80745d55
SHA17f65245c2ef39d4c831ea3cc47791b4f10042899
SHA256a5b2f0a24ad1d280f7eaed6ca1f0bdea13a920defe8f7352fbea10dd19bfd7b7
SHA5122dd234094de883fa8be43da63b8ecd31b6f0e77a45f79628ea6198d4f6ca76da5edfabad7a0483556d76a326022b47239914cb979087b6294f87fccd51eaa961
-
Filesize
1.3MB
MD562f85fcca52b2826d3bdaf2810595d96
SHA116518293e69145337304b530606a4fd7b15b2f8e
SHA25615cb65a5a272fb3169af8d8edcfc77d9d29ec9aed363df9c5d109b61df94c173
SHA5124adefb9838a916d52592919ac13ec4ff6b182f2bd905a3c4dd57a372b253b9e3d2219745f8414d8348a023d03180b0a46c645cbf6ec2c043add471bd8f5bad69
-
Filesize
4.6MB
MD525d68068e5f614f4dd257e78ccab9021
SHA192657d335397599f4846d43e96d711c89c3e9629
SHA2569ed9a90e1b16163b5046734e13531eb8df007afcd39cbff3162ec59f848ef1c3
SHA5124b2d54636fe5d2e44a623e246c4d6cc64bf0a379d5b909fb8b7fab1d40d5045b45e0137c8e8bd7d62d5181e01c344ab0bea9f0450a5688fdaf2c9b5ca0894ef8
-
Filesize
4.6MB
MD50be518c620ce953d99f10d7622bec7cd
SHA1ea2d98da5f8ed601b0575c0699f1f7d996b92ddb
SHA2566c2147d4832c5cc89cd2fdc9aae3c765869ee424f9377de20836856d5a1da1ee
SHA512bf2202003350956cfd997be5b4fce977900419dc4823aadbbc5eca11336badb5197700abc8111c0a12a362e0734b450d33b0ef1b3f13896fc2766abca5a54d3e
-
Filesize
1.9MB
MD5d7327792b3c0f8ce079575490a608b69
SHA109085cb9267ebc30120f3b5721cd921e35588300
SHA25688be45a39cd4f5d5bbad3fb3ee5e5cb8a413df4e02cac400228609a4169e7d6d
SHA51202b3ddd3f509b4b4bf4683d382e57ef71d3271878c00a9e38c894478bd3f0b1d2e2345e9018096e1090f8532a4da5f1eed01bf924006b87dcbe241f7db80392a
-
Filesize
2.1MB
MD59b3a36fb3f6e15bbcc43b233876ce8f9
SHA1e85e00b5380abd965acf8464bd4a65043b2ca927
SHA256e748a0ac0779d0c6afadd608ec89c7cad81310fd759788f1409ae2cedfbd924a
SHA512053bff82622c67bf98734410fe172fdc665a7046d2a95def245b73a6a54b9214aeafe855c8baf4d70411fced386a4bfa5fb924fd8e6384b329f128be9d94b085
-
Filesize
1.8MB
MD5b6ac663b620bebce701d707ab3e01a91
SHA12143bdbf93194ef0f61beccfaeee565d429a49b4
SHA25664f9dab66aaff21f7997b7f930899b282d3d39a2af3eda95fd9d7707bee51d11
SHA512769c18b37fe089083fca7470f698f2e499f8b8a20b36a7869f03ed95fedac2b2794974f0b61fee976ec03f3a9f450d03032010c00a2b2da6047439bb24328141
-
Filesize
1.6MB
MD50628e4339bc8d02e1ebe5607b9edbaa7
SHA1537257fcab396bbe6e213510811d1efe744691c0
SHA256dba363b9df7b5e86495f95bcbf0dd136b636efb86056d64114842d65328fba39
SHA512b72efff03ba02e64825aea5041c60d8a2c228efd1b82830adf1a91e1406729a1ec44b2c4236dce0baa59bf2de3184396c4723a89c403991ba54d1baa878d0ec5
-
Filesize
1.2MB
MD59966fa5bd124591ac2e3084f31955c50
SHA142c17bc2e0d1b7262e30d584e65285d54084d1aa
SHA256be96a49a5353e00326d9db4d788f2e76d87a5f26375722feccc2d8831807f2b3
SHA512c186032881acee109a5851fe701ad0086e757512f2480b8eaa8aab48110f9be3ded586bb80bb15b9f58096f6d1ebd6b62e1ccdf7719223673fcb0dbf32049d06
-
Filesize
1.2MB
MD50834c28160ee006c8dc611d10babdc8f
SHA172885bc8c281c3b6d5185d096e14bcb534cca1f6
SHA256d42770d7de8c33074235050166418db027e3a6d5875ee37f1ce6c6520009e27c
SHA512e19fbbe0d9fa9d4d4e511e77f2f044659ca8c8a5662ef1c1fa305de6644fc5ebd4536c23df31e039177206c35f6294896faeea25da1db52e153da06ce2e6aa45
-
Filesize
1.2MB
MD5b62e12b663688a98bedd0908da1c310d
SHA17c2b073dfa3d23f79e5d255281a79a09ceb76ab1
SHA256f0958a1bae2a7d851fa82be006888c705ff9bd28a5712f6b26abaf26ea266822
SHA5124e8db6c7c8aee1f1cbdff3bb996581053de70f6de6aefd67204070e4e2733a80ca3ae29ee248e41c0998f5b95c2100100fdfb7c982fa5476f9903fc183fb4662
-
Filesize
1.2MB
MD532d91d0217432cf5bcfc49717ccaadbf
SHA1537ac0d4933a115658a0162e60d4faf2b2818d55
SHA25640100834bfdaf0a7ad55151ea969e4179b41f6f8912a08435939a6e0a4f767d1
SHA512adc4621d2c77a2c5143da7032a38271ff50ef46142bc220966dbec6d4373c49e644009d61e16ca5f096ef89b169b61bdba2c417b98564492affd51ecbfb2dda1
-
Filesize
1.2MB
MD50adf51f86abdaab217f88014b5a48ee0
SHA19968a4db591088eef9467b2c35aacf3824d5b229
SHA256db5e47e96f44bcd900fdfee0f7976490ecaafbe86a64370bbd216f9f34812071
SHA512a68bb3c18a8705733fc24bbde3f47b8b8c285b4c1f3aa94f94df6e41519dae632b3f4c17cd494d88415a136aaf6ca4bf1add006a75731d8b062091e8a70f84df
-
Filesize
1.2MB
MD5121c0da5a1e01301f9c3e38bff10e5fb
SHA15ab825998467626e859ebf3e1c2f81438b3716a8
SHA256d4d88eefcf0ff9896166329a9ecbca5c0f30751326af3caab1d9792fb9d2e61e
SHA5123b00e6b043ab3f7db0ad30b0af0c6f728a1bbc97870e09e10bb931628f4fcbfd124e5bb871b5a27f9bff37580f4a818f08b60d59a15baec3ec0515b23eff3a7a
-
Filesize
1.2MB
MD540bef23126af135be2fac6213a4c5f82
SHA138ba2ef4b273939abad56b874f3ad626881047f4
SHA256d7978056ab712dcfa90e96b4036091e0bcb160fa772d3d5bbf81f8cc414236f3
SHA51220641cb59e73f24cdac02dfdbc7db4f1dd439ef0ed69f377c1cb60cc99e738f64376bd37cae27bcd62372cf7f94c7ed23d092dd2fe0f38a6d3b7b8bd694e1afc
-
Filesize
1.4MB
MD55c3a50f8968514ee18ab2dd3d0dc3b3e
SHA1606beacb9282428a2c74d77f4c69506b60096146
SHA256b719d84b5db585b680844f557d0bba2849cc9a342fd854de6c388a095c5cd4bd
SHA512d157f9bac9cdba8651bfd171c3e0a079464c20947e2ac6d6c5d5b2818fffe0e01bd197838313b2257d8ddc90035958ac0445c65a94e575ef5b8cfb769afe9681
-
Filesize
1.2MB
MD5877bf188067067cd55fb37c615257b26
SHA14ba76d5bb36258ab2431002c83713050f4c4c2e3
SHA25662dd54ea8a6828e0b360b33a4db9b66cf66a219c87de09a1848954b10f8fa8d1
SHA5122ba21f7fdb50d2e71e6ceddd5753fcc328eee167288bca0902fa875b2e4d4ceb4387d8e1ed2c67fa3e10aecd4905b62b98a27d1bd2d1243549bf5010c5b5488a
-
Filesize
1.2MB
MD53027e81b9a570a70e37b6368178b35c8
SHA19d5794080697f2705a23b410582e6e0ba813811c
SHA256564dc8a000abb7954102d8f47bd75f9da62fb243da03c4d68f553a2030996acd
SHA512ab47d7cdded8f1db5a6a670710145827d47a0cd2b43a63d6dae85f0fb006d0754c115dcd00f32daad5878b6587a09c9209c5fb625569e1180c1a6e64ad455cd8
-
Filesize
1.3MB
MD5ef1e3164a8a293f46e19ae88e97b1323
SHA131207fda268b9eb55eb1840775adffb54bfc5eda
SHA25691820e03e82dcd4405564303cbe5548a8b4b0f9375046290c640f8ecabda3e56
SHA5124266fc71ae6a8cc3758f0d990dbbf29633c4361659ca1578fa94eed178d95bf3cf6a60146af8c2f4e6d213ae1ad27c41d37414ebb60166487ff0e16703a7cdc4
-
Filesize
1.2MB
MD5b36d09d8a24c9961fcb81655310a9551
SHA1d35fb15b1ad606f203c6bb5ecada4d6bad5fd6d5
SHA256e1c58b6cbb5aee044b19f1b77af85a03543168cb729f7698fa09711e0856bab0
SHA51222a8ba79dfc780facb07bb6113fc2d3f0f611bc91bd8c9c197dbcc957264dd3614f0c63f36cc6ab7e440d70d8a0fc464a7b8137a314ef7fcf920967e0d53bb58
-
Filesize
1.2MB
MD5ae8092fafa7609af787a8e355bc0aca7
SHA1a06d04b0b17dfcffbc1f5f3037c24aab54a1f482
SHA2562a8dfa3742b179200404bdee63553e8eefffb6cb840816886ea4b538c22e9c46
SHA512846417ead27f18b7006a5a5fbdef5a4c3a838cff3a0790fea2c419be103e0706a03061ff50c249379eb3091b9fb19b4ed4c9b9181a979f3e55a4b07bbd88a74c
-
Filesize
1.3MB
MD5461dbd1c6a114c21f405bf00a81924d6
SHA19cb1fe7c85ca83815111f347d504030f3f1d1e79
SHA256002599ece7e8e486db50505bb727eb995cadb24f9f47c9edba5c1b61b7f50465
SHA512dc99ee906f792da34bb6f28cfc8b62328e92e6c089648fffec1d12b4344dabd4c65f5219ae3bc8d96014baad1e91550e1013036d90d54f234fbfaf995e222e39
-
Filesize
1.4MB
MD50d804ccc9416795d672d3805d07e56bc
SHA12a0e22f1a32f68e385134af1c41fe2ecb7556503
SHA256f1bb425beb98326e4b28c489a9f7c0513b0aad6c5ff4602ceb184372fe378f24
SHA5121aaf7f4ac6135db7d69836b8c125bd6a7e4664dbe3af279cf42cd9e1c1e4cebd064844697b6dfd5d92b16a5c8b3b5c61e39e99376a42212d6a534351ead3b041
-
Filesize
1.6MB
MD52ef3969e39db73514fdc09a31725ea77
SHA14c3a87d7ec9d90acb59fc4e129702abb8268032a
SHA25639ae071292bd4f8ad1f56849355971444d383d8370a61abde7b1565db8494f74
SHA5128c424644b89c397c8ee4e04e77498993d5a4f6a47d5b52518b497fa8cd269d457dab4d0b03bce7bf39d028f337302c99c3a94e5e55a6a16e8d3e85418a480082
-
Filesize
1.2MB
MD5157bd45cf7588ae37467865b6c8ba5a4
SHA15515eab5b125901e5bf67c718730161ae46312f7
SHA25680e6e130b2b09214c91394e1dfcc2e7dd324e5d70f03fc8ea6a467c2e7328802
SHA5129404ba48960b50342b04748cf52598157bc0ba815d9b4480ab50a070e2191ca4081ed3411e8f13410074ae14dd00ac79ac9bc577b768c7e6d4ad1264cbd14901
-
Filesize
1.2MB
MD50d896aa515e73b40a01576f54a8a0369
SHA1fb2c7656389251048f256cf0fbbb7d60abfbac4f
SHA256324592ff768855a472b872ff49922908ecd0910e9083247ee2f47e8edbdf4ea8
SHA51254c474114624f1de0cbd53033144bc0de8581ea2196ded5a1bbe683a14fcba83a167d16e4501e9fc453bdeb9c2db629e5c81c9043e0ecb011b373009d9d65af7
-
Filesize
1.2MB
MD537c349d08f0f277dc142af3c3c2ac3d4
SHA1a6995e0e632da582e2466c51c7562221611987a2
SHA256142a9d9921cb446d2ae12de79a32fd65cd1d3f6f517ca95414c09c2e6c122317
SHA5125bac9920722fca97adc9e68fefd9802a0553ea3f4c5290536a6b3208e6fca197083fa4945edbc8b6b393565850feb38b19c34e3d6dce345d9d1e05b542b6bdc4
-
Filesize
1.2MB
MD5061d1c286fda38c647a1f9ec832ffb20
SHA1c08bc21cff2c2ae435dca960a08f714b6cf0b756
SHA2568cea5446d410aedcfd8a086beafad11f9b1d0e907397fcb29f890b6790968b54
SHA512721dd5db038b2f68a4818b411a5f3c7ce95ab837816554b0076457f2e4b2a9b775374234eccc2076751fa94644776fa15273e2eff377d447a39e80f9f0514a51
-
Filesize
1.2MB
MD50b0dc952a007faa1b17e81dd5542df77
SHA14c20e83eee7afe1d4e29563dbbd0a9ee1f5f0382
SHA256ab1a9cb1befb060921973976c56d6ffbae9aab51d591216af217038dc4113e50
SHA51238329fe2488257471f7ae8f67a73c95c404a45a362ad98dce1e5934c2759e6bfb3ca314b136bbdf5be8b278b6c58fe5e67cee0b94b9fc6e6a819146fa64bddca
-
Filesize
1.2MB
MD5cba463551dbd883b6a101b5312ed6160
SHA19fddd2ebfb54f5a98bd1b8e92b4cb681ef01ae86
SHA256b8c676a189104c8816c26219bdfd3d194774b87809148a473e378cc823fdc470
SHA5127ff45591ec142d03118ce85ced452f739eff0588d39e178a3375265380e28cb133edc8df76e13a8e9c9218796f150764dab0dd7d3437175549ebe87ed9b8d48e
-
Filesize
1.2MB
MD581e3885d4d08f2e00020c2097fb59009
SHA15483a8717e0b58b13542e980b2bc53c8390bebc4
SHA256c816be615c130080cd4a1b1f4b69027ceb5fab3b41499531b8e5c41bf9741151
SHA5125999b380d0b724b528ed17d8f73adf66113ce8bf5a66ad09f1a873cb54f24fee76051e2f025f723c11191b6d8ce112e3c7b043b5908c6b9c4ee2873f70aea151
-
Filesize
1.2MB
MD5cf606081b9f38ac6d1f7ec45cb583c6b
SHA1f75607e23212ac8088dfacc0d058a3771cbaa790
SHA2568ddc190d3b5645cf237665509da1cc4d48cd848c4fbcc1f0341aa82e7e7af24e
SHA512010a9376eb1eb7d0267ab0be9b4e93d1b5f07b21559bea906fd525d4f0597e58d051f9e39a83667146824587988b01c50657685b3e52492e1648060f4331f3ce
-
Filesize
1.2MB
MD5da84c56dfae057629ddc408a9575b917
SHA10428cc2be46e3aa911c0115514fa018b32054fb4
SHA256d3861c05f44d1ea6ea22e280e69fa9082f478955e11aa2a247be4b79320005f3
SHA5125e69e96ff3ff00a1eef1ec08946e2c4682e9c2977e849d7a15efebe7dd9dce07d498ed60dae19bfcb18944091c7fe169070a7717425eb2a3a805ab709174302b
-
Filesize
1.2MB
MD5e48c97d07b2d2214cec15579681b704f
SHA19bd16529475ffb9c445ec57fdcd8773094130fea
SHA256d7d6a3c568192c85bd7e9f43bad05529118d3d9e3765bf3f9d21734be98441ae
SHA512b8f6554400ff59c2d725bf2d72025df94f3d5ffc389a94ecf84a6d52d0736f6f047e4e00e3aed47c60c5cc989c08c14e0246aa14802c2bd5b49e88b0bad075ea
-
Filesize
1.2MB
MD50af55ec52bb65e1790c8b981fca88bbf
SHA18f22fcb2b8e102c9fd3d9a383efc5fd844ee98b4
SHA256545a6bc9d7db0c1e1fb9eee64e4f3641b23c4aab94c24bd1e9741a8c4b585a45
SHA51284dd842c9df6c1347078ba30ce1d717a401959ab9a67142c4eff18f03c97853426621b1bd9a23a8b63ffc3e0eea69d7c204659567a149bf5875bccbb5fd69919
-
Filesize
1.2MB
MD504c417a80c7f3ce134d4a0bff0370eb8
SHA185285b917e3ec92448f415570ebc7ca209e07806
SHA256601f043ef83e25b176ac6c86b76f5e450e153d9656fa9ed6fabdc36e4d0b49f9
SHA5124df0d473070422ef1e11d97fa336eb656ac6072a5761e815d7d599db747828ca5c9cae1c27762b4a9e260e5c245a93cd2dba8feab8c1c35da4495d3be9d80feb
-
Filesize
1.2MB
MD53796ce4a9bfaeebf5a6cfa5032afc962
SHA1a273920927220374ac7ed001b4705269f949dc5f
SHA256dac94cf96870de562cdbb5557bfc68215d0fc74a8f8e10a31d6139dc7261831e
SHA512ebbde660a9438e6ee3c34b2a6ab537c424c32097ae928d291d474cc5c6e00bbe1a5fdbef47ac2bfe80bbb1264ba41c4153868bcd02d2a6a849755653ba9e3b00
-
Filesize
1.2MB
MD5a5c2b86aa8c19ce3328f247d9e215e14
SHA1de641231f73600c357eb835457c6b3555042a941
SHA25644364d5d4553bc4641833724017669153b9445a7e5ce57526b37114d2b6ce452
SHA51275fbc74bdce66ca72add09661642bbaa58299643db07dc5c3b438ff371df4aa0a0b85834cc7a3e559c3f9b63a08d202925ff949bd490ad35fa03779db10560e3
-
Filesize
1.2MB
MD54862c75d5f22d132c049298c4c541e35
SHA112bbcc90a6dece04b5f1111ffa0c0d516744a5d3
SHA2561199ebc5ddab36bfddc72996ac21f7efe26a2b576acbe05ee3d49817fb3cf570
SHA5127018caf3a0e06f1b133746b9623f554828816b4f178e8175dd377186df8a4eb8fcf49ebe62140e2af3397ff1f3e23437bad3102540dd202eee50245083af9a06
-
Filesize
1.2MB
MD57b96ced32da46e2940f0a13009c177d9
SHA1d56e89099ffdd49d16e2c1853d118b794340aff9
SHA2565c699216bc58e9cdda7a0002d3c8fc62a03e818c5a2a8a01224019b36f2f8663
SHA51235a2d9a06b34dabbfba7a45bc58c272c2fc70e357046ebf74bb9109e2d6551bababea3fa0668de031bce81ce7cb37920d24e30f40edf8e078177ea8d8026b1d4
-
Filesize
1.2MB
MD503b1236fb59698f6e98e0ae74f63716d
SHA1d0578385ae72b658aae50febc1703553e90634f8
SHA2564cbcedc2f298fa74fb98e64fbd30e261bc213ab4a0b6c2f16ad7290499a60d38
SHA512da28b01451eabac7b2a71548550b22038cfdde9bb95f0671344a31cc10187af10782769b51d49df3ba4720b3ce47cecaa5691e1712a77a7aa4f1d214be1e81ae
-
Filesize
1.2MB
MD57a158deb3d0a844978b6560508bf0999
SHA11d5985999b04df1d1ef8bd8825208a07d1a8917c
SHA256dc09ee0f2cbffcd975f6bf7cf4b73c03928fc6f11c2999fb64351d0edd878490
SHA512b0439fa689c60967a80acc92824efe189ab8afa2baf1810538353258506a9a094772d1c32285376be0deb42351ba0b0e46365eda4160b7745ab973ec91164b7e
-
Filesize
1.2MB
MD58dd907e15b002c0ba36a5f02b4c6695c
SHA1cd77e27c9506a06b50b64e577aaa40a7631987dd
SHA2567adf17736229652101eaa9186c9e625c4fe04fcae0a50768d65508801ae829bb
SHA5122c0e0fdc57c367c32fd1a75d1ec59726ef9a6197ec292be9041498ef7e6595e702d5b6fbdd865168273929274934111557a19214e31995c87edc19e89eedbeed
-
Filesize
1.2MB
MD500e06d7357d70b66ec4bf91166df1b43
SHA1c97c8eb8cf59c6e7825ec5d58735d582b95d40df
SHA256e0ce09ea1147d7ee8a72728efb479a12bc46d1ff6ac78003913af41a581b53ee
SHA51224f9827fc3332243ef29ce13a07ff8c37a5a08aac8e6f03eed6af6b1ded989c7b28a3ca9c02f1d2114c309beb5b74025c7cea9cbc019cb7acedb699d32e95baa
-
Filesize
1.2MB
MD5e79b0d5b3f2530b2389c2520138ae04f
SHA108d70f5b1452d16b96caf82aadc5d6846cc50f47
SHA25626eb37a4266a7c1bac9271d27efab5b80d0c4a393f2c8188119867cde9f88823
SHA5126d1ae7b2852bc2b7794d2ce8b668c6fd507e95cbe38cef044ff264774fdf2bd5d47e9a1dc0469543d3b3819a45847dd9789df933ad90ab68c1a0f8888862e385
-
Filesize
1.3MB
MD5038d6cc4eeaff714be68a143140bd503
SHA1be939b4db801d0216d2fdf42461bec5041074c03
SHA256eee90efcd871a90367865e235528a3f5027c2c93c9299edcce14535c1ab1c9be
SHA512e6587370906adda8f0dad97b477b59ec1bb88871778372b2140fcd5a03c79acb7633d3ce1e1818cf3d7fa05c3078dcd78bf33bd9a22e25020ecb3b8a0a319978
-
Filesize
1.3MB
MD5bc4646594f06c84b9f353028b90e9aec
SHA1fcc4f9ac65e58150611b35b94c0f58a4b2a3b431
SHA25648096fb4af7a5120149890ff2782eda23058c486ae56f5f577e0dc05049ac85f
SHA5129a89c3eda4e09900a97b918f84db44eb61cdbb5c814192265eeb71f325f7ccdcaa8dd339e2caae644b4c9a7257b1ebbaf8f7af98b73f99d288c6427166a2e894
-
Filesize
1.3MB
MD53c2994139ede220bc1c2aac4ffcc5a28
SHA185efb837cbfb37d75041b03577f653d32c4d5269
SHA2569e709b0cbf8597b781a94b55b2cd4c943b2f387552055018b8869aa6634f4916
SHA5121587e59bda265bfb681bb52f20a73e0c41039cf3fe36cbceded2b3b9209972c9b1513355308e9be4ff76db5304b837b2a2ba4c58027adbb60c32a50600390721
-
Filesize
1.3MB
MD5c1a7dbc5716b54aefda021918fa1f9e4
SHA1924522b4b40facde87acb83977cf9f5d934649f5
SHA25686390ea6a51ecf30d2a07aa356b7df0029e1fa91c96eb6dd41c774d7b043ec0e
SHA512fbbd0e6718bec6c16b2c5521cd597c2ab88825adcc65237ddadb3ceaa552157959500d7f06ff696e6666af9e0f920863f9c74d0d3e2eb1368f1a57c30bba83ff
-
Filesize
1.2MB
MD5b545654c5aadacf0fa1acaeebe557597
SHA111b31cbe48a7d0e231a6d928a6b0302d6bd9cfbc
SHA2568340ea19311b752898b4d3d14f90d3f1923b0a918ea13c2362ff6a762d63054d
SHA512f831bc7d29b884ffa4ffa8c9a030a975a9cbf5fe7baae625e031e0e3cb29b12d2deb8e29e116d12c88c1cc1ec1e4682b94a134385f5c3573c4e7fdec36992bb6