Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2024, 18:34
Static task
static1
General
-
Target
2024-08-28_2e5ae1eaa32ba2154bf516d54af9ec2e_cobalt-strike_ryuk.exe
-
Size
11.8MB
-
MD5
2e5ae1eaa32ba2154bf516d54af9ec2e
-
SHA1
add6e87164614a836841f9c964b3429fd7db0ca4
-
SHA256
5a03c35e85a0479504db68144d55ab02998b9d95bdcffb0dde924f3d1efbeeca
-
SHA512
c76091d5522ea347f782b0c8e38702bc1cf2c3a84b715fd0ffcb57baf29e4c88812b110b326a5f30d1dc8092dcd4d04116931d2c7955d82e03a750f1600a3b2e
-
SSDEEP
98304:Ny/Ig4Z0nj6Z+jBFRwoDES+a+yZu+quxSIrQ6b0LDz9Fe0QxoMDMFb1:Xgg0jV0ta+E5Dr30qPx
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 1708 alg.exe 2436 DiagnosticsHub.StandardCollector.Service.exe 2988 fxssvc.exe 3512 elevation_service.exe 2068 maintenanceservice.exe 1844 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-08-28_2e5ae1eaa32ba2154bf516d54af9ec2e_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-08-28_2e5ae1eaa32ba2154bf516d54af9ec2e_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-08-28_2e5ae1eaa32ba2154bf516d54af9ec2e_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-08-28_2e5ae1eaa32ba2154bf516d54af9ec2e_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-08-28_2e5ae1eaa32ba2154bf516d54af9ec2e_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\c8b7ed8f2dbdc151.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_81359\java.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-08-28_2e5ae1eaa32ba2154bf516d54af9ec2e_cobalt-strike_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2436 DiagnosticsHub.StandardCollector.Service.exe 2436 DiagnosticsHub.StandardCollector.Service.exe 2436 DiagnosticsHub.StandardCollector.Service.exe 2436 DiagnosticsHub.StandardCollector.Service.exe 2436 DiagnosticsHub.StandardCollector.Service.exe 2436 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4328 2024-08-28_2e5ae1eaa32ba2154bf516d54af9ec2e_cobalt-strike_ryuk.exe Token: SeAuditPrivilege 2988 fxssvc.exe Token: SeDebugPrivilege 1708 alg.exe Token: SeDebugPrivilege 1708 alg.exe Token: SeDebugPrivilege 1708 alg.exe Token: SeDebugPrivilege 2436 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-28_2e5ae1eaa32ba2154bf516d54af9ec2e_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-28_2e5ae1eaa32ba2154bf516d54af9ec2e_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4328
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4632
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3512
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2068
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD527f8048c282cadd47adb21b6369e3061
SHA1963ab6317528e5a9bac5924b31930cf892f3cf58
SHA2561e9edcec917b6b41ad411110f8e495a6d24ab1f6371c2adbfe1aeaab7cbce5a5
SHA512b3016cb50734cb8edc798767b62d5e22e81d52ca4a22fb3f843e5846f605c53610b693ca567bde8bc4a649df03604a44df3d1f5022559b29c55b383e09b54feb
-
Filesize
1.6MB
MD5a3972d170f3a9358d34a20a640bf4ba0
SHA1e4a63f1c49f4339790729ed65b57a59702b3e5f1
SHA256ef544ba110c13ec969ed7ec89f13dad86f9d6f4d7d426a2070757d925d02ec0e
SHA51236903e3b5df7836b9e713c28180fb362fc74ed2a71c29574a6a48ace90af398c7a039b3ddacc32ace591cc08277d5db3f51331b3ee876b85c0083cc1ed5900fb
-
Filesize
1.9MB
MD582f2c268ee94277283940d0d5b51f7fa
SHA1e611e433aab6bef95f99f2ae8e70aed2cf38e221
SHA2567d040899b454ad0af1f09210ffdcf60c5bd3019da3b8e66effd7663c7773467b
SHA512d39bbeecad899cf83a78f503abf1b6a8a3f996d61e669f751c5d2a3ee5af157b3657da277e96a2f3a6a07e269fb0d591985004c2e28b90cb6c7daad34087d1ae
-
Filesize
1.5MB
MD53f6b6e812e99bc345c7a887b607e8515
SHA12cd8929c5c072a45c8f2ea9bd15aee1bceab70f2
SHA2562380fd3428d21c04c681579779a767fd7eb7bec20e2596f4339053985701d7a7
SHA5129c7e7fb45cec47430c4928c89ef07d03d37aa5331c21aec42ca887553ea9ea52a21ac47dfd9f64e7708a8695a19ef6379011197c9b56e998e9ccd3619e203c51
-
Filesize
1.2MB
MD53806d6f512477a2083b5ff42456617f0
SHA1f96bead26a77155ed71f61a86a458f025c4a356b
SHA256d92358364f8fdb35e766bdeb44010219330fc30e81728fc7098cd774f9f1cdad
SHA5127f40271970124897bc6f4c4cbfedba66ea2fee8e181703d397b9e22f6feb703bf71905fd2578284a7e1007ca7dc468bdffed3fbbc2eb7a6147302eb03d25b1f4
-
Filesize
1.4MB
MD531b5b5904cee75d834dc46aafd514506
SHA1c49cbed1c3003e90af4151d99b26cc36d0a1fd37
SHA2565f8c966607940bccd27b485ab7d35e04ddbafce6df0c844286f9cf2bd62ce15a
SHA512b4b2cfb552e13c97f968090d83db603fd62cdfb57c31d7c60d258f5f5cbe9fa88d9ff7a9dd923dfd9f323da51760b444e87f524670a27d93bd2123d57ba28c53
-
Filesize
1.6MB
MD551037fd128d1fb2310088cacedde0c39
SHA13d833f5cb0f33ea8615d04e1e58862530707dbe1
SHA25657d09c9f0f7877d1fef8f880b00da372ac9e08c689bdc0d2a14b044aea0ba022
SHA512a9d50e8398e7865c25f14ed144442d67ced1dc7ca4eeac6c78c9b4395718c4aa466ac4d2327dafacf039a2d7e93594566e0a3cb7b46fde74c66de193faa57edb
-
Filesize
4.6MB
MD522451b3023b68978751fe4c7bdb5d466
SHA166a15ab6af766c8a833748d8cba8ae166cd575ec
SHA2562154336f078005b7362bc649196581e1c96a746534166dc792215e396c2dba18
SHA512b96075d811793b9310c844aa4283cb49dd6353fef5044c77a83ac01935ff0d07ad0bddfcab14c4bf04f0bae8c6eeca23b117ca4d944a8155d4bdbe167f24461d
-
Filesize
1.7MB
MD58ae1ae4a74b0c05afc2648c564e265f6
SHA188fa0bb069378ea4f89f2569c302f0663501a334
SHA256c1bcbd87fdcde0605ff74eaff7d88d673b1ab718edd98af1ccba4451448afb8d
SHA51217eda367abe806547516371f3d56dfa1deffb7c6f130b641e38de5325df19951a36ab01b922ba564109870d2fd7acc144a06e92c98070123fd821510faed6aec
-
Filesize
24.0MB
MD577b2058d38049d071f9861048e58738d
SHA18579f8b01841881214d1f3ef5bcf9c80000433de
SHA256c662282782583d609c16d64d38df575996e72fc552c88652c37d259f1ab158b0
SHA512892d01a9860a0218a795d06ef76b6bbf4f3a1dde61ba7b06773e8e227d79ea54b7fe1863ac73dff934a7d54c7c0edc294e0441ce1a1dbed5529535363569bb82
-
Filesize
2.7MB
MD576cfb8e5505ad5ee28de86113fc4b1e5
SHA15c28a54d30504ce515791e3b79fa7fa19ab45c11
SHA2562b21560e73534c84b6f313af4befadfc54ad78d5b23020257f1c42dd1600f30a
SHA512412b33b56193e893561ad9419d9ba17fbe8aa9a5c75d58fb653f21620c6fcf04f768dea6457a431f6e59bdb3f3c66ea9f38550737ebd7de276d363141733a7b6
-
Filesize
1.1MB
MD548876613930e07ca47121cb8a9906c63
SHA1b0f39f8b2cf2cd28ce18892a4131307c337af4df
SHA2566ff6c41f49d9cb8309c5a63b21af0f7354ba6e8178687934ce6244ef209e9988
SHA512a65c8327a59087c9f1308138ff6dbdcefe196fcdd758451be9ee5a84de49a16b3e149c4f525ef6436196a744bdd85102016ce0edc624054279f78ab7c400bbc3
-
Filesize
1.6MB
MD59d161444b82199d6e5e0816fec815693
SHA17cd88857800d39f1d18188cca3fb1d7579cdce5c
SHA25665222eec5ae9fc7fba12dc5a232021d6168fc0f3757bde8b530c746ac76ad5c4
SHA51214d1c36dde1621e89065845965b665d2e5a1f1810e28cd09e1806e5b319f73b96f515891e84bee69f5f8eded2758febf5a3f961d5d234abb46b77b28a054593a
-
Filesize
1.5MB
MD5588e30936b80cc5b65fc11ee38528a0a
SHA1697f8f16f2532add07302ba5dcc68c4b2969b045
SHA256cfe0b14da4d850a51df8b5d7bac047766139351e392b50a7866eb69be8b325a4
SHA512649a6352ffeec905b9ed389d75116fb48a5fb942ac2ab32e522368706e94e1efc80bc87cb350cdd990deaeb8ee3edf9cec6b7271ab39b78f44741c5ee0c5f20d
-
Filesize
4.6MB
MD522f4a2e2d9c0f4bcd8f418d3d62f8746
SHA1aa665d4c64def87c626e4a2c7b84483bf91e7a85
SHA256964f31acc68a6dec08d92ca0d7e7a946da56f2acac7f38d82a67c8b6dc860c71
SHA5125d969ab251d98482d17c2f2120ad8c8384a3ade8c326caeb3172925926c3ef737815e4b27c6bd2c4c7710aab17bcdccda9cdab3a20d1b50a7ff98f482071ee3b
-
Filesize
4.6MB
MD5937358863b8516a53ccdf1d4811381aa
SHA1622be62e04835a864888e21833aa578e1f6a3ead
SHA2564db11b598353391f8153ed76458e1681d44564a9f1aafa7ddb1f715eaf3bb34d
SHA5126a5a619ec1cb08697a3bad56b204750892fd32aa3d8eaebb26999760725675415852b15f07bbc8b0219b037a6bd6d590824d7793a5d2fe164fb3c72dbb172015
-
Filesize
1.9MB
MD5d78d4a389a2a67bf3ca333b52ae1dec6
SHA102cd9358a776e3c2cc7c85dd683e52cb0e91b6fb
SHA256027e93919c43b7b4183e99b9da567337eac195bd79ea3330b452af8ffde1dfd9
SHA5124398946fe95fb669216f804e63fe5caef2a45fc858c49f2c55f7b40093a5680e1ff11ae71cd446b03d1434f7fd968c195da271a013d53811611bfa9d2376ff1f
-
Filesize
2.1MB
MD58f6c74cc94f7a782e72fffba4aae908a
SHA10efb3536279c0e0f1e943175b41b57affcdc4184
SHA2562c2b14f40e542bb951dcb1463308e5c80ad18b88116f29a92f43206e45d044fa
SHA512f7f6fd0590fd6629f1301b15bd40ba26e3ff3d4e52e2ebeea807fc3cc13cfa13e5c6b251e026f21f1c425379e435a18425d771d09d6f9644430c0152af69a633
-
Filesize
1.8MB
MD5fbd221e10db71a36ec1d69fd4e12445c
SHA14cc169e0770cd1934919128a10eea12a835def31
SHA2568481b1a0ba551b82932871d3a5249980378d928a216eabd4137b3a63c4c9996a
SHA5129701abdb27c0e122e046401266fef349d991f847bdfbb2016c193039ab1a156c18e5b2f8d7b8f2cc22d5e2530cab78feafadda5a7fc79f91d02a65efc71ef632
-
Filesize
1.6MB
MD555c26191cd67021e53891d503b7a5819
SHA199a9f9eb0247480afb060191aacfd76c3eef9659
SHA256f165094f2c754c764959187fa7ee1534617b439b1fdbb4231d376807d15727ff
SHA512d82b713bba0cf405abc5c74f9252712984107cf55bda947b639aee3a356a98e04c9cb08917d57910fa214f3ac3721f85590c60daaac18ce3fd3c19214bfd6ad9
-
Filesize
1.4MB
MD5dc570afdd2175914ec77d9b4ee44f59c
SHA1ca535aa684feb0b2667efada5f8f240b5a2189f2
SHA256cea7ca314ce509c4ea7c107a6d3f4d19e11d7806746432e168eede5606a84bd9
SHA512b33f9e27f91fb0883adf6707909bc9e260d7e6803fcf71d5d13d7fddc4e6bea1b7c85624cad45bfa34564054167736b1a6f42a0ff9b125be03401deb2fc9e41f
-
Filesize
1.4MB
MD52b7ea5be388ac80e1639b4ee62257269
SHA1916bf55aa6c4f93e8283606b5cc3312464f5e01a
SHA256f87214677c3ae353cc5815517b14aa49d9574c8ecbca2715273b6c2416ccf0b1
SHA5120e058e5a6c92d6ea340fe84ce27f1a5750b76549e0bfbbec867bf6ec6a14254d7704c2bb4283f8e349ff3e36904a77d94214624acadf6f6c49bceba1dd0fe997
-
Filesize
1.4MB
MD5ce015dc312d44f1ab23c5a1286a05606
SHA1ee55b894bf8b59dddc542e5db876b1d257ed7009
SHA256cf683e556bb2be8d55c07ea14619ec8bb2fd56fcb8a0574fe21059ab8eacfede
SHA5122c1c7557dd9b813d2706b27e0868b3815a205a71b359fa334cefa493ca4ab16b92cac04411d0b6a10b56b471c9306bb55dae2c84e36931d831cb6dfcaf31f6a3
-
Filesize
1.4MB
MD5d7f5f872777ad0628ada5e7d085378f8
SHA1908164e4b1afd82c863819a06060236ee42f712e
SHA256d99244b6cd98bfab6b5d051f920ca6014aad9b887a523e8029a7d03d620413cd
SHA512b8e66df7d8d4a15d808daa74b9947e28a8718e82ed81121f0609940e672362aaf3e193190102836f5a8de6b564ccb52a299a31196d7f233101be817de40e2f8f
-
Filesize
1.4MB
MD58e4e752ee3cdc266b5af9eb611bebb14
SHA19a3122d5a65b3bfde05ae5bc02efb21e45992e1f
SHA256242ffc153057a4026b51c04cbd61a465590c7d6998222d72c808c363781b8265
SHA51244afffe2235900cc9014275062036c0990abb4f2d415764300d6a283d8adaefd0ea0f090b45ec2d7c88e57d46dcbba2d43aa862c11367bed72af92108d29d3a0
-
Filesize
1.4MB
MD57e35f40f4f09225ada9d494d2079cde0
SHA17141fedf3028288d67ea529b07862986e971df4d
SHA2568663b5ae9376375497611309b54a8b1016ba4c796eae6d6edea46bd7534fc8ad
SHA51201086ee18bc5a13a77d06ebc7bf1158a2cc67a5e2eb7788c12e99e5dc08f1d7680a85a54f69a63d54684bd4ec932b8e426bba0f95ffda9c3864d26f16b86d829
-
Filesize
1.4MB
MD57c8877492fa3ffd7875044ef95da65de
SHA1a592dde59a0e08efafb441b296e873b38645e638
SHA256399d1ffceadfad6a4ab15139f8d47f82a175440ec5630ffe214e35ae18b409da
SHA512facf6fb9501596e621ce1e093d911537bad2954821fa349ba03ead548289612ff8edfee4321dca4d3d11b365002024abd88150b74ea9596d371db3af17620663
-
Filesize
1.6MB
MD59041c47a3778e9890bf4db3c86dee216
SHA1c037d0de29176281c75ba2504f3f8df9259529b3
SHA2566089880686f6dac4abcdf1dc798d6567dff80e9a923e4c2150edb4d0ccd97578
SHA51246f9d306824ed923091ac54a9449f769b1714c5e2cc8f22efead0267fd4697ebb37b5609c30075220119737415ab23578fc128749d3a5655a1724ddb2ef3e16c
-
Filesize
1.4MB
MD581f87ad74b271819645b3421f12f784c
SHA1d43a9ed2ec88911126372388e8ae713f0466eba7
SHA25691d285d93e53d047f8a5ba0757a5a35d4f7fd581d3015d53fe51f0580f228920
SHA512ada82dbddb0cc7a9fff8452283dc44bf068c0b0e260fe00d946ae3e20889bd82966e9aaf4a482dbc2391e6f38b08565f5864f51aaf63b78c2bf8e80d5a19e322
-
Filesize
1.4MB
MD580221fccd25dd4da4318a83d03602bfe
SHA1a744c1c21825480aa8e90e00209617ac62bddab0
SHA25697c244084aa92ccfb11b6789434026eabaccd65d947cd3d7cdec01be324ca234
SHA512e8517e520996edae4c0db1d3b7da35c6261f65ee76e69c8f963f4ce3af8d2c9c7db2a8ce706578093135f162e7c3b6e27bd0280926a4fd46866e839a933fc224
-
Filesize
1.5MB
MD5a73c4ae753756ca57fdfed4d739fe502
SHA14f05d5d0d9d8a7ddedb6b50e2c7b3f0da7155bea
SHA256df1534a46ea93588830fdcdb3ecd739674ecaeb89c7ac54618d588b3ef14eb14
SHA512bb24ed0ae806589a3f549c423376859b50aeabd35eb36b1038bd5c2e41e8aecbade5cd03e950a4d9e69d781e0d5ccf9a90b83fa13ad7b11a373b3c735bb02926
-
Filesize
1.4MB
MD568cf441b633d434501798beb2475ce9c
SHA19da72c08ffccad81fb3e80e3764585500770a400
SHA256b3f33b6a678a74764f71f883c1a14c1e13889f827ee685964296707d457aef77
SHA51289219cd61412a5a291352ba7ea98b89afb25dfdf8c5ff6cea1b451f51144c52b1730425bea4c36663a6186223387d9b5f511bf0e4a9bdf242f83acd754bc37e3
-
Filesize
1.4MB
MD56e27f48ecdbcf9890de5c97f3708b138
SHA16408f286899c9c3c43ce2e9e1436dad488b1b4ac
SHA256fdb9e0eafd3a6d25cc7d176c0c645e96d06b93d956bbb601158b5437ae8dc0a3
SHA512cb809d77f1bd34f835bf3ac12aedd400d957959c4bfc63b9880d1b3292cd8126896a4480171a5d0e44b1a26f1d0160a6e3b01393d45c2098669cb9d427ae229d
-
Filesize
1.5MB
MD5079ee1fd5e88f40e6086b141c94c5d1a
SHA172cf4b8d028e729353ad448a7f4d56de9f3a659e
SHA2562253802758a8df70b4f0b44d1e0a29529986209ded220e2f271e0cdb5ef439c6
SHA51280909481bff5c8670cc3838aa435712a4051a7f3cdb353262130a1d04c253c1e25af82a05335186e5815caafd3f09018966dc00646d2773a2285018e46673337
-
Filesize
1.6MB
MD50cfc49ed28a5c134dc28ee54222d614c
SHA1ecab7bb4277dadf51e3f73564363b328aedba479
SHA25601af9bfea08dc13cb54682f2edc857d93dcda3d843eecd28be368c6275a8e1cc
SHA512d19cc64a2e27827f9f0619061522ef008adff78c2908107d5ca4ba7054152c473fa630bdbc7a5a0a42f218cb2817a194c03997f0c0e310e2644630b7ad20eafe
-
Filesize
1.8MB
MD52c14012b521ba6e7057594b93ce7924c
SHA1c0638151c9b446da3552b347ecf07dc3b6c9c9d5
SHA25625f89983b2aaf69aa20242ecb75e16cec58abef63397bd6baa952400a828a0a9
SHA51267e0ad1ec9193a8f0a3cd1c2705a0f209f70e47602229c951aab394949499db34ae906298cbbc7624e635b43e7f1cee623c1c59e6749fb1b3cee042112c33781
-
Filesize
1.4MB
MD50d78d43e27b826fa937f49c3d92e1bc3
SHA1333546143ee3bcb96ced8f0b67943bc0cbcd221e
SHA256953307c8ff6b22786df1e167d4e9ed9632be2ffe5f3b45df7d8eb215e22c3cfa
SHA512f8504c54c50908a535c2a363a9650c3da0fe11cfc29d5e35922a7cb7d73dbfadd2b6c9dbffbd4ada47a3f093938307012d0ad5e0749978c81616972296ca3e6d
-
Filesize
1.4MB
MD565abfdc9e5669cb915ba3355e134905e
SHA195d1db90e75eaa8c4eb1476fae5b98f8cfa765f6
SHA2560d024c1606e7c08fc9e0f672c6fce3b0a28d4e812c1fbbceed88973a072eb23a
SHA5124cc1a00ec4922bd955af373d5d80a4ccc55d9ea82b5282673ca52ded14550d189654ccd60f374a7ff701f359eecd26e42d74921d15b18c701de6509694371d96
-
Filesize
1.4MB
MD5c63b4d29d3500fcc969013e902683d8b
SHA1713a34115c4f8783ba8df1e1487821b448a30377
SHA256046c795894532d9f22d18e89c51f6f37723dd0856f9272599fc750362e5cd9d4
SHA51252d8a655a4740a8e40ce04759a70ccd98146981189699c96e1b20d12d33b8e777290b9acf530ff4cbe7df34ae9e58907727bf1e7571b7158fab80adb197e675d
-
Filesize
1.4MB
MD5a8158dabae3c94d5b7e0d9cb2d5fe59c
SHA1fa6b99a10bb1b4952f744baf682a8963130328d9
SHA2561ff223b971b5855dec86c92208945896047000e0d00c2b01f5fec0a7e994201e
SHA5121068c491b1e7cd177f654f7f240bf305ca656d6d948b69e1f6f6927a6305d3f94c9ca56b71c6940cf60f4adb9115535811d3829da27612d391b89d16acb17f79
-
Filesize
1.4MB
MD5c0c8c868da62f3a5ce388287c598e422
SHA1a2fc3870d412782793a3efd663b15064089f4a30
SHA256944f80d065e198413fdd52ad50fff8c8172424d9f6040788da5ae21fddaa4ca5
SHA5126a238765d0ed5290df4559c2a913f7132449b5b53a90e763dff98e3819071d3d08cd21480f0eeac525b3a2d8b739c7ff55ea3b1a033b20e5995f5a18a75853de
-
Filesize
1.4MB
MD5a3cfb3ed7c143ca181c90ee7b3782746
SHA19170b6f7c7621843623351cfe7efccd51e7cd90f
SHA25690cd35f938e2113bd5bd459f1e0c252b04cee63c641c0ece04a067d505d3f2b0
SHA5122b0ab250a641f84fa760ff7700a4c07a7ac6747b6d20f41a4269f0ad25dc26e5413acc7746a409494c1e8dbf3dd8bc527698d4279c44e47e0ddcb0118b790198
-
Filesize
1.4MB
MD54ba30df5165590f5fdded329e70e6cfb
SHA185482bdfaee0211309eed75576cb070185084f95
SHA256da19363ba483bcea7c9d5d1e47bdcdae10c1f4b7fc994b2648f36bec73cbbe2e
SHA512509fa74576a67bf689d71fced8e126a224747131e9fee8afb5a986a0896b3a1ff52fa8409b98fc3eacf2dfe0dea2c952748101525b9bccfb2ab98aefcc9b0a98
-
Filesize
1.4MB
MD5d0c5b65f6b1d77ac6a5bcc1d39140c54
SHA132797f7155c3bc0cc141e13cd36240c2ff96212d
SHA256a7dcb3346271033e7ab42209379be6f09d7cc3432b6e6ef083e3ea58ff160eb3
SHA512df41594f54ec7c990d7ded51f8b806a9d8b40aced5f52a4e9548271ed17fa48b5ac38c2cf04aeecfd501361216fc1cf922afb99034d5a71f2c294cc7b488a5f1
-
Filesize
1.4MB
MD5eb80087a310e45f5f61583f24739cea3
SHA143f1e5ae62f47790e9aaf3b791399f537540f160
SHA256f79d98bea85d67bea974ee19107010fa4cec47e54fbb30890f09816aab8a563d
SHA512c19e1f750cc9e419903a138108e5282fd65a03ec04f4d5eafd2bf63beba4a759103c933e587b542c3959736cdda9b5336b3209ea99f8f2aabbc7b51fe9d0e84f
-
Filesize
1.4MB
MD581a29961db605cb0029394100b765189
SHA139f9b95323ce237a53ef56e1f8ea854e622010ac
SHA2567759d026f3fc9fdc23bda13a5c8eb19b7a54fa1ea833f21a23bb19663d5eb522
SHA512005e1429a0ae10021687ff435a93bf8d2bf4b18e45e494939f9919ad8e87e282e046d585666d7905c155fd680de35241a31e80d7b1c85ac58b2fab10329ce19a
-
Filesize
1.4MB
MD58c67431bb7c9047a92d34858971703c4
SHA16e9abe2ca139d70ec8509a10da32dd19a24dd168
SHA256948c220f0be8d7a42cf10aa524551cd26a217e4e040bc4dd882e38e8068ce8e5
SHA5125ffe80d38d24bb21be57b0f987fdc30e744576fe8c3c9b7d6945a20babafcc677159ae306369a36a53eb2a1987f7d86f12e9ba45944bf91e17278380854a20ae
-
Filesize
1.4MB
MD5c8553278af8d6b45ff1ccac2d619c8cf
SHA117040c1f2b537ab46d80f5739de5b8ab5151e111
SHA2567d775c26de7556fedd39375eb0602e58392a5903ab0849df186b9cf85019e808
SHA512e81dfbab587dc01bca34464b451ac04d2596bfac7b5e6ca59b710ed47223a60cb849d2a3a4c9d17e10d533fa24f7198f610861b602d68878420f5e88b3562713
-
Filesize
1.4MB
MD594c95fdbfa20e329a38fee3079421f51
SHA1f176eb82b3bc6791312ed1e510166a7df515b79b
SHA256e16d1c8c033bcd742ed366e54a779b518170b214052d7cdfa5687b44d04c20fe
SHA51234e4ae00f7ff77f9e1749b00d49a833216f011600c304dfd27cbce03c5f22ea87f7a240f35bce3f5f294a04c3ea5b0a2213a2c599553db852d214b4642d1f965
-
Filesize
1.4MB
MD5429544245f72e8e56b46736dc232b961
SHA177d182b2ca9df6e0fa9bbdc406758e43d2244751
SHA25603a82bef759d71822f7573f1009aa4cfcad722937bd62a361a82f29f8abb61ea
SHA512f8567603732f93e18beb8e8b7f00c5a35a69af5134bea6c3be1e675ad15bbcdd380501db20e56302f7c179a83c6e15b57afeea25271d4492b88775b37e943f28
-
Filesize
1.4MB
MD5b0f20bfbb18d146501259efb6fb18a39
SHA19d1b4648067562720eaf8b38c84a74b0b11855a8
SHA25667b5e5e711ccce52e494cf9437521de4f4f232bcd6d51f2d1d3e07b3c15673bb
SHA512a64db69307101c9eff1a8f042a9e99ea19dd114a7ef7206553a13f15fef188f160c1b16c73a71bc7d8ef8c0e7c9a784b3dfaa5b5e0a7aba5efc59ec975a2301d
-
Filesize
1.4MB
MD5e24a352de88779d5c71eb8c09218da31
SHA1fb19d703769eebe7957d28b22628c49aad5cc560
SHA25683d32b98823d8453ff0d033cb759325e679ee22a3245aed217dad4d9dd2a9350
SHA51266c0d9c7f4a1d02d00705c70512648a4755da800296b68f06c626b24aa34e9332c76598a1d5f98124f76015e3d170988ee4889437515964d29ae077f8a23e868
-
Filesize
1.4MB
MD5b6c61b115c5fc981f60e8cfe5eec4ecd
SHA18bc8400e552cf436648b613d51c6c3dc9b70c14c
SHA2561f94e38851601f0d2937f878998011f981dcd26c04460b22bc1d8fd88bf96d64
SHA5128d0396d5e09b69d24c464a9da68ae479be258710f468b3bcbdfa25654375882687f0dd901ec8855e64f7206db9e3b4b9fb7acc3ba820b46ed335beaa14e2929b
-
Filesize
1.4MB
MD5c4a3e23fd5acdcf8441979a468a3547d
SHA10a3adb10f48578c9f41f12f4fc9918d2686ad7fa
SHA25606bb549e98051c2131500f0b3756302124a99eeac650728df2154f6f394e4039
SHA512dddd2e76090f3a76757a4d3dd2d65fb563611374ba35651588f111356ca225df40b625142c1f061c282cea30f8d83fe1ca7e8cf15ae50a4a3992bc04bee6c4b0
-
Filesize
1.4MB
MD525f2c3d0f19856c8821d0b0a4e97fa2f
SHA16e28d74ee90bc1ad4b476b1ba2e5b9b23051be16
SHA2564d81d3be44401bb55386cd98617118f8c3d73d9b4a2282a10eeefa2d5053ecfe
SHA5127fe3bbfa5870fa170c524b0820bf101675b4deceedc0c1e2b210c9bb5004570ea9219de0ead785437442fa265a86287ad7f110a00e6eb290bbfdb9e6a166a8dd
-
Filesize
1.4MB
MD5683ae55709630c7fb3286b34ecf61857
SHA14f38ae08e248cc0000356aa09f38f8af403df563
SHA25647542c5b07da2753edb65b85799c701ddf368ca236eb6ae7606d9cd9869c55f2
SHA5128795cc90ea2c08404f896788d58d32673155704051b97e293d932e162a0aa3d8e2a8f7c9e36f734fd5ce41da7b4d326bb79cb6c69f9c6bb99cc25b19b2c62bd5
-
Filesize
1.4MB
MD5378cc18b2f774bb3b2861349fb43bd35
SHA1ec445e281247ac43c1074a3e6c1519681c46ae4a
SHA256ba20c6664f48ee41505dce8b0d902c8ed47a749f7683332c1f0c2631391e8ace
SHA512ae0e3ec1454dab3e7723deafe63fe1c5d8402313877eee2947f10e13710f0995b9676525e6934cfa71693bc7e80266a053e0dc221723913268f11d81c07423d0
-
Filesize
1.5MB
MD5100812dcbff24ddbd32bf9be56556f06
SHA118ebbfac4dafb80ba55356d9289f1a9fb82f1cbe
SHA2563de4d7ee0888fdf253b1ea9314fff5908e317ed2648c638a022a88c79c04201a
SHA512e85cd929d4a1e1e407ac938aac354bbe7d3dc7ed0d87dcb379f1ee6649aa25ed1e85f76ff95b6312303d3d134edd65cd643ed29ef5aab8f827baf8f673fd006d
-
Filesize
1.5MB
MD597b3a13bd9a586d8d3c093a9997a6a1c
SHA10401de2317ac20f421a02021e24c900a77b3599a
SHA256d35ac8d3ef30b979e450aef41746cc333298594cf564fd4f97a379a09c7955f0
SHA51270b3e00f7984be60ab6f40b680ce71929098359291d66bcc8f98a33dcbdf81067e75e16cd799e131979ee5b9745abddea5ae930b156567a83a96a0ff185114a1
-
Filesize
1.2MB
MD5f24cd735b2458eb4f8deb935df9e7112
SHA1aa28b088948f1eca8f9416f5f54aeab126bc0716
SHA256f33140aadd3758a21201f5121c041bab857b7feec302730ad5bb4fc0718bc4e4
SHA5128588979ab8784ad41a2127a6fc00d7ff7391f476b61e54dba8b29d39759fae1c78492f1f9483913831d7bf06268e630ac5440799c4fa3e73165fe59de185dd78
-
Filesize
1.5MB
MD5556cbbcabae66e27bad3706a1381e2d9
SHA18503919618db1f0b2e21f763beec09c3c78e69e4
SHA2566f146d0af69c117cbed559dcfd5697a996070dc779bf204dfe5f97665e434bf7
SHA512d5bdc76562fab6883e35087c0d87e0ff3ca13f4fdcd345698aaf204d77954c5ec918b6f8e88484f4afe2194026169ec1daab4eaf89217abfe93dfdab83b3de1f
-
Filesize
1.3MB
MD5c3fd13145cb62d3cc714a9cdb39de5ca
SHA163371ad0e9578caadc7c9e9e118af929a93f0fef
SHA2563ce005eb26cc5bebd876c0396780d7308e61e5544f60a3e4d1138b3493b7cc10
SHA5129b52c2a47650877068c0e77e26228e14b66a824619090dd250a2eba59eadf4d4aaededda37aa626ede8d6e3c7e5ba8c517286eef3294decc6f3fb1f284d08c13