Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2024, 14:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-14_2413616fe76f5ddbc99f09977dc93920_cobalt-strike_ryuk.exe
Resource
win7-20240903-en
General
-
Target
2024-10-14_2413616fe76f5ddbc99f09977dc93920_cobalt-strike_ryuk.exe
-
Size
1.8MB
-
MD5
2413616fe76f5ddbc99f09977dc93920
-
SHA1
9dd13a352720578331dff51424fe6314d5ce6875
-
SHA256
aa918e251dd2db36402f06da07b87d9733be2a735bb0d056c0ebc1b79a5751be
-
SHA512
078412a39d2ab3053ae3c5cb0e281fe2c8dfa2c41f36ce7772c24d52dd45c4a1807fe182bef78376f63daa83671bf16e47f5bfb2b79c67efabbda98682a091c4
-
SSDEEP
49152:cKfuPS3ELNjV7IZxEfOfOgwf0/Di4DKhmWLIhukd/aJT:7m9sZxwgbi4DFR0yC
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4692 alg.exe 892 DiagnosticsHub.StandardCollector.Service.exe 3624 fxssvc.exe 4592 elevation_service.exe 1008 elevation_service.exe 1388 maintenanceservice.exe 2596 OSE.EXE -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-10-14_2413616fe76f5ddbc99f09977dc93920_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-10-14_2413616fe76f5ddbc99f09977dc93920_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-10-14_2413616fe76f5ddbc99f09977dc93920_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\689110c965f51a6c.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-10-14_2413616fe76f5ddbc99f09977dc93920_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-10-14_2413616fe76f5ddbc99f09977dc93920_cobalt-strike_ryuk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85500\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 892 DiagnosticsHub.StandardCollector.Service.exe 892 DiagnosticsHub.StandardCollector.Service.exe 892 DiagnosticsHub.StandardCollector.Service.exe 892 DiagnosticsHub.StandardCollector.Service.exe 892 DiagnosticsHub.StandardCollector.Service.exe 892 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 648 Process not Found 648 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4808 2024-10-14_2413616fe76f5ddbc99f09977dc93920_cobalt-strike_ryuk.exe Token: SeAuditPrivilege 3624 fxssvc.exe Token: SeDebugPrivilege 4692 alg.exe Token: SeDebugPrivilege 4692 alg.exe Token: SeDebugPrivilege 4692 alg.exe Token: SeDebugPrivilege 892 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-14_2413616fe76f5ddbc99f09977dc93920_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-14_2413616fe76f5ddbc99f09977dc93920_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:892
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2360
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3624
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4592
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1008
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1388
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD57fdb836aa1a1bd77c26e2ef04f2c84ff
SHA12256b6818eef0f2d1f10885bb1199436950345c1
SHA2566b6645e2fec4a69c151e17708ef4b334b3ebb313900f277ecf48915723855b0b
SHA512a3e81ab4530c69b29ad41cf2c1863f89aca7a70ab7b90931d3ec4961ba967c4503da453c73da2fadea556369c091e0ba982152692a37dffc7639efb851fd0228
-
Filesize
789KB
MD5df4b33f7f142eaa3348c3d0986006fd5
SHA186531765983686366cd7e118873c781127363e13
SHA256a013ee7784965b0e4c4324ecda335c6ad1261c2537ceb53b52e29201bfbc70c1
SHA5122826a05d717003cc4383a4fcab0ab5d065dbb88dfeb47742f417792aafa0842386bb64cb70a59c3cef9ff3775b7a4ddefc832baf0f3d89dd8695b4ab24082a35
-
Filesize
1.1MB
MD5a681e258c9cc1f1183d9e47444a983d9
SHA17a9c4c0bda4185d9f57d1e47474d877267668476
SHA256a2e2cb95dccd8534ee710d1fabaffce0a76028252ad68a07533549c601a7b1b1
SHA512ec5b5ce6aef63746a7ee9397e14ad0b1a7b249816f20f8bcc19c9c01c0be541fa9f653d2e9b470608d7ab25de6c052f67c3af6dca2dea01556cdbbbff3ae1dbe
-
Filesize
1.5MB
MD543e98eecdc5f0c12b4cf0ed3864e1e51
SHA1321b34532a727cb784edb24051a33fb96f069eaa
SHA256593eecc70b5a8a75d8a0438c26a5b4cbd3efdf75abc0fe52a55d62c1a980f3dd
SHA512e68ce5e0ea25d67a75bcdaf32d9ce791a5dfceae9747241e3b20305d0f1690d9b5820f112c76048db877e5d6c8efd3392e8786c98c48af47b8f653231563b351
-
Filesize
1.2MB
MD5054ebf936c812479a3f9745590e441ec
SHA10039a497093debcc128908eca3a017c2679ad203
SHA2563a704346af188df680495c507184e264997823420f68cebb412b243c24bda6c0
SHA5128573bb5e8934e40b9086c469a23c241cb31d82ccd0dbf0512f24617206572abcb7c473cc6d3f2c20db2b1ebb01e8da22e3fdfcd0eb6332be50591a6c84fc5442
-
Filesize
582KB
MD50f425f17d54882cb4cec2866cb445146
SHA18c4ec37879ba4225cde06197d9ab6e14d4c4af22
SHA2560dd3b285a2f59d6deb2c25e303dab44e16de69b7350f217be698d6781308c55f
SHA512d4669908056afde07c5e616f3fcdeb736d50b8fe5c97c0bab41aada10a15852f3fa6b410fe2e5e150d9dd2fd24dcdaa5ff44ceb83e7e603617cc128323aa8773
-
Filesize
840KB
MD5ece5ec0f8857ca8d276becfc70624e2d
SHA16cd7fd2cdae841c6914dc39a6c0bb0ff6b7c9c30
SHA2563557dbabad23288b707ce5d8b9d8967f4f004f27804a692854f90482e03cfa78
SHA512881278fb0e78cde0552dc5c1837cdb04180f9b4eae39ddde8fc853059ead190dc986f93b2184ecfa622d1ac0215d4a2f21a9470c5ceb005dd721091804fd0973
-
Filesize
4.6MB
MD5ec5a3e4f1f6adeb22cebdc93e210e4f8
SHA149208bf4d967bd311681bafd6c07e9c88b4c447e
SHA2561fd83c7f659e1c7046cbe47469c70e8924dca503f6837ebcfea54113a5c8d132
SHA5123389a57c471393afbb08deec8079d116a7b840745b4f19f05c1a6d8dcdb3f53f29c294b5524ac677056ad9ba2bf24cdb40a182d5c218d7aab26a435ee8f79d86
-
Filesize
910KB
MD5a2252f318e23f1fe38ac922b660c2ac0
SHA10b78c92e64e648330f4d38ee17e8a2961bdd7cb8
SHA2565ca699cc48f18d30e87503c3653a2177dab4ca6e5790d32314793eea5a8ace21
SHA512e8354e011e6dc1b76b8c587edaa477cd2bc2ac021b362c149c5e898e2009af538e68772176bbdf3b681c8326b4a48bfb8538a1976cb99f43e76f895435671fb5
-
Filesize
24.0MB
MD5a739f962bfec62b8049c3fa9e57783e5
SHA1039e82a95cb5a6555196f6e9e09eb8c0b7c19beb
SHA2567eee911c8a187b8cfec7e4a03671b44240eacc5c14e3dee6b3ee75282d7efbb6
SHA512c0cc72cc6b9519ed7c3a9cfb7c4d7be5f2ee78e191f22997bdb5486f6fb86ebbf125008ab2ac5a1ec78d8a2d6d68eacf98aabc5b15e465bac440fe21aa2fa681
-
Filesize
2.7MB
MD59eb007d47117a819d12cc8906322beb6
SHA15c8f2f5004ac83a5d2bddd33cbec8f114fa24896
SHA256c8a184071c68b7628cd7722846ace12e1ad88ad20e165cddb1f22b01e814aa67
SHA512b592d30f383064cbab72de515a79fe50cc0bd62fd6bd83830e9599ce352df994378f2e0e605ef30afc1aaa012ce668eb82e4d94038ffb6a383ba796573343763
-
Filesize
1.1MB
MD549c3b8a1b87b34abb455e6cae68e880f
SHA1c6c9bb4f3c2d1e8be25d9a8230c691160ee6d0c1
SHA2560942cdf651b2afc2f9f3ab19dd96be52dbe01a51f854b6ef007ae63a37bd19b9
SHA512168b044e81e14eaffbe5c9a3d8ab75ec9a4ff679dcae115942dfd5d61ae076e513bfb9cf907e5f9e25fe80a79800bade596c8062218b9aeadb3e2b44f47e4b2b
-
Filesize
805KB
MD567ccd3beb5cdcb545946f6f5fe60db6f
SHA1849565a5319588324cb283f25d324eb7ffd7fac3
SHA2567bd1f799c3b34301e97e0113f968bda3437e55dbb21891726176777bbc0f05c1
SHA512aa3f09d4b2aafa21ee3489b837dbb032aee4e1d0bb884331a022fe283826b0815f2bc1ec3212c78d5969e08f9fca99dca153d9871f3ec3f154989be12deb3a29
-
Filesize
656KB
MD5187f37d295478f4f8181f84e63c8a22e
SHA11d554cc8b12eb5107e75f62f92bd8c0e7bfa8ada
SHA25680947ef26c7aaf60c0056714f85ed5471ff1f22da643eadef54f694f56a76221
SHA512ae3f02d436c2af8b7f11d90919bfc3f7909ed521a329c05215933d8d0c8d0a08e8a5e6ce567fc8206ed853a171ef9c6e500be13cf32004c26681e219206a65ec
-
Filesize
4.6MB
MD571aeb66ab68cd06eadcb4b1d5e8f9e97
SHA16384a463bc64e0d1a9feb849a956ba5f8c38826f
SHA25620be0ff9f3ec40c9b53ea5a6126f9031c0cea2ed2b556e7a055ed2939a6aa50f
SHA5125aadba4c422e42890a3797c4374238f8536afc311eccb12cfe567cc0e1cf90f73b04f9cc4120f4d5065817d967f85fb780f83a30367b1dde37f636a9bef7abc2
-
Filesize
4.6MB
MD5c5dd011ae727a71c4948d05b8dc457cf
SHA19a0195761027bfaa367ac5a6b00ee0386bd1b335
SHA256c1ddb7281bdb3e7d433d13d055f8086dd54c9de7e841b3e3be4d016ee500f521
SHA512b778de58e357ca806c193364221f56b76d3dcb0fb9e4463e6173fd4e645ce32ea300f3516a7a1056c9f7eba4bd9ed3543198c7c1af840cb0da35d7ea98efec88
-
Filesize
1.9MB
MD578e5fed096f21ba3849500fb3c8f2385
SHA1f93189159fb3f3cdc9c481d2d7bea8860f73a662
SHA2563fe455eec4433dba10a9d6c7211f4e7f9dc72406f93b5bf01f6d4a6076508c85
SHA5125171af1851c6c03923244aa5dc497710091bbc5bbd326ad633cbaf7ff5093fdef801191001c8a25c34946ba9a4bb1da3ead11557a31c952eb88ceed74496d790
-
Filesize
2.1MB
MD5ee4b1c81d2ff8372489bc22b7d1080bb
SHA1bffff676150bef274f524c98c3401a6f0ae84c18
SHA256ef2ff4bff160c8bee6f7bd33213816ac8b939feae72db87ca1c53d19bc41e720
SHA5124e9b648922fabdfb98d9c7e11651786a70609694cbe11883fe6ccac1ce912b8e16e5843357a4aad707689dd9b9467ef805f0ec8b48fbbdb190d2b9b65131fd03
-
Filesize
1.8MB
MD53c509c13b2301cf06396de5b05447806
SHA1fb575103063b5a758f13766b1a38de667b3bc792
SHA256057108edbfb46ac13bd58e7cf3940b43feb4c711c7b8354e47ab0c48ee6988fa
SHA512dbba5efc1093def51a76f37cf6884c0c1e233dd2fb21c2bfa07b6eeddf814832b6acb3663c594a94f81d0d844698cb194968f0b4886fdfd3154caedf79ea26d7
-
Filesize
1.6MB
MD5f3f9d9c31eacbc391a802e04b562e760
SHA10797908e6f96c5acba3f48ed1ac8bdd0f9c150ad
SHA2560dea3f48f9bbfb110fe41118909a5565b92a57aaef44c7a37ee5288846b232bc
SHA51279f399023de015bf131fa9b9c33b6113ee1a04120a1b40a50c39d26845ebe3e77219837c510c1eb26b8482f3405b624a3e62d3a512c759eff62568ea6c9a11b4
-
Filesize
581KB
MD58325bd1e9352e1fa2757ebe2d315e282
SHA12c29552e347fac69c7ac93d1b73a7c1e4d99c6ed
SHA256c2e072de541a2e2f9e6b2d08cad6ad04a0d6c29705df3c667976ed52775cc923
SHA5123cca409e58faba373fade52a215d8960e3425a4763a91f89bca5fa75caf1007951ebb1719817ca3a11e8d37a49542ae9d0d4467634ace1a468a80b6de338b958
-
Filesize
581KB
MD5fe58de930ad66a8050797d79d79aaaf7
SHA14b1e23c0061b7bebe73ed9e1f35e00a2db00259e
SHA256b168854c56bcf54f828def4011925d93349a59e82512be7b421f35dc568bd5da
SHA5123230ed2bac76b4b9450840a56af87ab41e71a719a38701942df2870de872046895dad37958ce6c4c338d138d532b84fb5b1cc37c2d38d2896537871f07c35734
-
Filesize
581KB
MD542780b80e8e7bc2749bbf210589d31f1
SHA1c0c025b6970208935c9fa3038786433b6ea51239
SHA256fa0170a0f95d20ff5452fb2bc54d66b239d0408785822998f7b44629d10783d4
SHA512cbfa0448d081483dfbd1d39515694a729ad50834cf0fa24bc740c8bc0b67e886443a97a0c4d6e58e0aa1e11ce95ef223b9eae77189ca320216dfae5d5510f111
-
Filesize
601KB
MD5b5eb8347f3c067fc24c325f30f7270b4
SHA112f4f588ecd3d9bb1839661c613fd302b8750f3c
SHA256c07b36289cb2c7c2a0c1022f818557b4e1728169f5e5f8bf5376aebfbdf0dbe0
SHA5120b4c01f6abc744cb30b362a30f54f6eeb4331abdb48c8e8f04580f9d0d514fe528d1d56e74bc4b2681f61774fccb864c76d77d842263dd6af9ff245f8923ffd3
-
Filesize
581KB
MD59d0538f5e2df1d1cd0c8b0e736957fe2
SHA115277d74d23b394d0691be956380f3fc976175a4
SHA256cd0867fc7470970e15e3e3385e7aacd8d3439079763a68dde4d31f9455805a41
SHA512795f85c234a59904d0485515937026dac060b8919a692f79178f047afbc86f055b72147cd715e0eeef0196a92ccaa5f709ae5b413150825d3147db5600b5b7e7
-
Filesize
581KB
MD528bcadf3f92a38458755d23a55ffa6bf
SHA16e700ff56e07d90dbc044602dabea89d5592b628
SHA2561965a20b5dbb6ce59e9fef9bf377f2f0f67de79021a5b87d38135cf364fb4ec0
SHA512a969d93f2e7d0960e570bba815dd8806349e672ca980981586d4d53dedca1f1c852ac6b41b89c8bc28414c0bc1c0c99eaf115a5da3688e704ecb509aa6aad8de
-
Filesize
581KB
MD5ad7f9549e5c0243bce92a41c2b47f7da
SHA162adb762ef19d1cf7d1ba653905ba31c6ec38cff
SHA2566f49448f076d42774c2906b92a87d607c0526c92ddf676bf5b65695aef33fcda
SHA5129cf84d7dee5604d4ab60ba5847310ed308ec42103b220505b39424ec2cd47ab4229f966f908b7da3a2f5e21bd029f7883d1d0d94597a18ae6718185e928925a9
-
Filesize
841KB
MD5fa64155289aafe293a08299d13b30692
SHA142a57850945974adf1993812647e7fecdbc77553
SHA25686a65c11957f686cefc7346799b6a37e430ddcc666a7dfdb5d6e4fe9a7446890
SHA512e30e7fb2aaf577bf10e703c1cc20e1faa5e2b22404b017effe3392974dcb848c3994efe1ca2eb0adc0bc32dba555c2c9eb6bf3b1190394e12b998630dc7f844a
-
Filesize
581KB
MD5805729450171dc5b48f06921bca2ab8b
SHA1036974633d53f74aef69b8fdf0ea46a767ee01cb
SHA25603e1cc4a724b41cb41297f7c42a09802397955ce9d77084505f1a910f90a9666
SHA512e19ebd3b3d18d785a0b330ea4d94b89b7a35e0c52c08b30682b08a2306a4291d1e74db577c6bd6baa7e157935e4ac6f00b66e6e40ddc12a7f58da0070ff14ce2
-
Filesize
581KB
MD5f5260a77fa7c9519714bd4e76e713b71
SHA1167d63de6f5da10af22aed0671344f47f9216dc8
SHA256403d5e7261fe7eb4e5dc90b108eeb12da94df29b428b3def3dab662798cdfa33
SHA5121d6d91a5933b49c0549f665454238036c6d69510c78dc806403610bad47d650ef7e9fda5eee879308a1d7772cfaed4edf5343e64e757cccf43b9f2663f86529d
-
Filesize
717KB
MD59fdf2259ae57c5c8b4ad6604a680826f
SHA107300db864cc38cd86d2e85ce106630111d656b1
SHA256ed2a2d506293d3ac19eee4335f668741df6fd745f86ae0f44d6e5084e3f71461
SHA5125f8dc938b8624ff8605c4b21c6269b938f7687c704a3a57613c97207e7d14cd6aed26c51ecb52abcbea5834a8f1949bc1cddddccdf9136cb65407f5f53bcf149
-
Filesize
581KB
MD55d10a328d509b57447104ae000d22bd5
SHA17690d6384d692f2ce4d810cf72dccbbf657df8c6
SHA2565c951f1597ba250578a20a5d9eb2b0394d1bd284fe5677bf8a978d24a4a01d73
SHA512351cedbbd01ca9284078e41c0548b7ce47abbe5be0880d9d3d6f4e4fe76f94bdac89d3822cd9f95a9b95ed18500b22e351f67023b80660da3480da135c446443
-
Filesize
581KB
MD569ea6eefb2b5bd8f4e371aa6af12d4b4
SHA16136d7748e48131134f328c0e2500c65b671196a
SHA256fa19db8d9179d7a86e6add3afc921796af6c25fd5dda07806e90bf85cddbaccd
SHA512a43c39d4f16361399449bdea579307596cc6568880e2b78f2e886dc3827a60e17e23889dd388117c0229b4308640f6ef92ae0dacd2a0dc37705ce5ab820bfc49
-
Filesize
717KB
MD529056c3879d14fa32db7ad43db4aec61
SHA1090e9a12f004c5621d3e00d03693d402efb9c9e4
SHA2562609361cf984b77efd74bcb2cbdd74a3ca057d4c3d765c64d12929275f6fe1c9
SHA51203fbc50cc06d7a72af4015cb9bc992eefc9f65d44f31f036055cc3c8c59a95f5fdb5a5c819b4f63c6f327878daf4285a039c27308f7c498a200f5dedbb11ca99
-
Filesize
841KB
MD5a73c990cae5c922c5d8c6e27c75b9312
SHA1bbe774d3d1c14e6290986b85a833df9750de0f68
SHA2563994e6917504ddb7ce99c3fc8f4eecb80a3903edb306e44d1d0cf06bac83d5e9
SHA5121811f0c9c3c9c09b4881ffded0dc086ed850f9e72caa00db29f7519fdb8a09a89ff73a7b571c0243c23839aceda385f878a8d57936effa1b7fd2592a5543dba6
-
Filesize
1020KB
MD55dca400955b22988483ceb788726f6b5
SHA18f3b38a92e9c2759fb51f9981a9e4947169e0f7f
SHA256607fce17d6ea7fe9c84d83be34b740c01a7ac8b46da9b727b9cebd9cf90dd3bd
SHA51238b4a13b93554f7e025967139da306d8004671fb87840ba8b66c10a33daccaf57da848fee90bc7043f01689b3f9a304ccd4a0ad8bbf977b78b9bd7fb28440558
-
Filesize
581KB
MD5fc706bd7625a5011f529ac1c0d6f4d53
SHA127ae60a7fb653637c0222f307fbbb0f52c6fa2df
SHA256017e9ef2b37443e9304d80b003f41bbb9e9de4d20b3be91f46c987c55ea92f99
SHA51218266c34f45a59f8f213179ceb2d81d3c3c9955ec268f372e46f1bedf5f40ce25bd7796519ece7aa4a7cdf51c9e56041c1c7ad1f2ff020a9fb06b09f94228c95
-
Filesize
581KB
MD549185a1ddb375492c245571b5c9e71ac
SHA19143b2bca2125af2da77108d3e1c96751bc92bb4
SHA256e57ca7af03a502e4b59dceb675c431ed515cdcb93a666f2d2e6e33224c7e1ffc
SHA512bd2197268867c98f30bc5b88fee951e4c4368993a11105bfe6d612a57b13c5b9d4c64257ab214fcd1327e607956455de9b5f57d5b0ead9c81fecb18bdbb9965b
-
Filesize
581KB
MD5987a170f9101dfa5e20914ef5e30e111
SHA14387b66badcd7dd89113292229c295b36d903c05
SHA25669999cf23804e343689b66e4e5d49334c792d8dc58d6a6cf20b1427ed76d9d77
SHA51235649bbb5805545b3e9ce81a82d66edf1605ad73fe894b47e652110eecc3ef434a6fa22c64d19ba13053e2e7c984f2409dcfb23bcb5b73e32e42939b8dd13019
-
Filesize
581KB
MD589efea1881a7a0c9202ec6ff4454337a
SHA1ee911c28d0d1747c4b3bfab8a6de6c66dc559c23
SHA256bab25c0879d5ccd7f12a5b1fc5efec6fb904a3681054e6bed4da469e8915a601
SHA5120c08b62a9a99a0e0ed0c567ecf38e178f8a86e1faa746500580179fed6a09b16388385107c459dee3a30e5f1b8e22cc5d9ec7f48c7a74741a4356c0f59405d79
-
Filesize
581KB
MD5cff3ec79b6f49339ae31f0ef73eb55f3
SHA15c2007f4257a49590cf16e40a1d97f81facbdd9a
SHA256df9d339a342f1e8f1afa3396db534efc1df30a9efa76f0bd58728f675c99d14d
SHA51297766a9afe351ae6d222034577c63112ca4d5f9b45d776b4de73841d3a0a3877c650a75f163da8d3a392682d9b7487c408e6e4477a89489498921e8b26857e32
-
Filesize
581KB
MD521824b3ba1e20ab38ead106bc76562f3
SHA1142c7c8fc72f1bb96ba78ed085e58bd782f71354
SHA256a816d2a1276a2ab25af2e53dbc59b286965c7d3241feb93e9c29c03440e6d5f1
SHA51282b836a67c889a72eada8f969abb6e17971a8529be50676b331a4607dccf0b898223a9e26ccc8ce8d7213c88b25c5f2b7925705f2ed66c45af4ba5a76462e9b2
-
Filesize
581KB
MD51b709ce855dba7768670d33c908e0963
SHA1178de458bb59766f764062269ffed68e4e5101ee
SHA256c83382203875be59255251d3cf61b094f3ea638092e792d555e404199b4cc1b0
SHA5125281b14048b7cb021e7ed1720dd1e4d8a7d27b2fcfdbf2abcead995916bd46c34ee0decc1ff6b53592b8eacd01cde94edf8fa129a6cc1f693c48d738d7f7dd80
-
Filesize
581KB
MD5cc0e1d035013063906886f77dbcec5d5
SHA1e8259439837d7cb431beb1e5274ed0012df2f5c8
SHA2561f37a1bcab41254829752ddd0640c506cd62f43ee8eaf0bab377b2aab66027c3
SHA512c7edd71366a4192aa02d7884a47fbaebf233d0f71151a497768824379569dba24283eef0f38e4ea660336b18016c85c5cbe47bc09e31f5ef8301dd0c15687e13
-
Filesize
581KB
MD509e075c0a8c452466b558d7015112b7a
SHA179b9a27b0b15f1ade2c54024ce2ad3c1fcc998bc
SHA256f97feeaa29de0c2f2cf41ac239a92ab068030c6ecd3c8fd5a333fc3eef7e12ec
SHA512b50eb7fd7097f2237bf9f0e274c1ae08cb730ec880b8bc8f4fa8467034b5a1ebaa263cd91079a19be12b4330583ac3a0db821679714696382b14e2516a3b5c34
-
Filesize
581KB
MD5a593d32804a44090d781c16dfce50ab5
SHA1c43923a07e944b9276bc52b37e8ce44cf3023d76
SHA256b7d274c074a98d81f855a7ebd9f8fde96e028c0a2a24d79b34b628092801e464
SHA5122aad71236bdf535a2b48bf61a8f4f9394a7f5ea0ae32d0a8b7638a91f9e2e7c259d1368f47d035ae2018611a9c68227b71472ee578760f45504fdd090b9e7cd8
-
Filesize
581KB
MD519a989f45c0bbc24efa18f3c7fb2e0c2
SHA1b673718b37b5c83e3ac7aca8b874027c0b9308e6
SHA25619021b995f8ed776ac348f48c6c246efc294176b713639d0dcc7e0e01682901c
SHA5127ff62ab1d70e107422e957eb15c9a2663d211c7ed00a081e4a6bf1f3f6c455a58c22cdda26a7d5b10571f013779a01cc2c984e5edeac8ad96e9ddcaa84ced1e4
-
Filesize
581KB
MD5555810c8023ef5ff0522f68884615ebe
SHA1d6721ca78e2f3f47544ddfecb2cca0cabfcb55d2
SHA2569f8bc8017e94d4bc8df522bc47754a9438a1a1a872edef8f0a03f96b47cf689e
SHA5122d29d504d2fa5009c05334f4efce4050f1711b2b6c91e6873d249b53d1f852c0386f9bfcffddcffa6e1a06849219c7f825f885be6b5880ddcfcca8415b7d3241
-
Filesize
581KB
MD5d017069ad108ad3a2d4a05f79fbbb374
SHA1edf11fee6726fda818bb25a4ce346b1c50262e37
SHA2567e93742bbbd7312360b342f34de99f2d1c78bc02b4bccd262fed4ef26e46aa6b
SHA512435b62a3bc98f91daf9571013018064331356dc87a3b422a70d5f720df3542310f362ac33c453a30dcfc0fbbb8e32b32da953627edbb0a67f1b64d09a7608baa
-
Filesize
581KB
MD5c1333b51f52d1731d7ea48da795427d1
SHA1454fe9701948256fd5197ad282a210b98ba34f12
SHA256b4e7d33da62e9698d1db03a6fdf5d1d48fae5ba5a131bfe3d8762653366f2b89
SHA51229830f204d0f22c996986d3d1747531e98ab856c88d6eb8d7f331ebaff835e41258cab8badc4c7d91fa31206d582d218297ed4cdb8a8f4f1c73aaf6db70905cd
-
Filesize
581KB
MD5ce27f74a7f55f3dc48c3a76ec8f27f46
SHA11735a32b434d8bdf450199560f6629f3f4ed7f41
SHA256862370b98f288c827ad89d0cb123174b6f70f37c5a1c3858097998cb51f0d05e
SHA5122e7045175b9145122c29e03bab64066ef964234d40eaa1e2de8488640b1352928297944136829461bb97d07a62759ff1d290d693eb53e0e314baea3244a34491
-
Filesize
581KB
MD5b79243ec6186b41aba79053b8cace551
SHA1522be345840fea8bbb6d27f984d3bc2e630f45f3
SHA256ef584f658777a1e5629b3bdb125e8556233362695d95195e72eb31a878a7f85a
SHA51251d0ed955eae2b52787c03fe5b5f493b72ae04ad7075367e0b7c545e6190cf2317af86946cdeff14ba481a7c4d2a30bca431f23305e80df80b5e2820d4a6eae7
-
Filesize
581KB
MD5eb7a6a606bf209f7aeb3da48a98a0de3
SHA10fad0b11ceda8b6a00c4261a5d84add8933ae4e1
SHA25616e849a4b49e68608d607b7f3d36e8a29f200d63b779e0402d4044b3db2bf81c
SHA512f2b3f2d8b4b1b6d42668868db3b64acc842a63a3a19c2854f20dbfb1764183a5cdcddefbbe353f91d788e695ee83c0e9cd7ada7e8d900fc772880e50fca3fca5
-
Filesize
581KB
MD525ebec71f917076911300b0882117782
SHA1d394f2a47c8d642d06d133042efdeaf53de1bbf1
SHA256ab05bba9801b51ed9be0fbf395da724d8ff09a749d9e294e6c298d7c15350fd1
SHA5121a321fc12188e15443c296681f70726f1828093e15899df2f29421a3e58dd0edf34e339e0254ed53ff9d086b955a6bef4a6ba1d10b945f3d38f54a90c328a3ac
-
Filesize
581KB
MD56a0cfab805797de8cc3c9a7dc3a58f1f
SHA125cf72c74686081a14e4b57f494e18ab0855c597
SHA25605f63a1dc05b5974fd8d2816adf4a228c145f48470a17ba10f9131448bd7d671
SHA512dec449bd1e3141a8dd8e935e1df4ffede7a63cc44d98d3792e857714b6343349afd290bb7b20d472ab48e5f0d322a18e8fc7394e492f58225480b277bbf4d913
-
Filesize
581KB
MD56ff416e8b59582b240a46325ee7e6e4f
SHA1f40db9eaf4b39ff2b99b7d98211dd5addb957b10
SHA25660b718a0b4c7d4e343c1b5698a3941ab619478536ccdda0b0fa0fb3d674433e1
SHA512f1c514dd47549f62db954042d01bac259bddab49ab8af41d2ff00bdbfe03a13a60094ce77983bcb5d057d0763611732821776ed5fcb6aedf3831e8cf18b55865
-
Filesize
581KB
MD557e6c860c0d8caa04db2772def6399e3
SHA192e8029fef399f7bf118997f130af3c5e31c0bec
SHA256f758f695645b7e4ccc42ce45b2a3706a52f7b0161ee15f5f52d52b78b419d0a4
SHA512f242440c2cf4227fa7fafcbe78355594f74ed0e4ac27bc3af6b02c33a59305619b28cff8b7fbab59654d0c931fa8297c0cf57dab62a26239206d0607e61a0bb1
-
Filesize
701KB
MD57c65de4b93eb51a0bf92c690dcce769e
SHA166a1103644a268b61c77c00aa2c5466ca607590f
SHA2562ec9854dd75cf2cfedb0a42f4778e72643d6c15ea488364c4f1c0440a2791409
SHA512a07b8916e7d4043e0d1147a35b754e2640bcb8036a442deebd293fae382285aaeac11dc348e322994d957008ea4a619d9ae08a94405ebb3f94dc02a2ce8a6536
-
Filesize
659KB
MD57bbc012b407f532ef43078bff5b6cf4e
SHA17a924d1e8cc5ffb883228c7a636f5929fd8cac23
SHA25632b7f654b9d8dea5f500fa13964b68e458dc4376daf36d94f3b9877f1ab29c81
SHA512f780b4962968aa903d59909ba741b9ae542d9ed8d6d85bfa79c201bf2898996d5cb223e14b7d3f958abf78c33c8e40e66af83ab2e52dcb661de05e5c97c00190
-
Filesize
661KB
MD56e3459700815279ec73d9fc1f3d85599
SHA148405138fc8460b54672d62076db0d77c33667f5
SHA2561b1b4871796f8efd5df09273dc3ac6e6b1c965f25bd44425399e2ff594adc135
SHA512f4ae115172f6fe7be57485d7f940b5d8cfe80c30e0368e8adbd7780324d5e52329793ae5a7085d7de1bfa4e3a9d73297f08d4de7f87fadc24369bc09285679d0
-
Filesize
1.3MB
MD5aae9c04b55f968c1b62ac6fd928862fc
SHA12daa6fe53374836ddeca2c82dcf753e36f48e947
SHA25659756d26cc4f05e76b62cf7c7038527e07cc16464e063b258fa1dda8ae2f8fc9
SHA5126c37d3f4d13f806aec7e3ba05745b8ee0e81d4ee435a8d8f9fdd11780c728257bf0cf9d2274bd23e43beeb19467db0eb724e2faaed912671c6f852305e632599
-
Filesize
1.2MB
MD515f6e0d5d7f1ac275a85dc9244126f3d
SHA18b88bac1f2aaf455b5f644d7841425b598791d0f
SHA2563139da862c01da5324e03b02145e68346cc759dc4fa274d49b081850e1145355
SHA5126e3155dcf2229f1efe79d20688620653fbf199bc2c2a51c502da0e244730347cd1ea984cd1b6fe271db8d691901ff36d07a436c6774f75a3c959aff735f086a9