Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19/05/2024, 18:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-19_349425a3d1f05d87eacec5683a64b287_bkransomware_karagany.exe
Resource
win7-20240221-en
General
-
Target
2024-05-19_349425a3d1f05d87eacec5683a64b287_bkransomware_karagany.exe
-
Size
677KB
-
MD5
349425a3d1f05d87eacec5683a64b287
-
SHA1
8aa8f47529fde73b845f835c56bdf1948341253a
-
SHA256
2063041727790127ce4b0e36a7a7bee05d232fa8fa1576f1726b9cb8c17cad75
-
SHA512
206c282ac2dc4570f22a3c9895561b2521a2f07d36e6f08b6cfa66907ab7656e224519bc511cc09afd4eec5cd30e2599a904965e60246413ae1dfcd63552f8ac
-
SSDEEP
12288:xvXk1eExe2DcIpcsjoNPfCkdOeIAOSYtyvSllnM0P9lT:pk1FxLcIfsxf1dOeoSYEvelnM0P
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 5108 alg.exe 4824 DiagnosticsHub.StandardCollector.Service.exe 3512 fxssvc.exe 620 elevation_service.exe 2608 maintenanceservice.exe 3752 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-19_349425a3d1f05d87eacec5683a64b287_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-19_349425a3d1f05d87eacec5683a64b287_bkransomware_karagany.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-19_349425a3d1f05d87eacec5683a64b287_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-19_349425a3d1f05d87eacec5683a64b287_bkransomware_karagany.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\2be2bcc6293b476c.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-19_349425a3d1f05d87eacec5683a64b287_bkransomware_karagany.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-05-19_349425a3d1f05d87eacec5683a64b287_bkransomware_karagany.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4824 DiagnosticsHub.StandardCollector.Service.exe 4824 DiagnosticsHub.StandardCollector.Service.exe 4824 DiagnosticsHub.StandardCollector.Service.exe 4824 DiagnosticsHub.StandardCollector.Service.exe 4824 DiagnosticsHub.StandardCollector.Service.exe 4824 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 648 Process not Found 648 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3040 2024-05-19_349425a3d1f05d87eacec5683a64b287_bkransomware_karagany.exe Token: SeAuditPrivilege 3512 fxssvc.exe Token: SeDebugPrivilege 5108 alg.exe Token: SeDebugPrivilege 5108 alg.exe Token: SeDebugPrivilege 5108 alg.exe Token: SeDebugPrivilege 4824 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-19_349425a3d1f05d87eacec5683a64b287_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-19_349425a3d1f05d87eacec5683a64b287_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3040
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4824
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1920
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3512
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:620
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2608
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD57c1dd224505a682e476a7216fa147220
SHA175cbab9698f8024bc4180a421b39f746a86a3f1f
SHA25664900bf3e3c38c3d469aa1270a8b212ac82317cecbfb6ac5b8c4aa3f570fd2d1
SHA512b4e746c2a4cad1420e6ae423759a2c7c99ffb73268798bb872aaeede12a403688d46dea238b34a1d7d7ebb27267b314b70ec2b8936aa2ca7434fa9118cc0de78
-
Filesize
797KB
MD59530b9ff0f81a1b6e53ba266ee238cb5
SHA1ae30baa45532222bfea08af1f3e4272bbfca65a6
SHA2561ee02ed743e97fbb4232bc24a375e1b6f25d2e4e8d0be4b638abc73d7c446b95
SHA51202906c926589f1a8ad33315166e147a172adc6fb83a87b8c512ae6f4fd73f225c82f0f936c4a16f936f267d7e5fb1d8525850a360b6a45cd38223d8f5ad22783
-
Filesize
1.1MB
MD598b0289c75cd5b2fb570d102e83bc2c2
SHA162ef5a3a9a102e40630511370f8ae741e9292c5c
SHA256d75fca07af88268a71f231878ffb9423459d882cf910dd96a655c5f7f19db85c
SHA512d6ea4c3fbf82387f25961a78847dcbc09a3d249d4cdca7dddc0c24489db514e215561104d225836a869e2e6b865cd5de20b33df51c53a19b3b326038947cccce
-
Filesize
1.5MB
MD5a4d494dad1e19d49bf658ff1d7ad1824
SHA1eab82c9fd6f6bcf8a85bd46cd72e408905948ad2
SHA256eac20b5aff03db0de4a2aef43603d3050be542faa69012cf1a8678a6c6cb2738
SHA512cbdfad7716b536fc29166ee5e89e980f16fa098220ee821b0756b37ebdcaba0139311b503a2bf7399af92306b36b2b2d29a5622486f98dc46f3e5c90f67b1137
-
Filesize
1.2MB
MD51a37037eb728642bf0c1c8b9ebe9b25d
SHA188252e49d9c5d96ea84d25267a52408dee2a49ff
SHA2568cde26e9b51420b527025ee0b2b05e2affb644b1712bfeeb65d53ca17cc37db0
SHA5125049a7fa9bd61c9e9cadf658f78346fc2c69240328daa9cdd98a095bcb6c3b9ad4f5a304eec486b051887497b5eba4695bdd3acc868a25a02a8d1c37b2f30827
-
Filesize
582KB
MD5394b750f4ef2bdb071cdf984a5d780b5
SHA1cee5aac46e5fb810492e09566cf814da53068dc3
SHA2562c32aa8405d7f5ca6ab9a276965dd79cb9fa17963e2b879f0caa729e1baec3d8
SHA512b0c82b0efe89a5a3e2780e1a0f855353f5b4c596f56d7e585c2bfccf253399518dc2b40ff17687b516064207ab41d004c4c05c9e6212eb34529a486228aa9323
-
Filesize
840KB
MD5c5ec908d27c6380b32638f506fa35493
SHA1355373b739eabf3fe1978c5ef3acf6f376b8eeb7
SHA25695a4742f943026b363745d6fcb5446d66426bbea1d1c2586ccb08117fe3ab455
SHA512b38b52f376ee2ae740e21d04c92882f30179336e3d0cc76008b7fe916188dad3028f4c31e1100eef4643b55369f6af47e70c3605b07aea5048e5668b9e4d1782
-
Filesize
4.6MB
MD51834de161080908106ac137ee98e787b
SHA192cc125fc187223a217991d2af3bad98b9138361
SHA2562d9f21eddb386e08a69331e47554f0ecf4a67480d5c178509e9f26d189039a67
SHA5127d825b6553bcd5d8b2e2f62bc8460aea4d4857c73f64e9663bfd005cfd5df692f084ce5d60d5a600a6b6a655a37162cdf93f2609082d20c88b2f8d08d2efcfd9
-
Filesize
910KB
MD510cab9d4a30584f953c8351e74f7f312
SHA1c452c7af05cf533d431cb73e38739aaa870a36e7
SHA25630c6fbc332f2d401c7c6d2f2d30dcd9218c99b18253cd24680c639182de18fa9
SHA512de96e31d0e0f3755dfd7a8e72a80d9545bad21ffd4531751df487357a784214e2ea0a540ea61bad7f515e8e5fe18dff623bb7074c46b67e5e25a85d4a93d0a73
-
Filesize
24.0MB
MD5a8b563ed98533acdc2b3502da07ce09b
SHA1da713a8d293f3c6b2029b5b64c2f1087b44d8f13
SHA2566a84f204c73ad95707440a5f3bbe1f4451261dee18620656fac34377c07b0075
SHA51254a9391d5f5bab0c5e61f56a0894144a8536340cfbbff5206fb580828de593c36a540bd44c6b4e487cff724edd6fde03ffcbfe542c75791c769253866a304d04
-
Filesize
2.7MB
MD53d1cadf46655e79a986debcd297aa6c8
SHA12dc5f001a931f23a61d93ef6bbf30b77afcf9657
SHA256bd953b4d9fa4e095828f727170d40d2fd482d10c25bf12806198be530f790407
SHA51279d1672535d1af836d1edb526a9dc0a5e3b87241cbe9a2f97ce1143a9766317221c9e6bebc2fc4df731e89c03097c13cabf2f6319e458d59df3ad87cbeb55d81
-
Filesize
1.1MB
MD5d97118f6956a01061482c9b48855e49d
SHA1fe5e0d03ec949495c466f234092c100109a86336
SHA256770559ed0cdbf94648fda69c406c5e96a3dfeb975e0281679f6760050099562b
SHA512b508d91a463e62d1043f940b812509767d6b14bb5f1c1ac035f45dbecca0324dc0bce98fed52352522e9bc44f6322668e5cf316c1f044eb7ade9fbc6faa87f5e
-
Filesize
805KB
MD59038a90a08a498648bb57d225ba3f990
SHA109b99090bdbd045e962e12868c6d87d2682bdbcd
SHA25633d082ec875e7d9fbdd3e8d66b755de6fba31c36f4c2aafefd1918aa331fed45
SHA512496261f6f6aa83af146ab45c0a43b9151af8976d60d9e5e3243ff9101dcbfaba9c7f14407a08d090c508be6337fc3f237bb7eb2d4260e6dbe0e8df811cd8e8dd
-
Filesize
656KB
MD5189ec1dcabd0534a719090d81a10f900
SHA135750ca92b168997e0fe3008819d85ebaba8b64b
SHA256460c76d1b02493bfd5eacc8801d8e1b820e62863b9571215e78d8cf78d0546eb
SHA5126f791250f0170483ca7d3823a226129125af58411bb70dc800d7d3e2d86d64095b8ab3b53a91daca0e1209dc47947b10db1125dbf4f5f608c24f2116fc67e1fe
-
Filesize
5.4MB
MD5bcc2645070d9e72d1e4e5f7fd7a57836
SHA132718f00595aa40eb1d19b268da720eab25ca707
SHA256f2234251c00cff7840522b06b6d576c3fbb070915435ad416be5130c220767b5
SHA5121d83d98e8f469d8adf61197c9176381a99a84357e3bedc0b0a49d6a774fa92e17ce80127eaf6cf7652b78ad54de5b1f71a160fa93d62ad2936c677fc73ca6c84
-
Filesize
5.4MB
MD56dc5ec595e587bfd70a2cb5435758cff
SHA1adcf47fcf4309b8d98f2782e6346a8098abf071f
SHA256d2010033eace3b5aa30a89a4dfc980b700dde716e20c4c8aebab8be6a687fd08
SHA51225ecdf81b5b40b28569502737a7bd6fab89cee9c60c09a302679c51f5a09a93160b0ea27f731da79ee24ea28e35e0b879ff7f09343822c7584fda62dc04b7e8e
-
Filesize
2.0MB
MD57684daf41fcdee83e4029ca80d35a49e
SHA1673c99e3a5e9bceb928ad0f66c6359aa985755fa
SHA2563682d5b195f3bfbb776fa3b162257ad5f7a3bda7428fbdd9ac528c2d474041ec
SHA512de5cbd8b64195ebd2db7f40cb50213655128e03199c2b04ad39add5b5f653d04bce27814984743fd629816d208ce6508e0af27705967fe3b0769a0d9678fc1ba
-
Filesize
2.2MB
MD5f4ec0447e343f1c59b95420019f24ed7
SHA145ab26a0dda5040a849318bc9cd21904956229b5
SHA2565ff0dcb906863f729ac2690a54befef37eb24fccf3a641b320fb7a236a5a0184
SHA512634535f22fcb721bcfd22d33503a7dbd2ad5a5f9a61b4a6b57c1a139b5f05395217c57c7deaf05b0658bbc49c2e21b6f4a02c3e5076715b3a96a63c251170f23
-
Filesize
1.8MB
MD59e7ca506b6adcae5e32efcf0d9c493b4
SHA150d74dec02b37b35e99cdba4d2570a07734d1a79
SHA25638ddf0891d197fe16fd214032dbd434668c553488fb0e3bb02258aca1c29822b
SHA51204a933e08bbb7165bea1ecb0979c4ee050997d620e3412e6c2056154b155462b08442df3a0441858b75999cab2d73620bb32ecf9631ce1aa92334a6f3b3be015
-
Filesize
1.7MB
MD57f3589639800d8a45ede2a76328071c1
SHA1da9f2547d94514c7d6a9e274125e845e8ace42ae
SHA25661bbdcf1adf9dac8cc0f78362d9f41bf359a8a74b1c91a681b59003a20e940c1
SHA512c157262d20623deae27b676092168ecf900bde984e943dafed609d8bf2a61e65bb40866096949cc3eea6a7498665449256a754cb51b6c2b04854c5bb547e38d5
-
Filesize
581KB
MD562203ac0b4bf0b5b1792f69ce019e8ed
SHA1dbaec0ee06ba2a2bdc335668c500175fa58a3dfb
SHA256a8dda20d79949ff539eedaf1a55a72bd7dabc00f233b3d4b7b829f5abc103f73
SHA51209e6f4d73c57f925cecca8e71265cb213b2bf642212d9bb190a4433517a42952a7c64b395c4cc9ca0bea557e4275d8d33171bf157bdc383842c02bfefbe4df57
-
Filesize
581KB
MD5821f187c3a1ecccc221fcde2b3bedd56
SHA14959cbe5a7574f29832774644c44c0d3d0686d39
SHA2568881135848ae335570b6bc55b87786fc04281e5630a421b146971f733accb844
SHA512e77f07f34c56b872c181bbe820ee1bd1b12f295e899bc3b820344765ee44619abb29e0def972f95dcef2ef94c340f20be8173ed095cc1d7c274e5c534c942c94
-
Filesize
581KB
MD50e2b9e25efe18b98716ff704a95dd704
SHA1833fda5d19a366e6680164383afdcbf123ba8127
SHA256743b5a51f4ff74547225d37ac730390092618455075e315da3e6b0ef794d24c9
SHA512c152cdbb4ecc9e23121b41cdd4521fca58ef722ee549718fa65ee866316b4bc9bd4243b543b104510c10d2bd856814ae42bcaaf7de7020f3265ffec318a5010a
-
Filesize
601KB
MD5cc96c99281a5f6553ff550efa627aa1a
SHA110fa2ab39b2685d3262c37a89a6ed3c7b3061593
SHA25616d944f77b7a3b92f95afef48cecb04907ebbf344e5bf68fe76f7d4b5d250dbb
SHA512bfcee062395d7ceccbc22fb87db81626de3b0d5d3dd6c27ce5ebca1f5691824b772435d1d0c114eab99ac0bf013eb7ebba49b376015c3b5324007fed670c1c18
-
Filesize
581KB
MD55c3800abd4928e154a82923e7717a4e0
SHA1d6f258823feca9f2a122b8b63b19d25009f9bbac
SHA256e4bb061dba28c09663217158c98987c5949e56e0734638a55dc7c13f4a92e607
SHA512e0992c30e0ab04cea4c227e487793fa100edf74563114f60b67b55894eb3278d93c8b73e5d2b53216a0217ea7cc26a9b13f017d61eb11f6bc69e9dd18e01cee3
-
Filesize
581KB
MD5bd280653991333d813539a6a01d59e60
SHA18637abe06d98f9f6ab58211c28593eb7ad6d947d
SHA256325925d69f48e813941bdb04c7912cff181922a94cf04236b94c5523de0136e3
SHA5125f75303bc51f9173aff33243b818652f2739c68822018f0468a7a2e523f6a38a4b201d1c851b7e040bd3fd0d7a41c03ad671294fdf144635193c04f68815de9f
-
Filesize
581KB
MD5eb32bb56fa22b6e8f1f58f287f14e865
SHA1be734501160306865b7c674256e9a0f575da8fff
SHA256ccadf92295b167b6c12eb1bf5fbe02b0e66cfa991cc3007f678d5c90c7c88fef
SHA512d8e2c5601afc19370f5ed6a4ce5b76437ab0df23d31912e81c073b487272953a3c679fe1fa9cf0123085448a4c13e3ccd1cfcb4a842f4b7664fc2beba55a086f
-
Filesize
841KB
MD5c51ca19ce6701785442b435add916090
SHA15e98b39667450cab059a129b1ff5863dfb215109
SHA256d2ad99dc480c6c235343c4245d3d77da82d92545f0799a46009ab8394b8a6f3d
SHA512d90a4e3a3f07e0bed42394d86924ca899d33a36942c85082e84a0e0905f2f7662e9fc48e1fa587eea683a12c6451f1523d93805a15c489534060940be0a54102
-
Filesize
581KB
MD537990935b52a3f950b1d6aac9a712ccd
SHA1b980b4d8395c3bf07033e6384ef56fbb39e91ab9
SHA2566637f516d95838ed5af21db89fa2a4b94762924216c8b2e20cb668618dd848cb
SHA512fd1461ee42ecd2ada3b9d1008060503825d6659b91848108815ce72210e840cc93897d29923f3de1bfd1dacc4179b1ccd2cbdfb91b5696fe6d8667b7a1dcf70b
-
Filesize
581KB
MD50a442b8e362f5ed763d26594900d4c43
SHA1342025c66f40cb7c09920c02f6d070e606a48873
SHA2560e203fdd49879b428550910d18c53f41aca7ed1a845248c6c8fe2ffb910eb72b
SHA512d9aaaafa4546566dadd9a1b87a4e1f200ab44e5ad2b1df64e28a9c8f807ee90e440dbf64289044394263b0dd28e72b8099d20c3989cf79adf4c686ec4d74b61f
-
Filesize
717KB
MD5d40f2b44442c9918fa0b8c30ab6a26b0
SHA1bd195da7f3a1a5c0709325d99adb87fc5fe62890
SHA2565b105d6b4864c5803e017eef11177e953dfd3b44a8dd0f097803cead9d7b635a
SHA5126a3b440d6605690504ced3dd3ea0d2c96e6771b0dedb7736d2cb1dad42725daee302a36956b9827cc80167c1f3a66ed8fd2e376e477b96b1f8245d6a2646a3ba
-
Filesize
581KB
MD5f9d96e1e509ca456b1fa0eca51abb77f
SHA1545141ef3cc3b378f83d32a899afa215bb33cb12
SHA2568683295ff67d2153f29055ca42e62370f3d23cff98f1e042184593df46cde90e
SHA51205e0a2afdccba4a0fe90defa4facf57ad01bd9bfb205774478a91c7f81c13a73d0540838f20d4bf81ca60985ff32031ebf3fa929499b87b67e6cb7cb554d6fc2
-
Filesize
581KB
MD5b82fb1c98dd14316916f5803e84c78d2
SHA18320440746c6188573dc5f467309b14ecbc591e6
SHA256d2f2a7db182f52b22ff70f0d71dfb68ea21ea0fd8436f5b2f8dc08516fe036e8
SHA5123f8ec05c41afd7494d0d83f51637781e0265d2d14614128cdf906a4c15ae6b6bd6b3984c0ba4a763e3fae2bfdc58ca0fd2243e7039e9653efad95f15914edf64
-
Filesize
717KB
MD59401b0d97a9978a03b84ddb6677e4445
SHA17f56a8a9ad8221fd012179a54eeebbb5d4178d38
SHA2568c94180577e4489555f49ab53c89ce2ffee4d5baafb88248fdbf96deb6cc3fd9
SHA512830d9b49ad06896f9d079a1e43732547e6f023bd49e2a61973d4fcfc51692c65e9490ae2ab8910814f036770f036141021b25a61cead8313742d6b59a19de1bf
-
Filesize
841KB
MD5581a6cc24ffe284e8f6633c14b85398c
SHA12c07c0c5aa40d71da842e2f3c8ebc090ffa9a1ac
SHA2567bcc65a02f273d013ee581afb09413e58844db7fc3fded89e24ea4304045b72b
SHA5126d555a6fac5a7858a42b731b522eaa3aeb496e4f8a3796be5ea2712a46f8e90030464f1273a6ed6270e17b425208392e3ac288269d7ad5832bd767f912206e99
-
Filesize
1020KB
MD513e30dafca01494e9d20fadc84d4fc49
SHA1bd43654b9fd68a61ee5018f289adab7605120242
SHA256fe3076983b6bafd446e31e44605395a536fbd648e735607b2cd296137a9d1c37
SHA512dd435f3f4bd627f53008e923d0f56c59ca3f2bf44e101f80cb856541c8fd0bdaec2e19b52121736017d92581d557fa0b63f09f57f9b4196ad2b81d8aacd8b2ca
-
Filesize
581KB
MD589b9fe096ba0e411698a75f58655e438
SHA1b93b746a240876c948376f9a33090f979ec687fc
SHA2566c852503b724dc35ae209d9ce249aa0670796361c5fd890eb10dd9259322c5aa
SHA5128cea1b4bddc10e99b4b5fbd9456d3cf5bb777a16ab9cbb1831e3ee10bdd19b2501365a68d2559e8403fbdb1878e4463a3995a56709b4fd82419d143f2b5f32d6
-
Filesize
581KB
MD53239ddf737c3fe965477ba13f5984bb4
SHA16be7110180accb24f12a03368495d223858188c3
SHA256bcc80a38d91363ecc091acb388fa4ac8be87b3ad72d42902f85e973f80162584
SHA512ce5adf5ff54cab21f82fd0ccf34ba45c8afa953bda5a7e3356feafe1111cbf30db7349e4d570ec23bad2a7bc8ab401b472370bae81d54cb8091adc9bacbf00fc
-
Filesize
581KB
MD5b25065e5db0c5f145be300c32776df67
SHA19f5e2bb86e2fb4b9f760f34485b11840fb15c4f6
SHA256cf5f2b129e4f1bfa4e417665a4a5c9114e8eef1b3a1599bfdcaf53aaffbc003d
SHA5125ab0ad1ed886fb6a3f3f51982a946e5929c5413df3e04fdafcaf3e51328e7cd5be8672d695b3519d58f3b371f00d6c3cfac020dbfbefbbb8e9ec30b0ba9b565c
-
Filesize
581KB
MD53b7ec5b821138f05c364d380300e9f5d
SHA131ac4f194a814a0287d4f40c97b51a9e5c97107a
SHA2563f50d1cc53c026a7b2ca88a8f538cc14a0d593576f924e4763ed773d2ff1aa53
SHA512bf0b05f562fd977045011a836c383e3154c537f03efde71e69aa23168b7d7ed04f650d9a5d7b007a33243c476d65d6cdd3a2b8daea79754df88452766fe7d1a8
-
Filesize
581KB
MD5a0ee03aaa70dddf385f3f804c6fef6bc
SHA192a3745ce9b54a250a017f2ed66631147be68a6a
SHA256257c93225dfb6e6d6973a6f420547ab0c1f08bee795edfd928dd5c774dc8f8d8
SHA5129394586fd39756a5ba064e7e3a7fc11cafc56112b995b6ea4b56200c88ecb2d6658a2ca195db58bfa9a561b2776c06dd37b4f9b59549174833b3d1502c2d1974
-
Filesize
581KB
MD5b838e22a2569e8e4fb6649bdae1e1c48
SHA1a5033eed70891f959b560f110bdf72cb53074091
SHA256a9a5af1d2d807000c392bb62669addaeeaa3f777fd5fa00f8ca45be04aabe23b
SHA512aac456b45195f81bca2d1a1b35c49940a978d20685c9a2cb4f3de8539ac0205c723c48d09de968084b8a97b481c9e6ca9d8b05ae515ebc9191886ac8294d67aa
-
Filesize
581KB
MD5289587969435e90ec232d33bccda575a
SHA16bb917b054bf436bffa0a257408694a3fea4e10d
SHA2561fc54c759100a5f943d2fd229effbd8fa07191e1133c3121cbd8400b769fa6e3
SHA512915f04fd8bb86a8b7c8da8d66e02d6ed073023d652d73b3911b56294f1ff20380da6c8d1bfcf5fdf5cd4a7fe8539ea94204312e3368060b8fe79daab93e35ad1
-
Filesize
581KB
MD560fcaf6d4b6578a3374f3c89d838a0e3
SHA17320a4de70de913500831fbbcc7e8cd764f38367
SHA256c225d473c893a465d1a315c83311c0d42d51ff784bce3ed738cbf41217bfe785
SHA5125a75948cb7df7c78337ddfdf6666d0d6988f7c7090cb92d1dc5cb476938be4b4ea075802bc04ee0958a4d3ae4f729952f3dbaaccb95a31ec8d8984a3af45d309
-
Filesize
581KB
MD57b6bb718278e64557c843925dec13945
SHA1592d5585d1d0a4c0057bb8d4d2b0ba28a587441b
SHA2562286eb972c8a37324920bf41304874a7cbfa6dd882c0adeb3665d2881b603141
SHA5121b176ee1c514b8686bf642d32a270717b32e5228db6bcc978df2c11a3ec7136ac87be4e2a24c74791389b7d761ff6a1306348fb03f775e1d526ea217e4af0c73
-
Filesize
581KB
MD5ca092d91cd090ec87466b2a6b1686aaf
SHA1fd2a620b176c4dfd0e742dcadd6d3f0efd357109
SHA25693d9e25737b95eec637abd049da03d70ed62ff7d89cee1fc0f7def8b75977811
SHA51226232d69f2579418fef7d8f543133859126cb5525518eed7aeccd23c0b4852173cc8f4380500545101f6cc0de49b13ad6791692a738192ea09c58c794767aa60
-
Filesize
581KB
MD5000ce87253f5cfa9df32b5abc095f3a5
SHA13dde77d6094c2fa7e52c88ca519c7a15364f69b3
SHA256d04d1e277b9d4decd4f75a12141bddd1914c51edc9d0202e059c362bdad697ba
SHA5129cc295775d79e454ec48ea60608c41518b50ffae5be5027219fd2a2f4b25c442a9914799cc816e7fdf8e7499a7ccff36ad005e252b27e3ef28888cbe1359571e
-
Filesize
581KB
MD56375451f9b183853cf6028ab13d32162
SHA1116a903f80bb6e30151e3587f4b0c40a5ab38968
SHA256f0d56252b9b220cf0825a27369a0cf6a35424b67d20acdb2bcd9c73c37d99440
SHA51267ae4af3730d83da0e35dfb597ad44c906aa0992508410fa3de5aecdb7731508712c2c19883edd1df64f7e514956a26ca015a6e5ba9f33fe0ab9e77aa2419601
-
Filesize
581KB
MD55051d870f78f10bfe1871d3c213e5f65
SHA1d5e64d37ff88b7d62893827ee46de9aefde7aa6e
SHA256d4b0eb42bafe0dadf3c60c1ab966da224a7f38549538be6b7821aaafad11f726
SHA5124e452e183dbbd8292db4b73342ee1b3e9032bb4ea58eb9ddfd996138e36dccb4f312056f5379b8644cb62347779c74b1e3a1331827a9322c393990af998839d8
-
Filesize
581KB
MD5dc88da5cd00c1a35473ac49688ba1800
SHA184810d02e4203dcedc07f0eb84da48b0f8be2615
SHA25666bd4648b62d0177b1503a9d73e3b59c57dcc2e17d395964c4c1046e254e08d1
SHA512765b379181937706359d74a3a5c97075f43b9642fe450e1253b15100d9013413bacd47f8e249d0341a66c7c456615c2bd8e2de6248ed0db919d7d14be7d119a0
-
Filesize
581KB
MD5971118a327095ac726b83e9592edf425
SHA111acc03403eccf2e2862c8a5eb0cbad969f89406
SHA2567b2dada70f595ec1d2098b7c9802a7feae5016207b1431922bcc86e03c04fcf5
SHA5126d6f1205f95db4368adf971cc5d82bb871c9fbb4b103ca08f185a48744cc881f3d0fe3bdb43290cc8147124eec07165eaef561d08ea0a511d6274802cc1c9639
-
Filesize
581KB
MD51660f323e4f8560f337fef427e098d75
SHA14463f7f70e96d2231e1301a65580ea1d28548bea
SHA256470cab106f0900b1583fd030b606fa621394104da49e7479915198b7930ba109
SHA512f5338a6521ed97285e5610fc56eb40b6fe79fd590a71596aebff82872e4562c054436673891394a27fb0aa1830894b1aa88a651f154087952734a0a85490b188
-
Filesize
581KB
MD5a66d7a0cdea0ee7720ef82b502dc5076
SHA1760cf242f8fe361cbbb92acc73aaae3faba7e8e2
SHA2569337cfedbbeb784f4c4903790e66a91dc91f37f2d6bcb141478baa392dbf5006
SHA512837d2ef58ee2df60e4e0a34ee67ac766e82f720f38b487b45176085ec4edfcf646bf9c97511921b1f1bd0357b323a4ed592468511a9aaa223b45deb008b7ba15
-
Filesize
581KB
MD5ebd72c128bcfdc5f3adebce6809d72fe
SHA144b3c7065e3bafe5baa9c0b9565ff091ad4e8637
SHA2561dc68aa3f4cdac224fbe066cd1e471510a53cede36a7123fef1ffd8e3e48016d
SHA51220cf7acd8cb666c5641831c8e998a5b88e65640b689d70bea584f97b6611b35aa29454dfe1a435c976a931085efccbf6feddadefb99e8bbce80bd3bb3bfe65fc
-
Filesize
581KB
MD506d2025ce3c88c3885f1528e988d702b
SHA1051e39cf30d9e76a35b95c75ecd029566db51b04
SHA2567275052f4a673d62761c760f3ec2852cf19bfeded5bf9bf7430acb4bde850c2f
SHA512d9d080811fd52479ef57c650e4ccc19515b5a5fbd64f9aab79c25ee03df39b2257da37beec659edecc7e0cc145a1cdebeae51a69db28e6b09bf19f34aee09a46
-
Filesize
581KB
MD5cfcbdae287ef83047581a7301b2a0542
SHA1bfb0cf1d2af54b34f67c8f3ebe628b771d2e2983
SHA256f86aea73a8d58d135eb02d3904525a2f9cc69a57cde2fadd2c67ab516ce0fc34
SHA512ed71ec28f96c6d6d661ad2dcef9c55d9e54c5ebb2ef0d98f2aa8dd61f4161e7b8b32a0bc880741d9ade8a09de1a4538ae0df295780103c75e499a41fe8088c3d
-
Filesize
581KB
MD5ac27902fc70ee221162033d23cbf49b3
SHA15515fffd475493becca082cbe14e0011918f6057
SHA256c42966dbfc437ab3c5c8a87814671df9cc5a89da8944a5dd2854d7b0a81d8b90
SHA512b4c60e5441884b54ebf46af8ed5966a196f64e62d07bba83563d0b97b3349abf2f400f4c62fe1cf3260667f771a4a3ee52305fdb1d8ee2a6408369cbed7e47a1
-
Filesize
701KB
MD54927f245adf49da04d11b2eba77c2246
SHA12e36210e92d8f4f1e5045c47ec33d92e207c6453
SHA2563e9ea8862e36b79d35678a4975707bcce57b7ac38fbfe68e338b0c6f7ca4be65
SHA5129f551a7b87fe5e26963db82a0364d484fc5d45fe76d9f02d11ddb0de192fc4ae5c3483eb2191a462efcbd3e973221e580aa226102029e189676169d2042b09f4
-
Filesize
659KB
MD5f65d19781692a493c4661bacc1cae4b0
SHA10b322de17814deb1fb409a73cd1e61cbecb54db0
SHA25694077436f844618416a49abe37af683cf449239cfda7c30caf97481d1115aa8b
SHA5124bdd3bf5944a5a1c63992e7830e927322a8359651d31337049fd9aeec54dbc591c01b490659892fd4cb3acc59060b07af3eb561383f397e8f840d28df3ac6578
-
Filesize
1.2MB
MD5ea129b022d1e70d931b5ec64417c7c53
SHA1919e3f5d5ecf81509fc2ffb2ffee865558b59b59
SHA2560894ca84d7f912b66c3740118dabf7c15bc3e88ba5ceb50d0844e8426a991a0f
SHA512f5a39efc09e34399069d239d4fd21189ced80107cbbcb16bb3702b4347578d08776be07226eee9576b60cc08b55d2b5780f8eaa7c0fe0b6f2091ad812c6072d5
-
Filesize
661KB
MD59b294f2e438878166d96f551fb58bdf8
SHA1c82e7687d2ce50f21492048e4eb45109653bc738
SHA256b6cd78f56ffec02c55ef53a085a25d7e34e778da0487fd25c85bfc1df04a40eb
SHA512ae56606e0de301f6c343859e62f40568d14b40b685edeb66e8661fbc0da49a0f5658eaf0ce5404ec382583f49bde4eb53f6dea0e7dea80b5556a01955be3db02
-
Filesize
1.3MB
MD5e7df49e4169fa5aab581667081f26f4e
SHA1da3bb3e6bf2e1b0a576178dd62cf511bc6170e1b
SHA2569a05a6f447c0dcd91509b2ae11c3272edadd91d74fd6a21d4a6c29037fa4ebce
SHA512cd8c3012f7fb2c14555857480b823e8dbc88a3d51b7d0d3e0279f0424bb28a1851f83f77b652d1f9a56cd565a2d77cf1c6019a1c5a0f0c9ab0e66a50cdfe7ad9