Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 22:22
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-09_6014da73b640f8c78e7e31e7af63dd01_cobalt-strike_ryuk.exe
Resource
win7-20240903-en
General
-
Target
2024-11-09_6014da73b640f8c78e7e31e7af63dd01_cobalt-strike_ryuk.exe
-
Size
1.8MB
-
MD5
6014da73b640f8c78e7e31e7af63dd01
-
SHA1
74bcaa045dd8031fb648f41751b1c55301db7f86
-
SHA256
789724d85a314d962e8e9526d98bb6ea752f41287b0c3b92d9c51025f5c806f8
-
SHA512
f9f9385183c08d2501dc106357cd7da18b702dd5cc98b39911c566dc61eb6b178c8b16b77e05624348a4c40912cb2ea7d740d87622d855537d2ff5cfc1ec395d
-
SSDEEP
49152:hKfuPS3ELNjV7IZxEfOfOgwf0NgDUYmvFur31yAipQCtXxc0H:im9sZxwgMU7dG1yfpVBlH
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 3844 alg.exe 948 DiagnosticsHub.StandardCollector.Service.exe 4048 elevation_service.exe 1668 elevation_service.exe 212 maintenanceservice.exe 2124 OSE.EXE -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2024-11-09_6014da73b640f8c78e7e31e7af63dd01_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-11-09_6014da73b640f8c78e7e31e7af63dd01_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-11-09_6014da73b640f8c78e7e31e7af63dd01_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-11-09_6014da73b640f8c78e7e31e7af63dd01_cobalt-strike_ryuk.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\d96cff8cad6a2b9.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 948 DiagnosticsHub.StandardCollector.Service.exe 948 DiagnosticsHub.StandardCollector.Service.exe 948 DiagnosticsHub.StandardCollector.Service.exe 948 DiagnosticsHub.StandardCollector.Service.exe 948 DiagnosticsHub.StandardCollector.Service.exe 948 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4992 2024-11-09_6014da73b640f8c78e7e31e7af63dd01_cobalt-strike_ryuk.exe Token: SeDebugPrivilege 3844 alg.exe Token: SeDebugPrivilege 3844 alg.exe Token: SeDebugPrivilege 3844 alg.exe Token: SeDebugPrivilege 948 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-09_6014da73b640f8c78e7e31e7af63dd01_cobalt-strike_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-09_6014da73b640f8c78e7e31e7af63dd01_cobalt-strike_ryuk.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3844
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:948
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4048
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1668
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:212
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD58d41de1af99d1d59437e0a551f51aa84
SHA1cc4a3f8c7ece6d2b30526b7529f2eeaaa4fb38ab
SHA256bbca49ed3575fe5315c60c9a2a291568d0fcd6ac079f24a3564783847d80279f
SHA5124aec5859edd9070aee6beaad3cdedb3af9c0b1bd130260e2e9b6ee8e061c8688b2aba7215209ad16c230b4f825e62d9f1297f91af065f62316de54a2fa6404cf
-
Filesize
1.6MB
MD57cd8a2c6f119398be66815381896531a
SHA1d49e0c143477563afef90389d2123265525d1c72
SHA25609953cc7579e9ce78c9a14c41288e7d84d1f3b697353ed4db0cea908c5381b0b
SHA5124cc20a3c52df1187911588ae3e4dbeb972efbae4b546debcb0abfcdf6be9247f1d0ad06e43fea93a024628ede2b71d2c9dbfb11d68c5aa47b4301ea9fe50d01d
-
Filesize
2.0MB
MD54685bd686d936200c7e550717ac1d707
SHA1c1358e16f35aff3c03275e6783ca9c9fa7ea45f6
SHA2560aefab4f8f75c4d55cf93b0c6d5d31661fcb4c3b4af05440614c1b2e82223963
SHA5128b1a3a36b78c544acdf8841b0eda325d1c2227c9e4ee451248ac7aadde2824f67a70d07bc8e2bd37797a4af4097832bff31fc70724ea1244e16888c683cbec7e
-
Filesize
1.5MB
MD5fa074bbd8c200143f210984f152ab19b
SHA1efcc9d67824b44e692a541f607313a752da38b3a
SHA256fb4e4532868df3272b58cb456f8de3be33f17b4f7790c05c5bcf4ebccc859e6c
SHA5129951700c68916add83b7ba3710f2e36f474ad123a35cae7af7f785b32d9f8e6f5446184369dd669abfad909730e3ad02becf6ef7ffa3fbeea8c28f2696011b94
-
Filesize
1.2MB
MD519474ed2e36521297374180f942abd1a
SHA18d9c41690ef7f27bc5c2828e8ab0f5da128e62e2
SHA25692a4624374c7131fcba2423087ee2a7a525a6fb7f39ef5af694a6b46350fdc90
SHA512708e045cb4e02133afc06a30d55c3a4e31496fc4bea2657dc829d1a9be705e18c8414174b47c52b077c90856f07c49030c4739ed82d077bbfc47865b2f16b64f
-
Filesize
1.4MB
MD57527410aecff7926be644f24d2d01ac5
SHA1f0254ac501771f0bf875039066dd6d5e83aab5fc
SHA256c9d43fcf74f6e856eb0d9ec1b29a89ac431feda41018a3cea6110a8aa8368852
SHA512d059d18cb35fdaa08269407574031f238d3456e3c4287d4170c8c513235b42724896a42188ab9c28227169f80b395d4b5e0a740dcd970990ac6d5cdd4c23d0b3
-
Filesize
1.7MB
MD5d78a9a2083dfd1625ad5a2a94674dae0
SHA12280157c9f33817553382df50aad8e3bde4ffa69
SHA256da48416aac4dd3bf356f9bf1d680682ed6aeac0615897242f2dfb941043ed24d
SHA5128216121ae31acd0e9d9da1111a688c9e9756933df13b89b462f397469de6fafe016813a3e906c758efcfbd98edab74f746362cb4c8627c21bb5968e0c30aada7
-
Filesize
4.6MB
MD556e4a78ae257f18ecc9841b7779cfa1d
SHA11592dc5cc1aec2627ccf2c0ece920e859c7c9700
SHA256878ad1704c4739c0b32dde19f610ee7a2dafe171963ec298e1eb786925f9674e
SHA51264a903b0f86171e0c95f1381db008cffd816a5ec70528d2d61244ca64288381289af9b3fcda83be5f6dac5e9dd53e126ba1eceb9f087be925d0764f1110dac6f
-
Filesize
1.8MB
MD507bce98f4bbd3620d0f40e7744a67a75
SHA115bb81af1496f460f9c7c9f664c1fb36f6c3371e
SHA256fc825d44d76af93a082dc0c4ec1ce138976ce3470cfcb6208509d782e98fffcf
SHA51231628da51e5f65468af7da5f370f2bca6221bb6ba56f4c6406836182d6c1bd794ba242889206c6c02cf723739a74a7d81de2cad30b6064f6f9f72057f982ca1a
-
Filesize
24.0MB
MD585580f3c075fcf4e98dc2ecd444f1d29
SHA1707dde1d027c1c24f9c3d04960300578f3cb9bb8
SHA25696c890eb2f7a7767b795fda231dea0e4f611acce659898ee5e78c2bbca065e81
SHA5127f75d2c6da2ff4cdb0013527fb7d10a2f851737eb9433b31764b990e35e721fbed4def30861f18bcea9a4a9c5da3442e17119632c109a8fafe7fed6636d83079
-
Filesize
2.7MB
MD56161f7be11fba87ec8b33c372c11732e
SHA14c618d1288c5c39e5d6c92391a61156656addc2a
SHA256ed560005e7f3532c3b2e65a0f794c01edb83dd9847dd164b1a1f5b766cbf99d9
SHA5129d709cf7f44707392f08c3079f500cbac78ab79d960805adb3cb93f4cc41ce306f202dcea1c8b9c68ecfd655aa9ddbeda47c0922cb869b33cf258efa0fdca76e
-
Filesize
1.1MB
MD577bc22e633f1440f69900b3b8cd4f7ad
SHA126214f504dfa99471dd20c7b99b83f7beefd9ab7
SHA25625af0885b54eb1dfcc6fabf2c6949cd75829ef2d18756617c08c071b6e8fffe8
SHA512cdd44e2c493166ce16fe473491598402db3a73caad91b21bcbbac06c2f8f7fc5e7c57b9ffe9cd557c11cd4f28de222fb4f2fb9e642f9d86281af93ac4bdf9340
-
Filesize
1.7MB
MD5340393c4494f10f1501941ab58efccb5
SHA1e741ebfd17bd9ff5c7d6cfd9d939a8d6b5933fba
SHA256b0c9c66f09cd95aef4bdf7d7afed0e93b4996a6a84ee5ed3aea601960f7e6512
SHA512122bb301babd7c02ef1a37bd302d46fc03fe809d30ece4cf13877bb24d4cd14b4569d902e247885b8d47c769c6fd74067628c8410a1425a85de436433c3dee61
-
Filesize
1.5MB
MD52bb8b8a8ae179b94f3768c559a1e2f18
SHA12e34538b7440af2f94d9a939810f10e9625d28ec
SHA2564f6663e70ddd22fad8d16b43e97edbd3a7485faa066965d261562939a8ec0a66
SHA51232a6d8d15d265bb3429596df1d245ff640fc06b13ee8c3d210f5a23e4a54f916784fb326fc9a8c385e64535df13f59183a09ffe753d7f3bc961843599cfeaf2f
-
Filesize
4.6MB
MD576de17cc330fcd613136cab7caa19015
SHA1dfae5fa25bf2fe0a6df7afe5aa49d98c0f7be673
SHA256253f20d69ef56f6b20b0e6471dde6df9076b43dea60ef7fcc767b6c6991e38cd
SHA512facbb6b6d85540718cd3450b523c590baae706870046777a7bcc8e11107d39e957f2a941e8e88f0825b5aee55e977e1e91f555029b0b9e4165417d1366b8b1b0
-
Filesize
4.6MB
MD54c5603de3038753d08817afba25d36ff
SHA13340184244e020e9a0ba0621d1481b812779dc19
SHA25603cad42548a4ed1116c6ef2dabb0bd180e7adef8e9fcdba1f5db01ad52a80d35
SHA5125e8473d2e1fda7df8a1453c6a26448e9e9084dbaef9002f65e1554dd0ca49dc7ba39a6292787f2f8fcae2f79765d443b7d194fd4ec690cb417a96516e5b40ba9
-
Filesize
1.9MB
MD5d12773cb4fdb8b511e76c9f809587fe6
SHA17d874de7ec087cfc9c6668b6ad6bf31d54f360e6
SHA256153058ae59b15422e000076d09d88d45596a58aa95e05aade5d5a8f3768396d9
SHA512e243dd74aa7b6561d30d63938dc09a7f6e5b7c3c0d9216beadf9a151710abf80b85575cd59de97492ac5f4a759828748003af49bbf3208b1a89b002276ad7fbc
-
Filesize
2.1MB
MD501b2e1228c9f27004cd6a05528375409
SHA1d76e260c24c362bb8a92bf84a2d8e5678f542d54
SHA25641b0c654d040dc97d38a74b8ea816b83c001bd78e260b7ed0e8614fea761627c
SHA51243e64fc13bc63fce3f2e6ee027531e6a87dd8ac8f200dca930866b7ac2a28e112ad0deca0936d7179286787783ead18e640f59d6509138b5ea787e984f4f653c
-
Filesize
1.8MB
MD55d5c13c4050bce49cca1e478ff28209a
SHA1573d03a46312d57e3b0b1f2abff450ab176a5dff
SHA2560b9d927aa3b582f6b393a9ef34c03ee0f2d2937130a747ef5bfd8b8d76914924
SHA51244134f8ce714d280f17593ee93a23ea05bb8fa44f653f6f125a0ac5724915eb0e0b09017ba54a83aad2ad48842062ba079b6fcd28d6d733c609796b8550ce40e
-
Filesize
1.6MB
MD5aa9455872aceb316fb0793f7f5ac05e8
SHA1fa753a649a033b5c6647394e4d923cc1734293cf
SHA256f3f55482bd0b4bac2cde7f7ac0fd0808bccbf1d7b391e1bb721e5427ce780b88
SHA5129837127592b21e82cbe7ef5948b7084de3bddd6b2ca4695c5af6f0bf21b23bf3c71084fc0c08e889ef2e9736126fa0cb90b71440b98b8515c02fb1c984a63933
-
Filesize
1.4MB
MD51d9ebf82c8a1a5bdceb66bdfe0e67910
SHA14c30056f044742898c570466b404b3beed4cca0c
SHA25601061ceea6c9247dc0ab98965b3786b9a3ed9d26c546677e1a958feb2761be10
SHA5127d96e4b0970c4bb1482ecca64cb39b9044e8b1d76093be1d9e928a3230a7dfba601ebccf8df6db9fa4ef1b45e1cb0178ce248e108b5b1bd5106b36a7445f72d4
-
Filesize
1.4MB
MD5c00bc59abe03c83410533e74a5c9a7de
SHA16fe17810f4358b91ffb24b0617de2ae91624fce4
SHA256fd396a5604aee4ab3f08b71a40e378a0eaf2762c9148482750a0a6bcc8b89f95
SHA5122d8906260f26573bd75d219dffd2012be8240ac37d982f85ed61e477c378dabe32b65e14373454c9abf3202e7bc266dfcd32ebd200a0ae22c849a96c45d5154a
-
Filesize
1.4MB
MD501d696f176b4c36ebd1f372ceeff8885
SHA19dfaf538e9f348e24d9cd57944fac956443a3455
SHA2567ce3b6ae0e7c2b7f272401d304d6195cb4cb14b3f6c1fdd97ab3d8847502229f
SHA5121a05091f5b18da7804e7345e8769c068229ed468c68ff2f30a63dd91a6af454dbaf5942387a8570fa3a45b84413adb102f3f7a6af00cd34acdac2d54ba6a03d6
-
Filesize
1.5MB
MD5123921925a7c38128fc6a2c28aa40ccc
SHA14d538618a9edadd225b98be1528596da55019556
SHA2567b73873a3e2c5e75ac0cfd8deaa9fa6b8f5411287a58ecbb2c765b8116edd993
SHA51262194a8bb501246e1b03e0600eab3a3de66a6bcf9e8c14956d5459b19d79348f889a040af94fe2a25df627507c02b42bd654c86741fed41f44e5ab6af0bd7be0
-
Filesize
1.4MB
MD54437d634b1a70158f12aeff17cc9bd2f
SHA14bb832de76d893a0f3a29fc9563820c4da859ca8
SHA2566cb50b9294f0392d7fa7da9d41896e8c68868f00a3f9876c94e6ac9132338318
SHA5128f62cdd992fae3d409a49007d33e67d87ba9ad078be7fee8ba809638d56e2c095652c4db986de1e784786258b0dc448f4dede3a0926c5bb8d78cd9c8fe25b233
-
Filesize
1.4MB
MD538dd765307d1147120e6cbdd0154083b
SHA1924312e50a562225314b7213014fe1ecd5c4247f
SHA2568190f9ff78423769f05faef64fca0f274d8e992327714f4e0ea87a53a4f9ae34
SHA51294c7e6d9f733a2c7a71b13bf9612dda01e46e78a99b17698a2d3804d4ac6ff103eac61e697ad1a720d87aa037442d3898af208b6310fb03f838206dbe517bd0a
-
Filesize
1.4MB
MD50808db58a34cdc89d881e9980b332acb
SHA17fc547bc6d029b9d2566b5a38b71912e7c577e3d
SHA256eb658b8c0e4f3bc83511b0dfe4796c0a0114d2a0deef79877555daca24c24bcf
SHA512587cf78b330bc28d6c3984409731550e222aa4bec79d30502813112cc07eca654e051c519db4a165fd5201ead10a65c8f5dcdf41ac525833c8d996dac0f39d1c
-
Filesize
1.7MB
MD520e0ef58f4c1d09efd63c1bad8e78889
SHA10921dcc290041b940289ede4601808e63b650132
SHA256880f868bd6d7eaf678d346a8dc3a573087f3cd3a13f5e43c19220d5a7c287fd9
SHA5122d86923b1fea2a875ae3e5977101227a7a3656580fd48d86a3cd224c11e097f8f48478fac09b6c7a83e5eee402fe1b37b56a56a23bd61d420b4264ba0f9b51e7
-
Filesize
1.4MB
MD50d58f629804744a1ea35826ac9d4384c
SHA1f52e790b5fe7552e6b076441e8c1e647f1551ac6
SHA256f02c8555c41f4829c256128dbb94ca9d37359caed2749e5eb5aae7bc36ee9278
SHA512af8c75f93579c3addbb2e72786d5f9d9463f29964f5086e81f4a320564cb66ede51171e1aa8ac4c562e6aa5eb320362686802ac972cf8370642dff4d7d1c4333
-
Filesize
1.4MB
MD5efeaff2534b5c2948df419e25a54d4cb
SHA1c66ad97eb7f5a1a5b8a1a539f32e99065a17eb99
SHA256a522f72682b232714bd59ac7a32c25c555d2997822632c5f8335e806002b8c5d
SHA512c61cbb94ecf9318604f641e4d21ef4d0eab1e0b172a560323cb9c8a64880fbce6060e7dc6d4db37a3ecebf34f02f5cec69867c212761e1a651b498f276521397
-
Filesize
1.6MB
MD5c79c26d95809bbd2d93d3cfe29bc6d7e
SHA1bb16d35d0704ecc2c48c8f0252005e3ba9da6021
SHA2567a50f789c97eabeaa1088eda08a9058d98036737c1508a8479cf1ab56ebbce0f
SHA512e194aecf77188b663cb680bca7cdcdc60b46f4a6fe0b81d64af092536553e39da28fd8be19806023cf0a7d38a385a652f9532d33d5fca07e470f02feec5cda61
-
Filesize
1.4MB
MD5dfbd3435e5ecb1312274358025cfc707
SHA1daa20779e80656708925c4be4c30b00fa98d3b6e
SHA256dc900cec79c6cc8ff26f6af451671f0f434280c58f19d55e1bac6e8647b68c90
SHA51279fbed553ddc0acc4619ef83c9c3341a78c0f29df3a353df23cd47e178878f9fe1e579c55ac7f81b846c92b8b759b675224c5cb050eb447da6b22b6599a93b2f
-
Filesize
1.4MB
MD5fb91475f773e476aaaa0a8dbd5eb3aaa
SHA1a64dcf8507f76e9de7dbca1c66df6b7b8a24f20a
SHA256ea86c7e19daf24f9d6dbd03d40d8bc8047f6b49b0870b33b814592a854eb2890
SHA512ddb8c262cbbb80a21e10982d4fcdaaf0b7194eb114bb755bfb638a863f3df1b051fa2da3aecd20d6892bea55b2ada392c4a4cb62faebd297cc9333bc17cd07d9
-
Filesize
1.6MB
MD5bf35a602c05d9dc53afa6c07c6af172c
SHA1b3fd50debecbef3d37888d563d544731c8fe476f
SHA256645c855f436a67503a09f3fa2bf6f03685d6d78a4b56de22731a40f71de18c4d
SHA51226e63bb08265d74caa4c21cb667a062615a6bb7f1d06631b78eda914deeb7f5ce21f312f5b5b8721797a32b59a2f2ee2e4e788f0cb04119347660ad0f948eb69
-
Filesize
1.7MB
MD592946b15203cabcfda26d8e438cd8026
SHA1313f64346d082f30cf065fc95735af8e93753dc1
SHA2560eb35c63a1e79f528169757cd6d0e97f7a6346695ed2650afe4c98dc3c22c514
SHA51260a9a07145ed4de94e9a73bb8cc281d3d0b3d1ac1ba63d4b39abee8a1d6c0f413b4afdbebe6e07e0a456e24bb901d535b3a02c51cbe96f451f4cf2f1bc0be9f8
-
Filesize
1.9MB
MD53252bbc8769a1a52d9ad78a9690a3451
SHA1d9bd5f2f8790d28685ff19da975d1912ad127735
SHA2567f20bebf1d866e7c6e6b93ba57fb3d854d427ea6d926bf82af19d68785119767
SHA512946dfa98dede6b14889c746a2cbe6874e74c44e5f2907047d6626c9db1daecafdb50dcc7dfb7b8082ff3f4c474adbf5034ae38dab5f5d4829d18eee47ade8e3c
-
Filesize
1.4MB
MD5d451565cebec4a3380d433a1e88159cd
SHA1dbffa7baf67433105354ed4f898baf0a6f8eda1a
SHA256d9500ed6d4274c0e96ef2efa723c4478fcb951f814bd8a9503e971dd76070c0c
SHA512606bdcfa293695c902e3d7863489535f9125ae9f6c66ba4985fc7705dd07f402aa1439c1e4b67d5513e0115b05f20306faa25b009d35458c5abc8824d60c6bd7
-
Filesize
1.4MB
MD553deb4f68ac708ef54ebd8c6ecfa6a1f
SHA11239efffa230567e68058d4f5ee6537a0f97b7f1
SHA2568783b882fb4a63b18f103695a008be085db568d01f82f7044875669bd5340e25
SHA51291373b4adefc7fe0885830f14b032dc4d504cb1e3ae0f234c7e77cccf2606548927adfc9c3e0f83b25d50baa9d799428186b5cb35abefb84541d4b871d4efda8
-
Filesize
1.4MB
MD547eeb2a60956bc7df22a55e9c11aae73
SHA1c9bd3c4c263920f9629b26bcc00389f54bce71ad
SHA256f2f0a36b7c4008efd551e836b9d88084d81e2b1725a9cc28f3f807ea68bfa862
SHA512b45fce8909dc386a09a2caf02d1ef0a865067f1656b92744711db2c431864a8cb54a0aaf699b24464bbc0f351c6d34873a9ed14426789398a32f0ddfb922c812
-
Filesize
1.4MB
MD59309efa840d159d9fbcfa37fe9379080
SHA179622125097d7aa7f13dcc17eb037d528836d3dc
SHA2565d2138012d0dcd10ae5d74a282eba82a881564945ba5dc231df3a29acea7a71a
SHA51221924b16d0eb4f791877fd169cdf7e30f0e2bb6d7bd2493f2108bf2d1b49535f51e147954462d6477213b14b1cafef0d809c2a815c8e9afabe0ea523e61d3726
-
Filesize
1.4MB
MD5f0bb63f142bccf076fed74f66424889c
SHA171c66c78c1329c8d548f4876e73ed66e07d3b216
SHA25612acd9d9d4122e26fde3fc0f8843034741876ce7746952de5ba5d60c62e9eb11
SHA51232f2aef73f00f701817bbec7fd0d88e0130510250e8128684dc71e496689fed676f414165c7049f1e1e26cd0fff0b6ca8d5fbffbb163ddccc4c3379f680c7b1e
-
Filesize
1.4MB
MD56445bbbfdac35148dd4c5a056cb660c9
SHA13d38a1c255ddb0989819ccdff3f994f179aeaf97
SHA256231abbeb1c9c75a7add9123342afd7453fef106c59f869d885a24fd94e1cab83
SHA512a1ad2011c97ea75194e1af2da35e2c56e5f4ce38d496223f1167a252b34a378c055429e222c4f461d93b5af5d1fe57e96111f7b45dad4d0f317472a93f9e39d6
-
Filesize
1.4MB
MD592623bc4f9d8df9da688f2bf314a6dc1
SHA104ca3f97c66f2a019989448c8caae0f184cef6d1
SHA256bf487143767f07b1f23491e27f7d4f21380b3d0b6f1a713f4a45bef7e03f5224
SHA5122dfd7ea8fee53d114e45d15d31af8707349a2088459ee79ea4a305b05a428c6115a8aaab44ff388ee41207dbeb88754ae2be17d4e83f9de16389ac563b5a7c20
-
Filesize
1.4MB
MD54b6a8a1191d92455408d548a589661b6
SHA17d3c3ab48e6045f828fef4004e19b301fc7e54c2
SHA2564fa31cc9de1671696c3c2f926a0c9ff1fc18c2f97130ceae4a4497e6760795f9
SHA512e116766eebaae11e96d656c4359ef5d8b82be7393d92698934cc2fa2d18eaa4df892d699bc102ef9b390250e2d48df36f0117511c2d7f03eb671e97a43eec92e
-
Filesize
1.4MB
MD59d4d5b0471cecd88814a1afa34788f31
SHA14a4d9c24818162e3ed5499685330828db93a69b8
SHA2563cbba2acbcf434939629d20ff9493a9c0308517b4bef93885797493f37a71674
SHA5125219a7b848146b7f60769e06bd2b9f3e9d3d31ee6719a7441cfa648ae7a51fab30b5820676e22cf53c9e583e2f5fc5ce7386c5219655e2077f852cd6c966f45b
-
Filesize
1.4MB
MD5d941129195981c95a382cd9506cbc9ea
SHA155537d3129c6ec14e129c5e55bdf9be1b6423527
SHA256a42f1f72630500fa91047371f9abd0a9ce4ab9b6e9d2bd2b26cb5068f17c1176
SHA512b40f59b5f5f59a3b9ce6fee22f5fd54d63aa9d3e5c23056916b850c2a9b0184d37fa2503543b1bfe972870d05377b924f37ff95c9d6c961a6060b5307712680c
-
Filesize
1.4MB
MD511a76a1c6217cc74a18677ecbfc96626
SHA1b1114b6cfa000100fd76fd66f3f0348ed3ddd51f
SHA256ecb36936dd96ff9d8503c56d8594b500d0cdb7dd9bb67d07c2fa4290aef605bb
SHA512e03e1ffdd4a94b74fee99f5460520a093ec4728053bc660005fa1ffe18b49c341c7d3d5c6f2f29fb6d8f31800114c63955a3450062f44165820ce5633632eb08
-
Filesize
1.4MB
MD5a25f81f2ad717123b36bb6b326192551
SHA1fea85a38067bf5ffabfcd07adc026d750abc9610
SHA256f996b090e74487b44f87ffbdf525a46be3d5851b1cbb26f4ae8496878bbf6445
SHA51216907458ed0fc5f2c397fab09c644d2c2c56a02b007b273230379ff95c06fccfc8810e30548185de81000d23a740db4f970d7ad5d4688e4682bf498cf0b1b584
-
Filesize
1.4MB
MD55a99cf73622cf6710ee4e05fad87adbb
SHA1d5384596aea134d86f3689d2eea825f1934b9797
SHA256dad4dd88621de7082bc4c65bb14879e16f1a5b6f716b04ec7ee99efdf5700c22
SHA5120b3679b9888c26336ef1f8b2a6711ae4d32a7e31cb54d5771db4bc238e61e70f23eb11caef21c5f96628ed40f144e64eb95c9e609929039569f33bee0a19ec13
-
Filesize
1.4MB
MD57d8f398372825a8d994aa61e1806ae90
SHA14a65cb660dfc739a79479c6837cf9068003913fd
SHA2563e65a0711dacd3b057157e6a089c3d1602ba500c6083c38ce71fd2455551441c
SHA512d99b67c5020fd56eaebcdfee546ea33a8b4b28902a312dfc2aa1a5af82cb7c35b1ed83c46e9871562fc070faaeac3766903f1405d191dfb60e8dc35c5a07c3f4
-
Filesize
1.4MB
MD545e12ae06c76c73e5f2d7e9f68de0378
SHA1860551124e1b0d984bb26a1bf6e7815ebb652273
SHA256cd77b8ba1a7922771f851d21b8f404cf7ab1db55bec0d3f3e6d60c7196eee0ea
SHA512d4254d2e69915cbfa4fff563d4b668dda9892e248c1a469fc26cb8f77776d027e4709f0fabc338345024132736f793ef0a29c2b8405bbc9b09879eeec088dcae
-
Filesize
1.4MB
MD5ff5d16c2ec06e745532e1437d2dfefdd
SHA17025eeaa6acac25eaee4454e6dd73d2e1c2ab0a9
SHA256542ca32da2eefe402a839bf7f9905afb07f0d715930affe54e334ffd0a68dc15
SHA512bbf6a68bdafd8d3ab0081c9e1d58790567308033ec9e945cb8312e4fa6a0b1a682833144c1aca72347b64c08dd31f6e7f0ca10e4ddc560c37d9dc1e39d1d7820
-
Filesize
1.4MB
MD5b2bb707e778b616b07310cf1de2aed82
SHA17a95d52e7482f810f816f22ae9ce8def3c14d124
SHA2568b60fac129a7dc0255f054c70a17ce81eaf6e516846130e088ceab9ec61fb658
SHA512a78606434111b9173488f1eb1b61d3af6c248c041cd76b678c3f1d69e317cbf7c56ca8315d007a10d9955db330dadcf10cfecd310b588fd3cea0992de13c456d
-
Filesize
1.4MB
MD52280b90c33a6477801b8ee2fb3093883
SHA1f91a11b504fb8778c2fc93f457929b6a87b2b1bb
SHA2561ef4b9315c0d91026235704e45dc68b085c41c00e84ea956d657c9526b97106b
SHA512468c7f7b953fe463ffe413a3464a9dfa9a86f70435dcae79ff96f57d52fabcf662de37840753a2f14571977292b2265b97b3bd0aa52de75b2fab28cf61dd33bf
-
Filesize
1.4MB
MD566dfa87a9e461be663276536088c2fa2
SHA1e892192bbff30d3b88c8642560df21a74021327c
SHA2562f29c38b985ce12c54e27c60ea48dfa4559e11da65539435505749d5e7d764eb
SHA512259c7ce073bfe16785d0f82cc14d261383e43d973df22758737ca208055cf07f082f1efab9ffacf17d2601d4358f1c1d174b22bba06ab724142a768e9e9e4edb
-
Filesize
1.4MB
MD5a51bb8ec7c0925ea2aa54e4c46c22c44
SHA1ff0a0752f3c74a34572d1df8461fe65d1a83db41
SHA256c3d637a717c244c4416b00d25b5cb4ea0ae62a3858a7a15dd560137252328c7b
SHA512740fd12dec24bdf32eb4effa9993901ed9af021f6717b4bec78a75c5a44b6502a5ff439007f763cd272bacf20caf0a0e7ff977ec333b2297033592ba1726f9ee
-
Filesize
1.4MB
MD5bf27a18dad40b79f2417e964b1f00a76
SHA10684ae9ac2605d73b396712c0f7412ee8ef5952a
SHA256e362a09c6db8c6da1b16ff181f6444555f68051029a3b2502ca7b5a485a9e1aa
SHA51217c117dc6e521382d01ccf22950401c451ea4a21c4fc43099f112c0f3fd4dc4f58048c51f8169d1b2ab939692c50e56e6e2436971e40005ea4dfa0579290b16f
-
Filesize
1.4MB
MD577022a255264c6eeb7969cc5320f7184
SHA18cb3cc5a0d712d0ae851f5245c8b9b9098feb45f
SHA25664825b8fbd14f8bd8422a3198697da2038a1162d51ca832232d17b7aba0c3fa4
SHA512ce7bfc49c74375d93a1ea8ab6d0b0b3ed88250ce768b7932de95b01073b29944f951ebdee73d0b8ff4c83bbfffa4374ca9cf9d14e9d739a5d50c2c61f55502e0
-
Filesize
1.4MB
MD512c4912966b77c2b225d5d92d0469e37
SHA161a3ac7093be80ede6fed6ad6a8fdbb12a21e921
SHA256d505910fc8cccd9d8a6722a38ec92167d653b63714de09f2247ad17fa80744cf
SHA51289af877a15ab8ec2f2ac1d249d13b0bb68d05469adc8b66a1877563702e2bc310aee1eb6ad35d54f22d04b5727ec66316493c2a7674b546df1c76d9551517d88
-
Filesize
1.6MB
MD546e4c8864cf3b70c82323d162281a223
SHA170542e509d23f307679d8060d2dc913f7422d77c
SHA256b995206be236ed08b4da332ea9df2f75ad1ed6d8b5b716550e6e97f4dc8ca952
SHA5125e998e8e7b28bbf488316d133671fbda977111bf5b51e5dd9c8f746ad74ff17d72ac4ee988ddf4dd65af836428f1317c3e1cf9f4ea209e0ec8bd10ee8d48d81c
-
Filesize
1.5MB
MD5c2b706a870afec3a9d5efcf828a41072
SHA146ba51d96e92f652f046c362a406e9bfdbcaf804
SHA256d4fac525464ac5554b0fab453993bd68bb9215957a8f1fce2e3f8e25d685f1ef
SHA5122734f9c2882998c2fd8c85fd741ad754acc04be5392556e75c699404c423d6ceeb49869af4408e0c7bcaee6662f116e791540e910f18c34296fd5e96d6088a2a
-
Filesize
1.5MB
MD5ba0cf616e34451fd1d4eeb454b1226d9
SHA193ddedcc502fdef07486e604d6e0ed99ebb94c44
SHA2569df8cd3d538c8f43bba1f04240f0993f7575b13ad46b5114152af67c41b5e378
SHA51280a4c78f284172a032c5052664df972e1d5acc6e56c8c52699c4e9a3d0d5ad1a53d7b70444008a2153fa68e80cd3a64df00aee175822cd914f7d26e4e5b93674
-
Filesize
1.3MB
MD5780b2be6cd15555d4b979b767b43ce9f
SHA1ae873c19d72db807b73718b621abff67ea30b7c6
SHA256fc384800ca5a92df9b4ba8bf97141ee1a54d053eef51ca19b4a443aba02eda92
SHA512e2fdbcfd2de1e8a0962c698fd610f790e973c33363f70d2822de860b36480451198c820f8f9412fbd8543a844748a3160eba6651974becdfd301c24bb48933de