Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2024 13:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-12_3e6ae68ee52c0801c6d82fd71d2e709c_cobalt-strike_ryuk.exe
Resource
win7-20240708-en
General
-
Target
2024-10-12_3e6ae68ee52c0801c6d82fd71d2e709c_cobalt-strike_ryuk.exe
-
Size
1.8MB
-
MD5
3e6ae68ee52c0801c6d82fd71d2e709c
-
SHA1
0f83954ef561f89ef6864ae0f490bea9fc09e10c
-
SHA256
f4711a5ad18275cf2c6b121510a585bd904411db896d0eef8f40a097f4b9081c
-
SHA512
731d953c2d45ca6844c4f5034459e9cdba250dc6b6450b80f931f5efee5b8356499bbf1e05f0989589f59f658d643ee4bf775befceb187f3c595f96fcc0da56e
-
SSDEEP
49152:OKfuPS3ELNjV7uZxEfOfOgwf0+xl6G6kC3Sg:Zm9qZxwgXkC7
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1808 alg.exe 316 DiagnosticsHub.StandardCollector.Service.exe 396 fxssvc.exe 436 elevation_service.exe 4988 elevation_service.exe 3436 maintenanceservice.exe 212 OSE.EXE -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-10-12_3e6ae68ee52c0801c6d82fd71d2e709c_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-10-12_3e6ae68ee52c0801c6d82fd71d2e709c_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\cbf0e956cad6a2b9.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-10-12_3e6ae68ee52c0801c6d82fd71d2e709c_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-10-12_3e6ae68ee52c0801c6d82fd71d2e709c_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-10-12_3e6ae68ee52c0801c6d82fd71d2e709c_cobalt-strike_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{ACF3742B-09B5-421B-BDF2-BEE548AB1938}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78984\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78984\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-10-12_3e6ae68ee52c0801c6d82fd71d2e709c_cobalt-strike_ryuk.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 316 DiagnosticsHub.StandardCollector.Service.exe 316 DiagnosticsHub.StandardCollector.Service.exe 316 DiagnosticsHub.StandardCollector.Service.exe 316 DiagnosticsHub.StandardCollector.Service.exe 316 DiagnosticsHub.StandardCollector.Service.exe 316 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3804 2024-10-12_3e6ae68ee52c0801c6d82fd71d2e709c_cobalt-strike_ryuk.exe Token: SeAuditPrivilege 396 fxssvc.exe Token: SeDebugPrivilege 1808 alg.exe Token: SeDebugPrivilege 1808 alg.exe Token: SeDebugPrivilege 1808 alg.exe Token: SeDebugPrivilege 316 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_3e6ae68ee52c0801c6d82fd71d2e709c_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_3e6ae68ee52c0801c6d82fd71d2e709c_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3804
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:316
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3932
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:396
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
PID:436
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3436
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4988
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:212
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5a77558cca024994da8e40b4881ff26d1
SHA1bd4dde1f801b394da9c545e9b150c1e50418abb1
SHA256fe625b2e761276ec3b4d4565d8e6a5a168da2b198ea200b4076896199ed15368
SHA5121f1b406808b1cfd6566cd8f4b088bf9aae68f129a67ce7b34fafc6288d4710981913b8b47622d2d5c75f627502d48092412a910c8b0f1005469b73db6d35122d
-
Filesize
789KB
MD551c7dfc75a8ece8a2aa7cf3444f31792
SHA177b7da21f7fcf005a9fb6fc7684e0074e7ab9471
SHA2566f558587af7f45753148a151eda68442188db8794236feca3b21e8a6497b4ba7
SHA5128dac971ca159faded8284c694602fd47e6cf418b6ffffab7957026d933656d676c8f2dcae400133070b5f881138dea9c933f2feadc671553341eb7c5642fa213
-
Filesize
1.1MB
MD5fed52127a93c873298910fe5c8c615ab
SHA11aa920967c37067b81da8d531f1872273339b541
SHA256bf95f23c6c19b1bb3c2708c47a822815adc30da6646b0d2f2f95edfe55d7fbd1
SHA51225e80e32790541ab31ae73a8bc4453b1bddbf7ba21f30cea9982721fcf432bd78e1b77d890a61d8f52afc8b1e9c3427a31a95eee2008c9a4322563cf5e4fc538
-
Filesize
1.5MB
MD5e516948a5aba9602c87d30660e423386
SHA18919eadb7565234be2e205d984b4a507349257b0
SHA25611bfdad9c7e5f182c00b6debbbac3e3599b04321253918c70e6ee06d21b8242a
SHA51251ce3be1233d10aa1eafdcc79365944caf543e05220abbeef2f164be02b2c21e58bfe1351c880965f082753eeebfc70e445fc1a31e9cf079ebed9fda040acac2
-
Filesize
1.2MB
MD5d4bea7e0a375f1aeb90e90d89d91e0da
SHA17cafd583b1e31f98bf3d95c80dd4cf929466e197
SHA2566dc5446d8eb301cfd75cabde15d5062cd55a7d32f37e9a75a5e3387ec150c4cf
SHA512938a133195a5b1fe1adcd5e8879d5ffa0f256d67723b092ea8c8ee438981a1b8355f19014ce0e27fda6af229b073e16aeb5b2766f177f41ed006008dfb7949f1
-
Filesize
582KB
MD500cacb37f13e8b76319e55dc806ee9ac
SHA100150d78032babbe1918ae8e155f87579713daaa
SHA25673f1098b9af78b248340f0d522582af4ba056577a0a0cc76377bf619b796c40f
SHA512b535a4678bba19d43d43d4eff44452ea4c79dc81517e6515678446abe28ac9d525318e9e2043dd8cb721f9beda40490c3b0db6b08f827ed4c8f817453ae7bc99
-
Filesize
840KB
MD537473921420a5d2907224b8b87255d13
SHA1a0af5c1c1bde8b170920cd266ec1d90426e62ee1
SHA2566d5fa7f953456fbe73a8d2afb711ed1dcd5b5bb87d8f8f17854a8f4fb0ec4e34
SHA512f29f09b14c211a4dd60315489ef5d3291fb7344824185795e975910c5b992b96d4a37e88d2a37d219faf1bbf65efe734d0161af2795b3fa13a6ec06871b8edf6
-
Filesize
4.6MB
MD5b5ffd23490b3f84b48d99f45c099aac7
SHA14b6b51ea9fed2b407da799764e923da61f3d4a09
SHA25605d0ac11f0dbb157916ab3ba1bef010cd9234e8b140e22da3f066b48a12b04cb
SHA512451056fc21898d4d474769e100ea172bd02958adffcc49edd8ac59b0e1f09c14844009eef3b5a0c915ab914bc44ac738ba6c111d90c6a7152fd71e3f8ac4218d
-
Filesize
910KB
MD58b687d8bedcef74ade03a078f8bad784
SHA13a69b022e3cf712433a478392cd9ffd9a2631044
SHA2560f95f9e71d07710b00aa39a6da28515d0ac0114de42e10f8db71d2509ed321e6
SHA512ee361b4228b19b7cc1e15cb97758346039c011a0413ffcf36061b4c1d331c0413dee0fa537878aafa83f6b0a77e7e083a5e2851df299bc449ddf966f55e07a50
-
Filesize
24.0MB
MD56792dabd2c1437b90dcefc7cb46fd919
SHA13c3d4b4ebb73741d5894c62f8a039b0d7fd91ece
SHA256689574688f17aef45e98fd6914188e3087d78b09ca9bff80bf4de24fedf8afbe
SHA512916c0ca6e8e565f92261bc64612aa0550363abee9979f3b273c1e1800c97250c83a664b9999d40e0f756de180063bfcd92ab0b2cf257084765a3f9eade2cce26
-
Filesize
2.7MB
MD53c039a7660101bef4c835ffee9377358
SHA1ec9e1a4c8aaeb79516960029a1753a9bd2899b9b
SHA25603504e6601d9c3044b510cdbd8c35d0fb852b32046c8ea86ad691d02a50fb505
SHA5124e0d0323902b81187abbac02baba4416fb660b36d67f4256065519a644c599f1081a177459febcc6b7a33e97199301c978042db183834db59e115fd44fbb7a24
-
Filesize
1.1MB
MD5c3263a5f81e02f66d46b3f361420b707
SHA1bad2830e23115a06019066f4c2d846470debf1f8
SHA2564bc02dc4ece14b9e6c2a6d9f2ad21dd220d090113a31a02fdd78c22487b2202f
SHA512a4a19603518be103855b44e3d497c3006f5ef48186399a341812dcc297113fe0c85094dbd6ac8b5d64ecfa18f7471f32bf5a429583ee3c646c209f83798fe62f
-
Filesize
805KB
MD5e01bfc6cc2370e8f03adc41ae101708f
SHA1bc00d4557c2027a2a747387af47d0fee627dcc89
SHA2568fee7ac10db3a152174261dc5347b56ccfe4fe232c4e05187575239c451937e7
SHA51251087315e8e6fd85b2e869e2ca80d839945b46eb464054870a6e32f01df317ab87e49f494ee06466e541a904fbfc933423f1654694ff84c6314b62f02227baa5
-
Filesize
656KB
MD5a973e7547878921883468ab9fb77849e
SHA1130486c46c8d49616f58aaca28c15a3ff577dc60
SHA256a7125c408defc5bef136b0b092364bfd7fe8277d62575a13e9ae6fb1a7a5759d
SHA512bcc44c1ad35b6d9a4df966f246b77949a8f2e52b1bb054253241b2597b881cfc8dd6702ac4c4342014f4749c9db63411e72f8c310b319796f7eeec750f7cb2b7
-
Filesize
4.6MB
MD5229f47a31c89af6535f788f91afb0df8
SHA19ae80497c72787921d725ed14e75527b414c3958
SHA25689046474ef0f999c4a6d0cece99fea0bb0adb12139269e5ab1be0138cb0a204c
SHA5128a4370c2f2ec635748a39e1e4458ecece575764b91022ae855634092eaa99252c7fc2d3d2da8981a70403909214736f73471b17f1d0ccd166711bdfd40c31b2c
-
Filesize
4.6MB
MD54e30445dc105414e11178e11e45f8c5c
SHA1b12ef4ea1ba137a92c47e1389593b840fcf5c4ff
SHA25613c244b02c15d35d4f75c4c55c8a940dbea9d28a6b24eeb120743f696c2a27e4
SHA5121037acd617c2160968a0ad49dd885f1f780807cebaf591b288d2c41dc053e4720fa0f3651e02efaba2a3f2303b62e71f5227682abedfedc2caaea0faf8b75e8f
-
Filesize
1.9MB
MD5ecbc0c607b83f4010d12967add90f6e2
SHA1aee2c81e81b352a3ae5995203f193c99e638cec7
SHA256bd1d8ec2e098b12142fab4f0908b92c0d0647b4afe726bcf57d1b80d36719058
SHA51284d48cb572e328be5d453e44f425be9f5d9919ecf189de3d8aef53d4451380184a3963fdbc9f2db883f821c2b17ab19e4e3e525205a26f29de87028c0fffe4ed
-
Filesize
2.1MB
MD52cadbb073172e510ced714fb6b7e7d79
SHA11c1c6723a245fa379fbe8dec47f89091e541e8bd
SHA256a1adc8a5ad3b44c4873d3d55c98651d06bd2ccf9cb641db1f25c66162205ff21
SHA5127a8c6e72be03d114b91aad8c761690f4eb8352fc3535fbc1cba468c930e9f40615968312c8f0ea660a2ebde0d30db35830485c85fe2ed6a7417cd20d08773450
-
Filesize
1.8MB
MD5b759afad5884516c612f43904569b288
SHA1fe87ecdb9f59f8048e4e57971ba82556f6dae42c
SHA256fe0cb95bb3fcb349d79d8fa5a90705f88c1764b4ff2edcb12689abcbe6c270d4
SHA51299203570e0d541f6d35f19888ff6014408ff597288384f1c34257f47249d2ec89dcea3d87c411ea28f8f88bb49b8f1a96a53df17a07b7d3b7fb937ff4666054d
-
Filesize
1.6MB
MD5c7f6793dd97c14978344a449c1c9a891
SHA127c28a0da32d0dc8ccbf06579f0a87532f196515
SHA256dd4e32b842d2dfef7f787f115b8647cf8727456def0d667e78a72d69abb36b85
SHA5122400dd82ef80acee0aae69230946a10f371877399a45e8f333679b857e3e74c2667993cc6fc38dd17bb289906bca457890f100411fcdbefee728d9765f2a3f57
-
Filesize
581KB
MD5b111f7a9566fd8ae6fa9f90f4565d7db
SHA17c7de9e9480622b58f5e92b4470b75245ec05624
SHA256eb2f7393fe02d6b4d6460033bd688dbc6fc1eac35193fee8752a4bbf6b393900
SHA51211eb78df0ca75026f66308b1ae8e0468ff257bb284d77e5b3b0953e6c4ee955c644b2841c5a3d2eedbcacfd5adf351fcbf30acd70409c807cc681f21f3168746
-
Filesize
581KB
MD5ff6d931fc6b1f22abb842cc6718146a9
SHA132f0b727609a4083f48c97e93be55e864afd1847
SHA256a58dc6d81ef44339718be3ce948aaa00b4e0c09cdcde51237be3ab53b502df96
SHA512f3c988f1ea67d2ba433e51a9fb4d53de0523596cc57fc1a8c06ecb1b681c94c4617db7d4aa9a5470e3afee1e96d9760fc2a545600ce45e755b27e2212307e64d
-
Filesize
581KB
MD59829caff3eb93b88b80e2a3b8c4e586b
SHA169c5c70b286b0da244fca1282bb8f0c4a97d6051
SHA256514b17340c300c9c682cb0114fe135d5e9f9fb7ae73c9196649900c96ca592be
SHA51252db0819f976e95065b1d95a147f009f75d3f46f4944f2a88d684051c48b2ace793eeb3886a0ecdc14ee50c19157976e5e8190b615db4e651cb16a381896823e
-
Filesize
601KB
MD5701a05ea0df0c5ca29812fd8a9fc3a7a
SHA1210d694ab189caabe1dc3af80e4007c9b13ac897
SHA2563d344a33a5bc8d98f3507705bb05bce4460613053a91563a80c960e2976f7732
SHA512f79d30256d87897ae4e9f7b1e5ce6a259da0dbd58f92b82a459aaabe1f0aa44a8727355267936d73fac2363311bfda8b1445fc0af8154f12f1a93d70313998fd
-
Filesize
581KB
MD5ff7fc7a7e930b8d00593f3d4c0c1ebcf
SHA1aed27d6758d5dfcf917dbf8f8512ae0fec71ca6d
SHA256365554cc838940929bf173623988b8784d6a5bb7fa1732058454b1ed52530062
SHA512542c9dcd165a4560a9c0ae18396cba00ff62a56f93c87d7bc22314deae47ca35556b2be06fcf03cc66d42383d97fbf3e291fda96ab4ce57b26067b3ceae9af84
-
Filesize
581KB
MD5586d8c29eaba93b9ce1e3867952a36c5
SHA1af19d7487703d5b8373dd1746faa1f92caa4525f
SHA25659016ce5eebcf27247b328f108a40218e2585be55a0be69a3f06e1073e7c74f1
SHA5123c6708b7ed55bb9d99265d8bad902d7179f9aeab2a4cbbb9f8e706e7bafe008b04a5ed7d547f005c2e6a284d22600942eb323c34c992ab7907b5ebdf479576b6
-
Filesize
581KB
MD570ab7e40b6c7c87416e22992f288ea08
SHA1f868e8c151a0fcfb2dd57da0f93d7eb80b0e04da
SHA2566db6f577bf1ac7d0094469c8b9e99284a67261b753bc7a4d55c9ec00f0a706db
SHA5129e6e2049b627981349f760a494cc1844cc2353b90842681ffa1b3efbbe7f464cd8d738f56af6bb60ff25560226954b7076d5c491d923797a4a544794a357befd
-
Filesize
841KB
MD5fced9864fb9577baf2542c163673be29
SHA1ca2782604e7450210ac1c09006dbcb76325d5c9d
SHA2560437c0e62f0449906b3d59955c7a97430798697eb4966993e780c7efe40c8c95
SHA512fc5a69d6484a7763458c8b57711ab0333f4be2452bdff47ede51d393483ba447e7d1f987374ac09803335fe715cdac635b120df3f8c87e5e6569b3806b906424
-
Filesize
581KB
MD54e4f8774a68bd9a263aadd1da5224a67
SHA1373b7ce4ca5932e1be2b67be9a554228eac4ee89
SHA256e15002a350906631d43e88221794e0875fabd4b66bc2202cdd84ca20018ad418
SHA512244ba4b22cd39c386ef9b1176e097d4b0ef5ac0a666194b6c9ffa6b1d7a772d3038076c3819700f19abc9be356d36530737ba18bfe16dcd91baa744d79b2d8ef
-
Filesize
581KB
MD5c924aa9b484a1c132e5326de92db992f
SHA189f61298bf5b36b4c5f36fdf74706e98b70119cd
SHA256fb2389f25876c2da3264530dfc65f51cc1dea97fcbb460d9712a026c1fb06b05
SHA51238ac2387a2b93f2c95fd58a9a4ee002aacbda10e777c67ba3eca739915ef80f32ea83b854fe9d3b46316efe8258f055f2518cbe704459fb38ee8a3004c833451
-
Filesize
717KB
MD51ab46e7a19b6b0b25e25178acd82658a
SHA149031328aea0d22724882247403f7cccb19379d3
SHA2568fbba23efea465dfe1ab01496b94dcf4be3b9bd9efd83d9d390b2a093b6dfd55
SHA51297b7481bce782abfae1a704d908d99511b2c06eb61ba97f1c287e48b0b7fca2cba392915132dd71d780b08cd0d677d8f9af085258bdee0f427e1d6128975a6a9
-
Filesize
581KB
MD5b8c519d2efa7188694b497c917d1e7e7
SHA178207e31e44af652cbe3df19fd8c22d69b6c55a9
SHA2563aa0cdc5874467c47acadd89ec88ad5b4f22d3295a23984f57df44faa6647cf7
SHA51219de4e3901a9d532c29e04dd44d40a9362027dc4db3aee74868d0b81fc07fa0e432a094fff810f0f4c6c4a7a60c521c47dd11d81764058265c918c3d8f37a4b2
-
Filesize
581KB
MD51208743f42647a69571dd8f36ba8618c
SHA15a8507ce8f3ca414fb70c77f5ab4ae06abeee4c8
SHA256cf1cb6386862b1e74a6278fb10db187cc46a8274b142c6006d87e00b3b75fd29
SHA51204227934d45061381b0fed8352ccd2acbfa57ea1837cc9393c4c460ec9c7bbf0c0011c9e856fd0acef3d46a670defc4cd3edac7cbb4d4c5617557a5537a3eda9
-
Filesize
717KB
MD5342217901495338196e95c86a75e9c58
SHA1af8110d3b5ce5b672c57542d8b5731b457b9e088
SHA25686be02f8de75b868ac7caae22535dc18714065087ac95b75ae3b8bc58799d35d
SHA5126c2858fec106a0fb197deca57210f92fb610d0b478a37a3c08e85d072615a4cbd4ca8814425c7b7532c8d4cedd06169a80633a5e57c651145ba5a7f72b1ca52d
-
Filesize
841KB
MD5008271abfe6c6c0efaa03412a88b6238
SHA1ea025777fe75e2a8edc0344876d6137a7c2e2203
SHA256bc8487e1db48e76776f204a69264b3f656c1fd33b9154df770ed3894e0b7098b
SHA512348790cf48b20cc34f7f52ff5112f02231e4967231805c6825f881e80acd95aba4eb3cd6a887eddea09c76fb40c792638f37916e3101d030cb834a6b957e3fa6
-
Filesize
1020KB
MD50bde773c0e561aada2f6766c69039491
SHA1add01b483ddeeb922b163cc5a2731061b4a0fbc3
SHA2567274a40aabf1bb25411c5878c01a8f85dbfdc7820131eb8a0693dc21d511e0df
SHA51205b43bd1459cff301391405347316919347e6ba786b61a4d937e28a4a88533734583080d87da8bc212ffd664de99ef50efe5b85070e23b9711d94239aa732f81
-
Filesize
581KB
MD5bfdfcef646f4329a011c33eb0a30e4d9
SHA1048892e7e08e0a6c560cb64da05211b6faaf14f7
SHA2565c47219c2ece3496c932e71c118b2b1b5310eec42f054150ed4aebf0de11c5f3
SHA5123aa7138fc890ad34d50e1feb8f6fe3c641f2d2dfe28aa314dd6a889abff4dec6ec31fa1062e8d7ffe37139aeab961ecdce4b862141ce9cf84ef5d9495a97d1b8
-
Filesize
581KB
MD5e9560066bd2c210d2ef84544c2e14099
SHA12f52ab23e60e0a500782a444b3d136e950c3724b
SHA256f0991c62bdff6ba5fc5c4b01fc0646a793bd00326853216b25c8c71f20718455
SHA512fa03fcbe47d33c415d18ebde37d815f2e6eb5a3b0715711922c212619fad5d48b7ceab190b675fa2cec1b1f3bd2a9f7d1ca7f9f662bac133bdcdca0bcefbea7e
-
Filesize
581KB
MD55dc094a113d091ae7686ef382dcd158f
SHA1f7d25a6c2c5ff1f2037570d3129803ad5e856b36
SHA25632821d019fe3883953e62fff685a33b28d6633fcb1a68b0415db4faf1ea6bd50
SHA512a65610f7574009b65a21b44323eea6165ae32d3225d2e0c94c8ee907f38b043817ed85132411609baef1866d107c0215b3c78f869cd8870f7aed90c042bba0cb
-
Filesize
581KB
MD55b1acbf8c1176ea6996041b82be359a9
SHA1302ed985af1086367fc4f930150afef252199162
SHA25636af7141e7140e8116c70212d04d68ecf9d08b56b6b1ee713d0f045bf0460e6f
SHA512c376b519e649b3a8ec045352359b8aa0f1c7130f60cb1b751bc72d4cd937cc9684292607fc5ebf1b4596707e65a856e0800b92d5b54112ee07118f80e998d4ee
-
Filesize
581KB
MD5705c58356a12642e235dbaa4b7addbb0
SHA16651a64fbbc0feb25b16d3e9ab99bb24aa3b85a7
SHA256aeb90ac4e6f5eda80591db3b3adf16096ccbd5290b672392c2f17c550cfdbf03
SHA51286df23136a8a54e2238d87258a3677a668a2061acc7801685d16750b836c81dab516d4e24ff1980a535e51e5c2f69d1a1f4e56e7d31a3c2e8b09656057a2b37c
-
Filesize
581KB
MD583afdc2b5db43437d26d7f38d638a4ff
SHA1efa8df35186ee62b2506487b6802ab7443c7569b
SHA256f2c6ef66f420c4c30726a2da443036442fb54e05dbb9108395c4904e172bf8f0
SHA5124b092eceb86217686ee889f9fd569313a117c7351ea88f9002da400fdad466614689fb641fdcfd79126897f383cd301cf50b3c0fa0de023fa838d06daaac1424
-
Filesize
581KB
MD5c4886e799a1dcf97f0acad0bf854b3b5
SHA1a4c2032358be584b32f1c23f5a8924a28b80f1d9
SHA2562f1779541244808912411fb2c015c1ecd11966c4719bf2b21b16037590725219
SHA512e5a5eeebab5f5b586b4bd322b7eb2a83436be068483aeca18d039b427594e6753acbae16fd862d227ee7034c94a69433c0e1c26ae50a182abf43e1cb9f73b7cb
-
Filesize
581KB
MD529fa31ed5c6175c0c514794fffa60ee1
SHA1be735f3a9093feeae467ffb44741914cda4c7370
SHA256e166ff897f6748084d3db4a50c381af080d49a30bcc9385b85c655ac10012493
SHA5122df983c53facf1baa7247e30dcfcb658dc5465e9c9044f0cdfd31475c2ec006ccd6a922ca95284fef02397eac36dc5f928f69f4f0900f0e5404ba374fc3b1eb0
-
Filesize
581KB
MD51f9c824e6a8663c72a1a0af8bc0eec5a
SHA199ca76ba65e27f1535a6966145960f0f8605afbb
SHA256246acbc01c508b881c2f462fa444382f4c992e34f255e723360f9be3739ead93
SHA51273a31e97c1e6078e67acd5c4db0d1b5eafcf806379b13ccaa6bafd8d2ceeeeb69c0cbac0b18ea9b1f4f78ede48c02c7bfdf2ea8df06dbef1e9cd9c222f3b2190
-
Filesize
581KB
MD5e9b99a0f46bfdbe9043e83ce49b3acb6
SHA1bc661b776875b713243d6c2d7812c07703b7cec4
SHA2560db874a782aa365041ea86295c31f4920604174c893c0d1bf3b38949d16388cd
SHA5129075358f432b0e4fd6c8f3f408ced3c7e9e3819dd3a169350d1605689b6a68ba5a97918dbe8a77fc2352122d39f37fd9aa02a74d127461ae2e4ebc9e7dec73dd
-
Filesize
581KB
MD58327639c4e2127bd8327b3da940fedf7
SHA146f7e7a033acb04744645b25f3becc928c9591cf
SHA2560c22b08f1c2281d2220853beb586dd8248bebcf50605b82462d303aa52ab538e
SHA512f352342bc486f1562f93b3c991f29b39493bb16866aa3e1310ef2f6b88ce51474da6eb0ada8cc3b73c2f78abf6f477b168325b20d443cd47688142806d398259
-
Filesize
581KB
MD5a0ffda504efe3996fd9d4c490f7b3a20
SHA1bb031e820749705fdc43c4475d26f230e3457877
SHA25670312a0c80e5d6e06823c67d153e10529eaf7a7ee16798c2588f4cd81517a51e
SHA512ec2f703e2c82804bfe54bb9a13f0c7939ab8a9f65b9555d5cb13a08964fd415b5537d818d6de7940f0820f35c93a58c14df85fb77154865432332f5500002755
-
Filesize
581KB
MD5457694f256ab92d8c94f7a95abab730c
SHA1bdb3a81ff483d9fd8867c0c46238ee466d1a09a3
SHA2569ad3cfed5459eb2af3ab0a1a6eb3e1a5269a9526cf819b5b3086ed86fe5a9404
SHA5126444d56598f6c6b9e68f11cf3bf153005bff2d3e32225eaa24744b85207ef2ea6a61d5540034da8a0ca278c7afacb6d720b0673bca18739d108c2c33aa4ed12a
-
Filesize
581KB
MD572c6b667a7ed61ba3ef4f337d4d5e048
SHA1e7ac696f684b44e661d21fb6c696b461916f9e6b
SHA25695733e5ab107ce5b2037a19477a86ec716120984e39718f8fe173d99e24e4200
SHA512eca45cd5b55543b14f65378b97ef253203454b07427bad0229c34c2c421afef0cfb0cac9a3f9920debfdcf6a1679e7298a8fe907c5a2ca0eaffd9f8d4c6a5695
-
Filesize
581KB
MD5f2f9c3712ef119e3cbcad349e43c8809
SHA1e59fe7f9d4d1f975cc84696e4a0e222033e457e0
SHA25616e77b1a1757b83eb352bdaf5ee20548ac912c8081d00d06f8ca794095b37c2d
SHA512a6edf8e82096315643a7d68aea855cba8caac4ae9cfce017289690385832944be0daabf2c7514b304775999a6351560b1bbd3ce1a649f92798cee854f0eabfff
-
Filesize
581KB
MD56b306057dd28098d789705d5b63614c2
SHA13a7dccfa30e5b64c0340a27e35cb3449b597a7c1
SHA2564ff1aba305685f1d25e7050f0b2f2a50184fbe3f57a723948455bb8a155d7f7f
SHA5120e42021967690bf50c8f80c2c889d2c1792783571c82e0c5c3a1043d99ae5c0a79c30fe7f8898889f228d33811ae03155072c71832c83625288bd77a9bf56e1a
-
Filesize
581KB
MD5ba033899e0881dd0c4e089399758bbbd
SHA155d1b7958ade3f08b6cfc097d353b3fb5bf61fae
SHA25648da3adbbbf6566dbf8c12ffcd062fe66c15257842d78fe24537149f89f9a5ae
SHA512d4f8172c407652d5772e67bd174d744de5491129984e1209b8830aa1393c82ebece99e52f9fea83e3374994bdaff71a340dfefcbce9f8321361172c23a12fce7
-
Filesize
581KB
MD56d6feee0dd750e4cfc85c6bc269ce9ac
SHA13804e69f33b6e7002717d97b1995659b5f783415
SHA2563e36138a7f835f81dea767e80fc6489954960ed658d676b99d0edd37021e1c00
SHA51229e4cf52f6c7cfc5448f9354feb3d06e8c6f8127ec02473e1634883bcdc1c9cf07752d1429ec17478a6fe976ebb6bd431036e14742f39bcebe6b7c80c5f4e9b1
-
Filesize
581KB
MD59bd7324f0e8ab4ba31e96e26281ade1f
SHA10e8a0877a606e6e562a7ce454e472681e3b49fdf
SHA2563facc202fd181f7aa1cf7f78b0a796634d8c0c6f596dae1b3932230c1e2f98a3
SHA51281ac1b86a37657aeb08d8154c086f72c9329cddaadf70965b1698bba20f7924fad1946cc7e27c20ab4435df42a6179820ded40e541bdca1fb36899bf8d25c3be
-
Filesize
581KB
MD581d4d681ba0e9ebd597196fbefedb60d
SHA1a8fab38299b1bd61b352c3f6848acbe69013f83b
SHA256532a15b3948fc6b0cfe1d6fc48628912062d82f52b9b2ffe1414ecb5a822ec53
SHA5122ea9e52288f9f9a465b7a22a0d2b6ca809613f1b127dcbfbbdc31a0329302a6b1decb6f36aa9c626ebc3de519e2c95aee4676743b471d5cc2cd67df4be9c84d0
-
Filesize
581KB
MD51d825ecd51ed4d8bfc436aa1c64943e3
SHA17f9a657befdeb862e34ca700ce1c6b0e42724056
SHA256c3f65edb36957c3a83a70a9e7531aae43de2aee180fd4acba5f87bcb5968ecf2
SHA512f778cc0e4ba3e2fc09faf4a588295ba6a584de9b8c5d3f2d56441b75d4855a3152d67cb0433bf0edbcc2377d127e34343146b659d85b8ab8335ffe35ecbe0725
-
Filesize
701KB
MD595747f90e39c1eb4d090104b7e7d813e
SHA1ec3dec24343bbc8377fe1de146ddb04566d321c4
SHA256de21ed274f9900c3e4da3b78c91cea038986ced21a014d3fca6ddb8c1a23c59a
SHA512af755dadf1423b7e2bae3f2883035977ad0047de2504e55778f2516b9a185e0cf386d836b783e7b9c6a49bc55dfbe15297151e190f9319f6b400c2f48797deb1
-
Filesize
659KB
MD5cd93c04b73ec60f984ada9c6b9b37544
SHA1af449df9d16eb8d6b4a11694444c171a26fc1b1b
SHA2567965baa9846ccc79ca81f19eeb75561e0a1504e79e7a843910da53913d7c45f9
SHA5126d764c57f0d994401556d304e8ee20cea0774d02e977b4f21a2b2b75eb65842b3f58814249a1ff00127f92c98d9d1e2dfe0acbc178760ccb7dbdef94ee156692
-
Filesize
1.2MB
MD5cfe36245cfcd6bb3b3888c72a0bf81ec
SHA18bb25c305b96fb3136b99c2ce0ee5965966d7b56
SHA25612dfea82e8bb948259b3bd334f47ef538346d5db941532f489df6df5f3c4da62
SHA512edd22b2ea77b895059bde2b09997d2b422355d830cfbd2f722a536c8afa3fbee782fb976f8e94ef2ac209661919da9d72ef150ee697d7d714696781f705e2af1
-
Filesize
661KB
MD5dd138d33545d43f0d0f947c60b8cc810
SHA1696a5ae53a65423873bc4f02fb2b7c5bc90a6872
SHA25651dff29d4294792cc6b173b8b72392ae89edab27b2cd11a0d832759b9fe8a6ed
SHA512d4ad96e4b4f8ab7362bc9620b242602e1fcd4d12cd5e212f1aca673793cf0dbb19622ece73e9bedaf365a3946599717f3cf9c73269574aa10b96687682616ca3
-
Filesize
1.3MB
MD5435b99d1238574a191fd29fd8107bdbd
SHA18e0de49484579fb9c2e3c23203263ab9139693c1
SHA256f417b1a1ef65abd815123e112c11004e76d685a104d03b3111edcacb01b0e6c4
SHA512b917918929ad516f5020ec1594da37ac30f14923d09397f1e4ecafb569d782578d720601f0e12312e57802b500e53edb34e255bdb73a83c2db8405447cab9137