Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-10-2024 04:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-26_632f61b0edd782eb367e14a24b2c4f4d_cobalt-strike_ryuk.exe
Resource
win7-20240903-en
General
-
Target
2024-10-26_632f61b0edd782eb367e14a24b2c4f4d_cobalt-strike_ryuk.exe
-
Size
1.7MB
-
MD5
632f61b0edd782eb367e14a24b2c4f4d
-
SHA1
b7a1df5407eb6590e04a4880ace477f40402947e
-
SHA256
b4a7984cafbf50fb8e113870fc081b39c2c0f0d1b0a689dd06048472ae82a344
-
SHA512
2a8e5474a1732985329f5f167ae2e84887a7558e9ddb07147a0ca8a47bc855ac397c20e83e977373d71446f5a0fd55fc8f2e1014dee416f54284c0a25634686c
-
SSDEEP
49152:g4f65cTlG8mMHcn3obb0PzPYayvYNhVes:gSG8mM8XP9yvMVV
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 3744 alg.exe 3336 DiagnosticsHub.StandardCollector.Service.exe 464 fxssvc.exe 3012 elevation_service.exe 2040 maintenanceservice.exe 1400 OSE.EXE -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2024-10-26_632f61b0edd782eb367e14a24b2c4f4d_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-10-26_632f61b0edd782eb367e14a24b2c4f4d_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-10-26_632f61b0edd782eb367e14a24b2c4f4d_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-10-26_632f61b0edd782eb367e14a24b2c4f4d_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\568fe6d9e5a029dd.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-10-26_632f61b0edd782eb367e14a24b2c4f4d_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe alg.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-10-26_632f61b0edd782eb367e14a24b2c4f4d_cobalt-strike_ryuk.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3336 DiagnosticsHub.StandardCollector.Service.exe 3336 DiagnosticsHub.StandardCollector.Service.exe 3336 DiagnosticsHub.StandardCollector.Service.exe 3336 DiagnosticsHub.StandardCollector.Service.exe 3336 DiagnosticsHub.StandardCollector.Service.exe 3336 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3612 2024-10-26_632f61b0edd782eb367e14a24b2c4f4d_cobalt-strike_ryuk.exe Token: SeAuditPrivilege 464 fxssvc.exe Token: SeDebugPrivilege 3744 alg.exe Token: SeDebugPrivilege 3744 alg.exe Token: SeDebugPrivilege 3744 alg.exe Token: SeDebugPrivilege 3336 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-26_632f61b0edd782eb367e14a24b2c4f4d_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-26_632f61b0edd782eb367e14a24b2c4f4d_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3744
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3336
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4372
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:464
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3012
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2040
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD54889d1cb15a588d3eb92892b73430a23
SHA1004ead4b2f7eb37eac9f253e741f584a11de93db
SHA2568a2b869fb68ea2402ce43345ca1c3423ffdf009e0c7e2e87daea96497809111c
SHA5125dc37aec7100a6ea59ae0458fdb9504d60edcf34175c47a573a6fe929cbc2f768fe864b2b4f332b2f3c86e9261a4c243d5f380c4d312aaf9bcec30193ca8b74c
-
Filesize
789KB
MD5f213d0cbeaa6db7ec36ef4c17da74ef9
SHA19199feea92b992f03faaafad07c0d8347e65a3d9
SHA2563a1459c0012d8cdf32b886765afbb0c1229b7d9c0289d7f2567f2ca915197963
SHA5120c59ed2602b7a2e5f0a3fe8a94176fef94fdbbc811e2bbca55ecec633b4834dbdf858c64d8905f5ab6067e22bfac83d95bb308ea36e6f7a547301b4cc0cc2f4c
-
Filesize
1.1MB
MD5ef720bad6ac8ee847400283d05f31d09
SHA1474c3e75664f68ae0f63a60752bfb6c4699f8f64
SHA256309a719e74d040cfa534e19fb1d4ce8c01ebf61006a62c1a7b0351fffcaadf20
SHA51263cd9b3d92f94d6a0703d5af3a249f8a2073bada6fb5076c2d6e3b10435343b4e731e41c4ed00cad859b85b028f2631e61aafa35e6d3951e476fc6d3d4557ec3
-
Filesize
1.5MB
MD5e8cd33ff079c47e6464fe00bd659f8b1
SHA13890ab924a4e9495243b4ea6b2be9f6e6bdb494a
SHA25668461145cd43bd979b10a4cc9974497ed8ffa03ce149a5725bb46ca2291d1d24
SHA512fbb3fade3020ca31403e4e11e20ad936a24b2875f6bcf3507722241d7729605e72b39e6256f7eef5e3fa3d68fdcb36899018a22eb586d3ac7e69ce54a2604366
-
Filesize
1.2MB
MD52fd06f4296e0c9d33a99f573b7f598d5
SHA1c35beaa8d3a5793e62eb7f01f193265004f19f5b
SHA25613eea0d5f919b419a76623680b45d6e19e1c759525805edca142dac9d4b5ed2b
SHA512c179e18ed3ff595bebcfe70d6ba433c8d78f1d1f27b523778cf1549a802119b6fbd8f7605f7982626e8b47ef3a17f79a9bf8581934ecb4b4d6b0042a757be345
-
Filesize
582KB
MD51b6947fb3352c63b1f7bf41214989530
SHA16b4763efbde5d89f5caddd261dcbcac334fc16c6
SHA256b885c54ca6a605736fe7d052d2304fa6da49eb2785afa3100181f15cf8fdd140
SHA512807e383634ac0c5ca6cf115f6f48892bd001a01cdea41b78845718341ee9b43ae8dda34c58dacd9335b967c1e53ffda432f34e56a9daeb82e120e83c0264a6af
-
Filesize
840KB
MD51daacfece3c57a881a0f3c1d159c58e5
SHA1fd597508449ef2985d4e1b3b69e62115396107d5
SHA2560633f3c9ba578efa64abe8e7d43628fb923b7c38ea2b754bf38b3490a06c039f
SHA512bc83bbbdd9ea9658eddd954f9a0d771377ca3d302a696f2e49cdb52458ca3b8853d5ce2ac5b517c0eaf70654bf9124124fcfc4c4fb704d0e072376081dabe86c
-
Filesize
4.6MB
MD5cd242aae95c11d67fda9a07e98f5ece2
SHA135b770ec8dff4e80270d0ac0f0fe45179dfcb5a1
SHA256c5413816fe1214f46b775077f2c3f11ad5cc78ce430f87e668762abfa33a47c0
SHA512075d7e21821b9d44bb524535c23366cab0181b8453b7b970cc64cbfe8a325d0b05ba7e91e809f61f246875304b0043ea36a94d52ba4aa4367cd142413a4ae9ec
-
Filesize
910KB
MD590fd5894bb5a748c542906155eed24d4
SHA1e0d5d776e750fd534b43d62d5d5a382e62a8a3ab
SHA2569b4e7895de92951709dca62588f7097ca73bf8334f3a8a436e1fcdbf72f3687a
SHA512173bb29ab6c896dd8d00bb480f08c55e447bcf95d1eec6344ab5e12a4a17c316eb3e564096cc499e324d555098f10e134be9210596b27481443caa19c53ff2b3
-
Filesize
24.0MB
MD5ca12176144b79cb78d7e12e4a90b8b4c
SHA10703324ae53e7608ee1bec6b67ca5c860c3da797
SHA25666c4379478cfd69909be69c4f9e0a8734cbd78b53399d7d157a439bace92a552
SHA51285980044087ac3794b87f7bbd385f32e3664903273036e6d773bb0ed41cf54988444b75010e4cb6aa3edb13f4cd9d66892d2a6699be5138a9515fbcd41be5e04
-
Filesize
2.7MB
MD51396f55032346f47e1e60e749d1647ca
SHA13d51310686c559ae6ac99f5138db7fb064af2e38
SHA256603b7247dd9907d8d9db8e615ee95bfc6e39c0a48928278484c3a446d1071271
SHA512bc57895b2ec64c5e69e48e25019f46dd68b6dd4b5b392a489388768becbdf9ee885b316fea543900696daed78b425130e581b8b905b312961fade4abb0032620
-
Filesize
1.1MB
MD5758b5aaac2af613f3d13154eab73053a
SHA162e9525f98a17d94b27580edcd9f46dba65cda40
SHA256b51c43d22567e9a1894f3c00dfc437b2a98d3d4e42321c529da718b7f53e9716
SHA512fdeab78f058c6e87958d6bf235f8abe424c9d292af0076fc2cc86e5b5fa05f1f4c42f7bec13ba2d68cd0ff4b125c8e939677f8f18f78f338d13d30b5c4967df7
-
Filesize
805KB
MD58013fa7aa2d2c37533ad21b4fac6cddd
SHA1ac36ddc4f837bb42d716c2501228c2a8b7e22792
SHA2562b510322cefce076682a9466c4a4fc8f46f4918e4e43070b177af0b72903bb0d
SHA51287bb5cbebcba50760edf576f88e25ea0043c667d0d90e52b77670dd72aad1cb4f5690913849832cf1d6c7a234a76c66a279112cccaac0bd4c6d31682da4e5221
-
Filesize
656KB
MD56a506a206eaa50256a88ae760ccce386
SHA13930124dd1a98fa2cf7c0c777f6631e68b9c72a3
SHA2561b7c1478901c0844ec229dd6e246b93b470ca3767b89e9b84688b51546678c30
SHA512baa5b7e984bc07e63d6525fb4d44932063efa1c4a5d3474fbd197a74dde4ab45bc75b22856c8640c9d45f51daaebac7d179645c5461b4f75b9070d48189bea1b
-
Filesize
4.6MB
MD5ec018c9ccb969e29215ebbf267f37f9d
SHA1f6fd7ac33017f586b1b89bbf15fce0c4711da37e
SHA256262d3c2f609e8a4dc94a48631afd201484157ffd3d1bc7549663d38eaab79d88
SHA512b3a584d5e3eaed35f18315bfca0188f585aea000884ca1c0c3b70d313eeb4d895e6e4de1f0f45aa4f53282381a2d9f319b63830dc0bf918d9496bcf55698db6e
-
Filesize
4.6MB
MD5d8379ed83684110a4c55a62a431ab0f1
SHA14ba2f63fe3837bf22aa9f99fd4d3f354058e0c09
SHA256fdb78d6066fc63ff5fe46fdebb732f38a6f269dc5d7e216b3460fec0ca21b516
SHA512873a97373bb23b1116f6d0fd9964bf81aea6c21ab347e931ae556d289d8af8444aa8b662c2b70993f074560b00efa543aa3118cbd25e7ccd37d8f723dc0b3cbc
-
Filesize
1.9MB
MD5af10f937b9a7c01bd970fc61276cf080
SHA1bd1b34d7abd61df6caafbb47c4a1f02c70fc5c30
SHA2565abd280abc42adf7d6503baed1f7a445ecf891595a93a33543281f4488bb4ff0
SHA512c3f5f09c73f331a8bc5862f0e48b31c38eed9d5f1c8d5f19b2889e181e22dac2e686cc7eb471661225fe758a5d948a6bec5e50ba2f5234ad0a1659f05b94df46
-
Filesize
2.1MB
MD5e7d85a2010747a153c168657708517e8
SHA1c3e4841f8b49e98e096e78fc34a37d2cf8ea5c92
SHA2569bae6213115ffaf33a48a0e23a11b988925faa087e73eabecfc0dc8092e0aa81
SHA5121002a994e51f4ec6b9ae652ea305a0360cfe3cb778265463558412befee12f037ed2f2b4aefd16de7927d13551854dc9c5cc2b36a61cb474eb1099e0d6a4567e
-
Filesize
1.8MB
MD5751090eadc2bb04223fe4536c2120927
SHA177c4a88f43d4994059efe15178e8484c97e3050f
SHA256c164c684c07c6a366fcbe5c2e10925effc0e80b72897e7e49c712c539ad16dc8
SHA5126cef5689e35f5bdd09fb93bd563dc96d7e512f7629ee25820a7fe7a09d4bbfade9c9420a192bd041fdeb0e14484b58e480a62df842ddad3c70062782b0a8c1f5
-
Filesize
1.6MB
MD54374caf34196d7d3039cdfaf93cd96a4
SHA1f25de8c7a2d99e713e4db333219f7bdff0eec25e
SHA256597a3b6f2eef40566d13818431d12792d678b5b62ee6ca149fa99801522973db
SHA5127df7d4fd6dbb98292918a159c4c9c1bc8d76216a834f15e8ed0e99f50dbcc9d38bfa0e82bfa81557502bd6cbdae2c817e5fe1107a4cb92458a8a2f1891b28361
-
Filesize
581KB
MD57f1aa2d56e08004166a88497d24beb51
SHA13021ca8ae07e65d55caaedbbe72539e035698d91
SHA256d7732b1b27b350e141fa68842e292b783f2ad476413def3ec344c7c8230230e6
SHA512922e44916271104e64c42422c1c9caa35c0f7cbb31426477a7ec77a3f2998e6600da1c793d796e0d257e6c7ca0ca1f378acf2561c1ed94b4ecaa6931a2366099
-
Filesize
581KB
MD5a5013db085e10671c59c2f382af39a8f
SHA12e25107acf308f64ed9228dd52feabb65850ff00
SHA256f01c3b314a70d1665168f55b87215e1e43bdb8b510d10d855b0e53424469a27c
SHA512313e449d0671bec5896a8b6e3c1b512aad026a05b971c5818aa1b5096b348f36ce10d97bd25e357debdb445648f7c88ab02933ecf53e1e8748fbf3b391d5909b
-
Filesize
581KB
MD5e24e170e37b474d68b950101741f2596
SHA194f3c63fb5a7b35e369a9f0d9cff2898c7b615c2
SHA2566ff3e2456ce3579831e105cd2762261e094bade2a8dc7143127849147ccdccd7
SHA51227dfac5b14ca6e6d721d44c297c0e8a8a6aecf84128116c521695ab4c71ccdb1955f673d2c80512c741ef9632f3387d9392c51d5b58fe62b84936fa222a6b525
-
Filesize
601KB
MD59673925a524f9896635754a9527cf964
SHA1485880c7242f5d072b92456c4a3014365397fe5d
SHA256adfe19e3f2536db8091317e5fcafe90553d5fdb8e1962f5b6b9ea8b8c3adb74d
SHA512ca98aadac6a31a27ecd128c3ac15db3d39319554174f8715fad7bc92e04ec64cd9fe1e0a9859e29f8500071ca5e01a4417e67b4acf5320fd63a052ea11499260
-
Filesize
581KB
MD5c59479a31794cca93085a25843b21e41
SHA10c2433470d988676bd2b603908992c639f9a0567
SHA25643738150ea7b85b49655223a2d56f15a55abe23484544625896cb8856e093d45
SHA512b917e178d64fd18fe4cad90a0319cc111a7978d673c724a5c9eb6dc06f2f08f59ba2e8a8cb5fc31e0c240dc3c6ac554df3f11c6b4f1d687e92ea9a33fd959598
-
Filesize
581KB
MD5d39ca4a84037bfc3ad72f1fd8fc41c90
SHA1cf7f1d478a91b78e7be3aca13e89d84b5f088238
SHA25643d04d939f24ae47c46d2f2fc3bf5b9517673fe248c65074a5c05b6148013f86
SHA51237e0143a4413cc2908446da01f929cb7b19e887b64805c052a718f1eeb6dfbaee6d9ee959b5c7261c5c778011dc4e91fa0215f5ef0cd7517d2a94b175b2db2c0
-
Filesize
581KB
MD58c758baf961c7fdc658baaa3ac8637fd
SHA1d55e27b0474582ded1f5a930a7b6b33809402d22
SHA25602ca0b4ac94caaeba24e870999811a1da71cf41714d1705e649960ca3055141d
SHA512fcf464f2ee059128dbf4bef994a4a55a3fb7befbb0dff0723cada824bcff6a5eab530dbe03a96b314de4aaaec5e23a30d0de40430a9b02455ae9f1f8d0c4b7d4
-
Filesize
841KB
MD5d0658aee1c6642c97c0f8b2bb25e4c66
SHA115b106bc8d934f7394db86705699affa5bb1dee1
SHA256e66036c64aadb2129660beba14bc8288b5fdcac3a75c0c4f25ff35011186c285
SHA5123ce7820221a1c2b069428623eee165566580443bf93b4318b3ae7fbcf7c13cbbdd8e5ac8fe94045355c9f3241891c7909135988924ea79767012628120b38011
-
Filesize
581KB
MD587c1837a7dca270e0cea8bb2dd046dbf
SHA11e1c4739fa205aa35f2b1158ae2904fc381946a0
SHA256650db85256c40bbdbe0ce20f71e4ef50914f5620a6628f2442d5aa8bd514cd65
SHA512037ed64cd1c45ef7aa6f2a09d6ad0d971b3a0dcab68b68b971b317fc9839fe527e3fd2882d6ff8b595e0b391cd2d3ee3e21fd014c61603cda05fd32e4bd1a4b6
-
Filesize
581KB
MD50df47043100b93433d5ad290eef20bd2
SHA1ff39c7030f44e9ea03b86b7be85319fe2c2af4a5
SHA2569c16b88fd77fc01b96bd32bbf43d2430acaacf022ca7d4d78e8a0c4823ac8624
SHA5121f4b4f537047cb7e99099a5088e862cfa9f22415c07b0a4eee493031bc74c3fbf4756096125726b673f8c3922645b3a4b9eb5224598193dbc3ff75631ea98264
-
Filesize
581KB
MD56d33b15aa10dc8d3149167e359e7b186
SHA1ff035fa1319d3ccd61988abcdce0eb9fdd40ed02
SHA2569880e50136d93fc04035cabd85603352c0d1398c3aae8ea2b9bfa788adf1ee9e
SHA512232ca20feaf68b0dae390082c539cf2f5eb22dc0cfe68ddc104663e82da8bd0da07ff4b8d93f158f094ac79ecd8adaa25f4c1ce4159937c7b0c0957e2f2578f7
-
Filesize
581KB
MD5d5c147ed246a35f3bcd0369236b93165
SHA1d97c045f4b4d96018b6afaff870823b98ba426c8
SHA256134998b8ed6162fbfa600bb60d1abc94f06fb15d020b4454b5efb6fe2b70fb77
SHA512202879b59a6b56939e2a7fa19745272091a15ca81daae083e8b47e6c9fba046cac4a24a74d9bd95ee285925a494c1da8b8e06a11370427fc5acf6c16200128e3
-
Filesize
717KB
MD564e8c70f3abc34953a9bc0d561deecaf
SHA13a52225c4dbeb2470912e352a7fc3b162989b0e0
SHA2567d7d32076adb6703c89cf37c94a8c2cbf777d35c59d06a10a88d5877e246864f
SHA512b489d406a4a33b77f1ff142dd985864a9ee2f301d301a7832c364ab395639ab25f265117792634bd98e9f5abc43a4d3d7ab236ba0ce30270d541146762082396
-
Filesize
841KB
MD50404f65a4d4d18d2c73aca06f9fe6a83
SHA15d71cacce11b088d4b0613c2653540a7c8c6b559
SHA256a6ff279523ca7c12e5e68a4cda29d0ca7f6439018fe28b4571ac331d6bd865e8
SHA51270376a99da4f442f18a0cfd2a01f497c773fd8d92e4165f7e5f5ec5962f3ab82f1a1471b307e02e8c83f593fee1cd3ade35934f2e3273ddefbfa3ccbb3266b1e
-
Filesize
1020KB
MD5f6597fbbfc0ee99e56c250264a91d685
SHA1e119a460fb889f9f69a234b80c4f4583fb3ff453
SHA2566a1a9cafcadd201f5e06eb90b9dde9c035f6c2ee1865ab68a1b1e61bf4d61ecb
SHA512302562a4f0ba4ac9ec3bf556b18879438c2b1f90c46a960fc0ec448aaf0dbe68280913ce93d42e7360fd0b36db6c9ee9ae7db6a66d7217f61e32fbbe1b689385
-
Filesize
581KB
MD5184f1ba66c4e5ebca58f76a81b1aceff
SHA14810eec0d3971b2d0c72f98b3ddb1add9f4ace41
SHA256e958988f01a476fbf465f791c994837e492f8488d5fe34886fda7ac730ed1a9e
SHA5127c75c9a43e67fbe115511f02652cca4518de5f247e4a984f69ae90826f19dc3949aa64682b4a4afbe1a746d7b78452bf1ace70f401511e8b01b5880cde52c92d
-
Filesize
581KB
MD52bf138d1ad86ff9a006d4ae5d581789c
SHA1a70311f481c25b09d8b03c2bb8b65b616c934ab3
SHA256bc48129bc75df2e1836a295b3e2c1149b13d9e5f515326c640bab93ebe7cd4ff
SHA51225ae4bc9aba8c75e74f1ea2acee7553ebc978fd0d05ca70e2bbcfa88a29d6499960694193edc931613311fd867c027947f803010843cc47bd6f731bd3004c150
-
Filesize
581KB
MD51d76c2e177616b2909350057c2e9091c
SHA1d91808fbf0fada045feb188446e32ff8d4de7a3b
SHA25616080fd6474393ec3b1675d643075d8b0a65f606e6a72aa899b7579e6faa4728
SHA512972e0ddb3400a227e2893b24f94d2b2e582cf18e1bcdafd7c37f5852c6a3b34ed86ab439f6d1745cbc0c6f3b9fb92d9d90b57b825ab760dd8f0b52a4f258faf8
-
Filesize
581KB
MD57b937bfe2b4099e0725b69d5bf80ce9e
SHA1fcfbde956d4ef9f7c042b412e102af09d9eeeea0
SHA256c33096bd296f180aa94900daae9b2bb8720097e3933b90c6abb1c6a96c98212e
SHA512a89828f829927163792ed5952cdc357e5a39161ffbaa75ca3ccac6db305d5b190fd1a538a715e5ccd55eabf769cc4f34f5cb2dc1f516fc7052a003990bd4ccc6
-
Filesize
581KB
MD50937bcf3e7ca47fe0485a6c225c94e23
SHA160825b0545d1b43869a565f0ccfb422761024678
SHA256b3846b72af1b886890446d40f050eabba489534c11e92a196471f3e74fe4e495
SHA5125b7ad1ba4a9a25bc2104071d0229c4bbc5cf4c30ab79aaeec56fd80494ad89d1bf8ee4ddafa80e6c760b01441ab15a25ec6451566e1b9fc9ff92b7b9eb709326
-
Filesize
581KB
MD59b70342972dfb913bd969368bc25892e
SHA14ba87485c194adc97095c9674a7aeb76ad471eea
SHA2563a35a15a4aaa9184ca4effff84d81a7e3c26fd126e32fba3a270b171e5cfe9ef
SHA512ad790947c8fb2f00f0970757208368a4004999945543e467078bb2fd0717751db2f9dd23c7fb0602d220659c09d1bc839660bc7ff1d08a8ea0a4e6c0d39fe3ad
-
Filesize
581KB
MD5318c0e078a723910e27aa3e55ea1a06c
SHA17823ecdad86ef40d24268ef83497c1b38a94cd09
SHA2566b5e8ff19bc2781e7a7ae73eaf312fd46dff4376bc1ab209be20c4a06b51b8b4
SHA512b81e15f68f164433de39b94c9e59bc7230dbb1b76c700413dcdfac9f5ce31d771b60af7272a91217feaa011c005c499f6bcda9cf37cf0f247c1ad5a926951b9e
-
Filesize
581KB
MD5e54c37f2a15c5bf2423edac16a4ad3aa
SHA14854f4d3f95f6a35e35cf4b0c4992e98cabcb7d6
SHA256342a7c32c563e8389bb40f3a3c6435f46c57a6d3036975f80b89a92596edfd76
SHA5122d5a39e1b7e051b405e7d362728d3d7d359af6e71fffc2bcf2e3dc9d05b101d8d7013593934708bc560d42c1b962c5db14ded9a2e1f8328b8347b2018688626c
-
Filesize
581KB
MD545183a6e8b142f1194d2e565f3a353ac
SHA1e56bbcc67073fe2dee00edb781323cb8fcb83062
SHA25651995315f2fcc8fa496ad9bea3d184074703f76e0f468f22bee058d367b05913
SHA51207f92b840e796d70b3e79905365cc08891ce0d801931efe85141e8c444c2a5ba11be09ed6a8036b3efebcad74bfd3853d246e90a1008103556f3f87529c34fdd
-
Filesize
581KB
MD544c6db05834986577e26966d6acef318
SHA1b0f5e6bb3693c4be8de2dfd16cbe2bd20a854351
SHA2567dbf6aa4b6f418634695b0ef0a73801345ccba190c45483a0e2248ec72e9a544
SHA5129dbcd6865c2533ecf13dbdfedeed108e011ba187ede175b0b8e472f7871fdf5fe4f8f8e3748d60f78790bb84c0802f3afcfa854fe2a24135b9fc48b2b86da824
-
Filesize
581KB
MD583faa2553c43ff8846cfd2d92b137a63
SHA1a6876b8517f0c52edcb42295ac6512312840890b
SHA25699cbe4f722c3915dbbf4e7c3bf41e027d1d960f2a10386eccd4997c00d224c76
SHA512d6ed71021d7e4aef6f50ecb2e6d00e2083cc79d3570c05f24279d847e568b04e1798e2f005e7612f70e7effc2feb93b29019076a54f0ad38b37c46cff48578e5
-
Filesize
581KB
MD59b140a2b772a8a6778579ac604ee7eee
SHA1aa5c42908f60fe79297d4f0c6de5676e4d1c5564
SHA256011fab732c608fcdc205a277112e66d5b1218e9c902aa3f8ec44a73af9f31829
SHA5122ac6e0b2b037405e5693e14f87e1e0e3062d476a3c5b4357e564f14f28ce189585c654246a0a9a68f4eb10b6e85fc77d4e78601c4bf4b5353da414eb720097ce
-
Filesize
581KB
MD5dbee27aade99167e9816c20f58576d80
SHA107bb57276558dac7ec6769ade389d5e9a78d6166
SHA256063d696257eb3ffa0ce134f9b0366103c96008ddadc36d681fea59302d7c4a63
SHA512e442a0f54e5b64229245746954e3ac1ad9beb51311a755352c32c4489b2e0837afffefbefebddd62c103f297a235a82970085eccbab4aafa5f588b684abf20c7
-
Filesize
581KB
MD570ffed561b0f1ce216a5a534231eda02
SHA1aca670a3de591e2da588ce518bbf13f37883ffac
SHA2566eb415c2a6a5b1a89d030415221818d204bed24806e4612421685934bf9fcfa4
SHA51292b38717b4516fba927703b10b76f40f502654e5ae37b53206b4ac15f3a19e021f19162264b1ac3cea15d68ccca7267e1da8758cf95bb062003efb23b11aad2a
-
Filesize
581KB
MD5f29882cc881ff2432418a5f80a3b1ade
SHA17b85ed6da953593b46ca356852e32bce9314d754
SHA256529c1dfb7a7ed64a6931875b0d4d67eddce7ebfb9f850a84f5cc34df5565cde0
SHA512125307db5b71e85323cb097ec7b899fa2c5d094639ec44e4c9d84d857331c0a0604fa308e641581bba3f5acc0ecd2b0f077c1be14ebb09354938b3a697744cd7
-
Filesize
581KB
MD542cf4b6e0f624c1e3ff135587b8fde33
SHA16637327ed315ec8fcb4ac830eeee822ed413b24f
SHA256209dafb55e2bd778b903cd34874a80da8d77b6e5bbadd94a7885f2bc2b752b97
SHA5125411d58cc224844103b2ee2406007016a6815084469513b435b2c288aa50265b7bccdcc1d13fc18f3448fa45f25b7a4d1d77f934831fd95951f2cc266b040785
-
Filesize
581KB
MD5379f085db84e4329e6218238512c7c22
SHA19b063190f6fdf2abc496aa3ed923e6202ad88685
SHA2562a83bdc33eb006d7c47be064f4c2700b42aaf571757a090c40a2a939ea15391b
SHA512de7ce870ca0e434859f8b2749d057b7b8d87c67dbd48aeebd0c07cad5222cdbba8880366adba6d690ae7cacab0fd554ff9783b37f0ac3d609a969e467362402a
-
Filesize
581KB
MD585ac985ff737eaa47474a539e79cf25d
SHA10e79249527d6523c46623dd5eb308ac4b5100f96
SHA256e06f7fb4645c3f6256e4750dc558726122a83d0cc3e9c4da60766d86bf931aa7
SHA512b053b24ace82adc25fa05585089f2f9431b3a3db5cab50d0185bef4f3bcf0df2d3e61eac57a1312f66fc840735d4d8fd010aa5adfd41355fce60aea6f26e8398
-
Filesize
581KB
MD51b151bdd12374cdda81c6666233d4e05
SHA1183816d06b21317a4fba3ea8b68c0ba57db4c511
SHA256e3065519d4ce4d044eb169223ab5ba2cd228cf1c72354da28f1efeb933cba453
SHA5127242be54bd0dcbccd1d12f4b8624fb4d8879876999a7ea09d420496a2b05c1a5884c95c08216b8d6d826086b5bd7ad19408812eccde96711b79a87c2e033dc14
-
Filesize
581KB
MD5b62cabb4a7dc6f483ac19046f3b4842c
SHA1dbb6afe519c3990c7155c09e23dfe08c046c4848
SHA25622c3061b66ca4f3413711d264fea8a2278e5ab9cd4aa317b92bb4630399f3398
SHA512005b874f75a503c5dea2ce656116c62428ed7ede45228864736d1866d3249408345dfedfb3b34d9d5f652078190aebb4eebe669be9f4ab50934e832384b01bb7
-
Filesize
581KB
MD59dd4128016f1f86203db8ea41e66dabd
SHA1e7f0fed46f576d0b1e51d83e2917e4a9ba9115f0
SHA2563c83480b63e25fe08d638c2fd43c3c34d5f7f1911e3d1fa7518b373c8acc76ca
SHA5122fc53c4c45a2382322badfc3370c4f0ac5f99851840e11ed0d8b22da387f45e44d050ed952d6de77cd9412e8e42bbed83f1f22e2e998a2950a3747df7ff58be2
-
Filesize
701KB
MD5248599f4d790b164a3a7a4bceac2c1d1
SHA1cd190a4ebe22b5f1803731d9a3646411715605d9
SHA25639b3352d26029f29fb0de268889ae7288e65c6753e3cda8dcc07fbd8be2a5f63
SHA512b688cf3b4f9230c0a6d8886820fb8a8f1e16d6573b44bb32cfcd6ed866bf737fd4fb11f6d07a6cbeefc24f1204f379e80088fe581f14088bba7474587c03bd72
-
Filesize
659KB
MD573767a3e60ebc93ab197542b73191c8d
SHA193d7c0cf5a58e8250f50382975150a143bb8a438
SHA25672702f9005111e1e3d86e599bcd8149a3b4dd39e4b88668212bd06a4dc077da9
SHA5122401549d190f5b675de87450b2fa782498b00178a1d437e55ed271f50f26bd01b3b83b1a163833dc55970231b10839f897a375e24af8e0d7ea05da303a7f5faf
-
Filesize
1.2MB
MD553a01c31f2e7801f01d3fb51287c8bbb
SHA1066a00f3495944fd71a343c4facfb505ab6fe1a8
SHA2566c663840b7e6608149b0bc0a75a55db366168b476ae90856dc6a5e99d3aede82
SHA51275dcd10e323ed917ca992bb677f5c52812e27588e904007f9bc14bcb6bb1db6a51a8d3fe6633888521e1c22380df6eb901402e18aad89b3cec1d286f554d3f08
-
Filesize
661KB
MD529a249a5173213e27da11b43ac06f749
SHA14edccc47e5482d9ed6f5a8ff2dcaca407e68015e
SHA256bcfdcd3f06875dddb9b43e0a731e2f48e5072bfe0786fead3e9fcd632f1d17bf
SHA512fc69423de5fea6196a0614b82d2891cf7238bfd61c3bc03f589f219398c18f45312cef1d5014d72982222d70d63656b2478870e513dac15651ad26a970363783
-
Filesize
1.3MB
MD55695eeefa537cb95c428aeaa2d5b4efc
SHA1ac866e36208a51d7de734e54ce500fb25e2a488c
SHA25675b7f4f5519593556883116f304937749548347bfe3dd781063741b578f03fa9
SHA51224124bc7857621e9f9b8211305cde84281951e1b70366242ce6dd6f107b64fc7666a38aa5e00da31c8c3a9b8e61e93be9c5aa6efc73f642a70a6c83174529054