Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 01:07
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_e5fce993243da65fe56a6f97b0f66922_bkransomware_karagany.exe
Resource
win7-20240221-en
General
-
Target
2024-05-22_e5fce993243da65fe56a6f97b0f66922_bkransomware_karagany.exe
-
Size
677KB
-
MD5
e5fce993243da65fe56a6f97b0f66922
-
SHA1
269302bd729999a3c5b5e662731df7411ce1457c
-
SHA256
5feab5ede15b808db51a1e592b569049d1bf94f9abc3bfce59e4113df7e47704
-
SHA512
e1d72d0373bc91b4e5317b37d0a484f862576db5e0a8caa8743c76de11d60387e5a66095f1742cfcdb6ff268d79ad2feffd0847e3d9195804cfe92d7c173df0e
-
SSDEEP
12288:hvXk1oUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8R:5k1oatr0zAiX90z/F0jsFB3SQkW
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exefxssvc.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEpid process 4520 alg.exe 1808 DiagnosticsHub.StandardCollector.Service.exe 4972 fxssvc.exe 4940 elevation_service.exe 3984 elevation_service.exe 452 maintenanceservice.exe 4996 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
Processes:
2024-05-22_e5fce993243da65fe56a6f97b0f66922_bkransomware_karagany.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription ioc process File opened for modification C:\Windows\System32\alg.exe 2024-05-22_e5fce993243da65fe56a6f97b0f66922_bkransomware_karagany.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\302de9beb3e2edcd.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-22_e5fce993243da65fe56a6f97b0f66922_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-22_e5fce993243da65fe56a6f97b0f66922_bkransomware_karagany.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-22_e5fce993243da65fe56a6f97b0f66922_bkransomware_karagany.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-22_e5fce993243da65fe56a6f97b0f66922_bkransomware_karagany.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exealg.exedescription ioc process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
fxssvc.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exepid process 1808 DiagnosticsHub.StandardCollector.Service.exe 1808 DiagnosticsHub.StandardCollector.Service.exe 1808 DiagnosticsHub.StandardCollector.Service.exe 1808 DiagnosticsHub.StandardCollector.Service.exe 1808 DiagnosticsHub.StandardCollector.Service.exe 1808 DiagnosticsHub.StandardCollector.Service.exe 1808 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 660 660 -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
2024-05-22_e5fce993243da65fe56a6f97b0f66922_bkransomware_karagany.exefxssvc.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription pid process Token: SeTakeOwnershipPrivilege 3420 2024-05-22_e5fce993243da65fe56a6f97b0f66922_bkransomware_karagany.exe Token: SeAuditPrivilege 4972 fxssvc.exe Token: SeDebugPrivilege 4520 alg.exe Token: SeDebugPrivilege 4520 alg.exe Token: SeDebugPrivilege 4520 alg.exe Token: SeDebugPrivilege 1808 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_e5fce993243da65fe56a6f97b0f66922_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_e5fce993243da65fe56a6f97b0f66922_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3420
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4520
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:208
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4972
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4940
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3984
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:452
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4996
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:81⤵PID:1632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5eb1e4b74080ed439bbfbf872d20dd1a5
SHA1f8452344ad577de3a2ef826de54de0e147af822b
SHA256911ea34be6edb595050fe2e098d2481f47e758f2b7c366390f667b8dfa0b4307
SHA51264539d98f7f0b7f0f4becd2da01938e0b4fa41c6327bc2f21dc41f22cbca50aaeee2e5d6ee0dcf39c83f295f44077780df7699cec94c09f4dc201735e9c82b4c
-
Filesize
781KB
MD534d87463cde09236868ec015a98193e9
SHA1940c956121c3d1b32a88a71c32077b4e656142a8
SHA25632b822aec478424216046d8f4f18a61ca9b9913a2d5cbc65890fa0619d1bceb8
SHA512b28c8d3c3d53ecfe9448afac947fc3f68093a570e144457d0f4493648dfe16d32abf5aba7ac064559bed544acf604755d37ab2c6413686ed1e68df94d0fd3827
-
Filesize
1.1MB
MD50ef698e859eed713df8d652b8158cdbf
SHA13fc5e0e97c3bb7f8cff855cd7ed542cc2bcb5bb3
SHA2567b487deddffe03c22bbc7b9f025dc95dda37e0ddcd1a005054d40ebcb38e1ac2
SHA51280b8954339208220ae72ddb49e3b9f3dc14bc9bd97dd9df6507dd22244244f2eca0b53fcb265e50f76b1d40a6a2ea8917a399aa5861c97a3aa1e31d4c9c52922
-
Filesize
1.5MB
MD52081865e42d13a0dfbb577a50a790990
SHA1908e3cf0736ca9c82af0590bc310e4b5979056f6
SHA256110aa3ea4ee65244062ff6d33cb9a91046b3975e8da480f46ef951008df0bfad
SHA5126fad7ca594844ddc18eb59059d7892110bf8609782e2046090492daab3eb824290454ac999d8e253a8693f9d0511aabfefd939e92e6453b0aae6ac4ec7ff2870
-
Filesize
1.2MB
MD50846f1886eaafcb7459bc17fa69ddc3e
SHA1d1b6ad5ca1a239c7ccf779bb756e5836934b2820
SHA256850c414ed59ab3aa81fab782e4ed9e6762a05ba0aee0dd26d5daffa1988cc921
SHA512e9c0264cd1effd27b90d4f9f4dfe63eeb8f80a21536b796c4d6619ac72df850fdf22e16e1fbf3c8182fb96b19109837fb100fbf717d4f73f1774206b20166541
-
Filesize
582KB
MD5d22092a2a646cefbcf17f897cdca3127
SHA1b276b5d4bed03bf4960d466c654efd030b198fea
SHA256e5cb83b3a7833e95dd02295060cc3cc61fcd329ea7a75a40035e5c11809778ba
SHA512331c3e296712c39c508aaf1269caea9997ac918dab19ad3e05667e7011304d9ee8a07fd34919b7762a8836765c26992d627558b3825620f7c28a706877ebf15f
-
Filesize
840KB
MD5a3eb7af3e22198cf6a11988c981009f5
SHA1d0105b1a601b08acfbece8157e209aec14ec93a5
SHA256009beeb4012a16e44f4267541be10321fb6e94d06fa28e30ac6a6b580e57e387
SHA5127995e38d9a2522e810fcfe9df8ce8922d7fc6f006fd8c01ac152e58bcc33e1bc0edf54e167c85750bb5dc0f330e2d9bac0d05ebf6606c93dc97f0d112a9b76e5
-
Filesize
4.6MB
MD5546a17bec5109835093bd775061c7499
SHA1d59dbd1115ee1e4d47788b016c7ab3c4e772b50d
SHA2564bdadbbc9ff2daafdcf8e6e7012dda88754e93ee44a0c9267ec1205aab369901
SHA512a3990c47e2fd35caec059053411744abbf7ce999147e8193a430957d1bbe9261ce93abfd3a94e4e9a4f84e62a2ecdfb4536b3cb3e0d0a4e29feed0c6307eecb9
-
Filesize
910KB
MD5e94184e40af868d1694a5bf070204a01
SHA1ae7e64a217936f51a72857cbc71e6e36341ce232
SHA2564a652f71a733057a6fb4ffa503a7afcd9702fea0ab26fd6a577c4e6699c2979d
SHA51248f1abeaf0f4bb47aa30892f046e8714d4d33b419bbbcddebf655bebfcb2bcb97a4c8889c0cb6b1fb9b62e03e06897048a1430fd0b598cc0f770f485dc798b7c
-
Filesize
24.0MB
MD5cb30125958c4215f5c13519716c3e8bf
SHA132fa0072c04240bd11b4b86576139813c90bf31b
SHA2564696d2744945b60fd146474fe2928a8c7d5f7e88e9c57817e8680d500af355a4
SHA51250d4fc6ae21711476615cdd46a62679fb2a497b4b1c8bd826a68c0cd43c4f3b5f23d198f891e6ddf1d21aea74649cab28fcb6c46e1d1109c4af034ba1b37eff7
-
Filesize
2.7MB
MD501635d750721b6d3606bb283dc83a9eb
SHA163f8d1f6572e6aab70c2ff8cad463c8d30079865
SHA256a9787d126904ab08da2ac4aeac0b4f1860e6505fce8cd724c0fef5a4cb6feaab
SHA51238ffaf75328ece5cc81c09d4bc5419fcb540e54bfdeb5638f5a26330e56823224247b7a3ca0fe6d67228f9b3e93c0a83866ebb44fd6ef14c26690e09ff874a63
-
Filesize
1.1MB
MD554a4709cd9780bb1bb340e439c3e5445
SHA1c628291287752eb5d10d46d94e2ae5e5e4b6b9e3
SHA256a53557dc70dfddd24abf084d1257ebe9795ce86e14ba3d437081841c587ea694
SHA5124843f079d3a79fdaef1bd3f32c035f5b220569bbf8ab7ff095baf37cf29c373a6a7331e3a8eb800127e91661cf9991205fcba456db3eb0973e25798b9bf48a86
-
Filesize
805KB
MD5c8079ab417a3eec5a0bcf5578841af63
SHA13b92e50737833abc238a68659ef63dfa28439d27
SHA256af2434001c38ce37d0871e59091a8e5b702cce8bf0ee4ff60826b4ae2b453f24
SHA5129e827cf3db71988673d404262c4e311921653f2ddb6d4a57f2210c62e7e8fd95c2736184e8d62f8c67886aff954aa26264178d21e4abdac8ccc721679677d7e9
-
Filesize
656KB
MD52cf06f51efe0655b61407194cddce5bd
SHA1873fe51db632f8ce254d634dfadee556d4021f8d
SHA2560e0c23c0255a3cd2f552de1232f87afc98976709cdf78b9ca71aae48f74fc456
SHA512c1da97cc4c3c341f47d8bdd5613fbcca37227d0512c9ba8028188573116553a705c613bad165c9f19393ad19496595c881cf822a14249aa18b4d6d07cd2bb867
-
Filesize
4.8MB
MD549f76995d3bb4feb74595b124022fc24
SHA1a04a81e8a0d607e051980d90c9fc5b46101c68f3
SHA2563bbe4a18ea222bb255ddeff97c3bda2d4f68f16c4be5cbd6f7722e015a5b8561
SHA512420bf88e21d45c116a24a4c53f3c51cba916a78d72a824bae6362d19ed2375b8ac4712c5b1f1b45699393d024221f3933084449e0b463068b8ce6d12cc82d858
-
Filesize
4.8MB
MD5868585c6f7339c10a583b57ee69d76f8
SHA1a179aafaad4adff6628816773e579f59622af232
SHA2561124e648b6a0355996f543ad4a9bea5de8a8e50df2935131efeeb75999dc7c7b
SHA51241fdc2a0fd96052df19ec58bb83eaf16668fc184d3718c4587cc5a712b41da42f7aa190bb3383e73926aa9a676414b2e1238969ecf12d67149ef84d455766a97
-
Filesize
2.2MB
MD5671df3e09862a10a181a7f11ce97ccfb
SHA1c76533de90a7d74d8c98ffae0732752cbbf2361d
SHA2561d28114663c147b6f01b976755eb1eb0e8acb662f2677283c5b1efcf129fbdec
SHA51266e105165c79cece06c33733068f437d17084fe96981293469e3f38fcf4c21dbe1aa547987c7c785a7a274682e4e16f46ff1a21f7efa21c415972dd46048f16f
-
Filesize
2.1MB
MD537ffa1de55fbf3c18243f20e4f95e95a
SHA1fbed3ea114caab5d76bef02aaf7af1bf8a8f1004
SHA2562e58028f0ce3ea186316e8b88161dc4c6eef0ecd50d7fbcd323da1f27b939d6b
SHA512bfbe6a340a453dccada0b0c4ac45c54ed4d760e99c657aba3f61adf81e20db5af3aac4441020cef0c606aaa33c129a51b06365963597fa2336d6c7d0544f130a
-
Filesize
1.8MB
MD5abfa2f9988c35bc356466d5ca3e650f9
SHA17cc5dbabf0771d64ddcee4436062604a348944e3
SHA2563ddcefdf81ffb179f4845005d386a3b124cc652ec4ac3cf7358c7a9c575d2ff5
SHA5128622e61a430165853af2954273328be1a493cfe59be51b8a4904c90bc21aecae55a7751127e20d1af613ca98d66877a587ca0a16b34ac05944fae3b67b90a1db
-
Filesize
1.5MB
MD506b0a244f399a3308986fb65d48e55a2
SHA1657ee179a5830431e7e91a907d5391d6458adac9
SHA256fa6c5a84887040ddf813eaa9f4321dbec83a393bbd37b8fb95bca13cc1320b07
SHA512552f240cd28e83c8b4a152b7a86cfdeab2ed4a6e64f963f37f92165cb0f05f07167122e5cf7b3b25030ff6d24f67f5076e2fe6ef6a19a16f41831caa3ff8a589
-
Filesize
581KB
MD5cd0b725e073a632bc9a14fde69c40dce
SHA1e3ce4295a52ff972ef55f5b8241d1121d906a35f
SHA256d8f4a45d4abf5956c51b6d1160ae4e3315d2ba29e6a0d87dd1cf376166fe4212
SHA512e7fe00bdcca9eb7e2bc7d954d47f5151b1a03e7bb3444e56bf8351fa81d0368bafc111602c51c6a904142c0971e471a91c72e65493eb6de4639a2b0dbcc0965a
-
Filesize
581KB
MD5f65498b7b1f81de6bf7b9a0bedffaf36
SHA1e9a34f801577accf4f217b50b7630579e44f3375
SHA256c01150c634a617bf8f7832a2c7ecdea85777e1dab96e029596f924cb52e4c57d
SHA5127babdc9e1c5bb394023c5a44defac0a2af3e290cef1fab3d09042f6c918dac3c4a52bf3f2d88c8e820d6aeb04b4bc992050aa14694e759598e3323acdf58786a
-
Filesize
581KB
MD5eb59a4f330d86907bbd5ca6403803cb4
SHA1313426cfbd1466100ea4eeb19d8c9323f2f3e125
SHA2567b61376463fd6162578d697d7ddf38c8ee19febcfe18933699ee2804d4b9ab5d
SHA5128c1fa447636e1ea0bb07c68efbbbd5ed80eb7dd482fd845bc84797d68f1c5a22e837b5a4b4e7f8c198e1233388d55ced095e4979e16023032cd65893a99637da
-
Filesize
601KB
MD57e05dd580d5f8f06982cba6002313438
SHA1c3f147a818514489f14db49dd41fc37340cbee31
SHA256ffe281130796bc3eb38501e51f6e71c7f1a2eb9c471dca6acae10f52adefd271
SHA512dcf68cfd0f91f2a9f21d70c70b83c1bfac02cc3ce9ba4a795ae840c7f39e73320b6adea47207d604e1969154eca59f34198aef153b89d7f7a9c729a86084cbf8
-
Filesize
581KB
MD592e75f476030ec8c88d02006a36c6113
SHA19fcb722fe562d8d99a0d7da1f107e8b99270971a
SHA2562a9ce3071abf2a9891d350f4b1b3d023a46713271c5a2da748f9041e3a5a2846
SHA5122cd5df74cca0a676e51fa6dacbb4d3224baceec0e40bc76fb0679643ec689f8e4e027a35d7cde881b1c06eb5b052126e8358e39eb1231296e53b7a356a260afd
-
Filesize
581KB
MD5d0bc37f66deefe150f6234c0bf1f6c2a
SHA12e9fa65ec11468c07680ea81bb0f8f8c9921907d
SHA25690df41901a8161aa91495b07ae221c1e5ec4a4f08d409d8a7ad5e7e7f78d9ee3
SHA512529b9ec45b4277cff20a470e2bc22f0035d90e2bedf33de0985e59571067ce5ee9eecc52a1b3754ea84713abafe7491a29128f94e123ac9bbcacda2780a1c622
-
Filesize
581KB
MD5f57bc0d297f96e25aae40bdaf79d6cb9
SHA16c82f87cc62ee316432cddd0674e59cc4ddf777b
SHA256486241b62e031d50ae8fca78cd2b396468a74763b5a556bd1fc6d343a31a038f
SHA512e5dae88768162d030bd299c95fbd43997dff64d549b1400cf5c6efef263a266c65c01c4671d4c703d068fc7b1c9f948b3dea7cc6668ebf411da76184f04ab6db
-
Filesize
841KB
MD5a4c4426783073fcf717d79bec29bcdb6
SHA1c2b55928c4e79595770a81168a2c5da722474a4b
SHA256785932741ba423815331c523f2c59ab35768deedcc8fe4784f897e86290ab53d
SHA5120ab8be39ebc7d49a7964d4888b3a8f7a306dc368a7dce1c03b298471c8c91d8aa97d1aedc9b60fc9e2c4c5cae1277b3068144d6105a209db135fdb167203b9db
-
Filesize
581KB
MD5f1cdddf5454315e40206f767cc1f6bbb
SHA1420db6bca02be8f387812c179f6166c958397c3b
SHA256619fe9b10df1b6161a929e6f14e8202c2ac9bca65cdcc90767b1133a2bb8cb47
SHA512f651cbe35ce3d3edb2a1acc95273f76bb580ff948ea2a2e5d07429f33cc637805564d30d17cb6addd320d3943151b0f58d7f288c70267c168ad5eb8a12eac6b8
-
Filesize
581KB
MD5284d161c846e7edea80dff45de044461
SHA19dca7eacb215a37716b834590a722f106fcf65da
SHA256f7abff0c47e3af15f6c6fe2ae63968b5715293bb303190c23f2cad31e5221b91
SHA51280e1e198298620a45a088a4828cbece7bfc80a39ebbd3b9351cbd77292d2405c653baa16f5d95b4fe960263bc9079994e315cece69730e98f17d3e5c4a845d9c
-
Filesize
717KB
MD52764f45301865e7e9eb2b8e2a0d2d6ba
SHA1e1b29f7884db8c0e0abbca7f8d5744f9533340d6
SHA256461d18591b83559894c502baf53730ef5137b93422114e640a78532b53e82c37
SHA512b361859ecf29c5879d550597e949796e147c416012252e0736d0b930b3e2f9c5e8bb6990c760bff2dcb5b547d7321ccbe2759c8657f0ef601269721e703f1149
-
Filesize
581KB
MD50da347ed307ccbea1115c0882d68b18b
SHA109c92b613aab998ae1f92b16b9b608a632c05d37
SHA2567aa51d5e22faead6551eeac0751cd27bfa6babf9df3f92ee9c89029605c6c9f0
SHA5122c5b90fea38bbdc758d869a42bdbf791e4414c37fe7b08401b33de83d900377590419130f0518a09c223702014ebf96c7671d583addb60577e3e10d91061e8d4
-
Filesize
581KB
MD521277be71d93c7e94606f3b1321d5f2d
SHA19a9d2c9db590c0afa6ef974e34f7c0014d6952dc
SHA256552f68eb5ac59e754f5b236794e47af0f12e042d551163a7e36baa83b44b9115
SHA512752a441f92a916ecebc24ca23cc9c21efddab666b375ec0fb31657e5937803642a33e786f028dec8dc0bb2f86183384411aed34fa4c7eae6b8847087c2e9f607
-
Filesize
717KB
MD581b37f6e4ae3ba7ed4b216cd4d4cea11
SHA1bf63af4fc0323fa86903204a7fc515097f335f3d
SHA256a43b366e88a64b9cdc0d09d1f8ac96d5800f1e165ba7f1796c75124743bf4504
SHA51253be813d7ab221b80b56b82ae80a432b1d59e4a571f5322622dbceba2e065e337f5fdcd3f6d38e58ac48d6b33c18d5a4ffb469f21992cb7d7c46d3d82342cacc
-
Filesize
841KB
MD53656ed0210ac54c555d302a3f0defbec
SHA166cfd123d8b3836fc3a0ee564653d492c61786fe
SHA2560ea039e48bc05f29db451a545e90d546effeeb7e60ccc29c2b7bd37657cf6162
SHA51292a3c1292d8081b856a03e4d81ab480b00984d174ad7042e0a3d006f68f3a139bc7a55fc8343c5356b29167d2eee77aa0ac46e10582758d31c271813e32a3eb0
-
Filesize
1020KB
MD5063c743917a2d1e79c934debff789aff
SHA13f153a671b2cf3b436cc911d23c27ff2a6a046b4
SHA256526ea2670f1b86f270f16bb864f6bf11531ac5c53428ba2fff85fa42093cfae9
SHA512cd9a4610e9c44a7f394be5163268544b07ff66585b6bf760c63e10f7ee1c4ed2d32a2122a12e4b44e2def2d6ca578a8ead3cb5e6d93eb6841bc2eecb04155f18
-
Filesize
581KB
MD51a9e5c03f1bf6431dd96ca373988f7c0
SHA13befb5375520bd0741e0ff1d4c59b755ad011ae5
SHA256e301e198960f423d3d62b078d6ea056232d06cc7fd4981f17b6a713a3371c465
SHA5129d669b4f4785aef8d75dc3a22a22aca1ef6ff0161b399c7c2a12a503d18c8c53bf63092150dc6386d866955269e5c7a56237781ecc24bdc91ff47a3203c294c4
-
Filesize
581KB
MD5fd659f8682e32bf7ed43382f5c26b109
SHA12d26541bb10ee461379a14b5aba5fcb2dfef4026
SHA256e0df650b2ac63f487c18f2774351eca13fcf683b435e343761fddfea1d87786c
SHA5122bfcf3e85797a01c1a5b9adfafe2ab660582b09a55108665feaf1b508cadaf28c9165024d420cd424e019d2a15ab6be73de5a77b90a9c21953ed9caff4d19296
-
Filesize
581KB
MD5cc1f402826aad2859810812dddb1fb7b
SHA1674de8862f1b5b306ef20c06d445498f28c80ee9
SHA256a6a51b764d4a14faf3e6036bb17963d572664b402646c03abd47037387ea82dd
SHA5129bb946c34143e78ad2b1e3e7a9bbeba768a8e9557f59595cfe2d92c1d09105088fe3bcec3bd3330e9183bebe6511e1f4a6682703ae7e195c115a5dd264014429
-
Filesize
581KB
MD5dc3eee266288070c4387908bb8e543ce
SHA17c637a9b2897294953650bb47dfce5c68ddbbf46
SHA256fb05bb1fc5bd7faabd8f2b20a0b75aa05ee2279f739ad1154aa7d281aa6ca2bf
SHA512b0dea51250747b7e8ce8b73e73aa1ef5f17c9c3e40f677a18502cf18cc4ef2aa84d0076db7496b8b7f8afc4467baeda0283dfb0b03659d83b32f2574fe8407e4
-
Filesize
581KB
MD5d70e83c771761f9e711e134734bcdfcc
SHA1c8b8a61e6d78a108fea1f19a94e90ba51a708783
SHA2566a8b6c11f0dd5ac2e56039fd10261655fa155dcd484d610f74f0165977bb83d5
SHA5125ee4e0538fb39c1febab45e18cc04d81c13d15a2f9ee142a48cc805bc28ba50df3dec1de10100735f39af06f934b7f2b60529c5fe77347e844ace6c99a0b0f9c
-
Filesize
581KB
MD5702e3662011ba4569d9d8c2b823d9e57
SHA1a7d76eed7a2813aeb9b4a6740c56e84e38b91ce2
SHA2567f82e413ddd386cb86f2be52a39e3de7aa87a7dd1fc4d8e739514c9066f59d14
SHA5124c76caa325bc15250012cf8f403db6e1db0f935a7cf1a8414964e170545e71f23be4cd165231e4cc29b662f8bd0744013056a69a4e8486f07dfb16e4a6415ae6
-
Filesize
581KB
MD5e43bf95d24dbc2153d81c457901da705
SHA125c40ad96bef1fb19a9952e3f98b64f229e83ab3
SHA2566e1293e23991042716900dffa459474675bb7f71f67aefc1763fa98f8b211ac8
SHA512a879c4d7015210944fbd00dac4466e43a93ba7aede930a61f5598339927b4cc3725c977374ac31f1f233b0a6d92d60681e7f50b0b7f648c61d3bdfadad92f25b
-
Filesize
581KB
MD5aa0c47e707febc346261b9038955f381
SHA14d551ca729d15a3219c3723563f066492e5f5385
SHA25674e1769932d6a20a0e15d6e84b632f9cf038d79e9708963fc90325cf6a307ed3
SHA51203eacbe123c9cf482a30e09f69ee5dea7999284a4faca9fca35bb5d17d2f5a694de0fcaf281c21519a37330c0bbb60ef3f559fb1ec4c87882351adc46e229665
-
Filesize
581KB
MD5232133f1a632e99eaffc2c1be3515969
SHA1ba56a7a6febc2557e9c8dae4105e1aa40337f7dd
SHA256aabd7044669324a5abcc38c3aea6ecbe70e8d9f5f0f462adcf4d4ea7a546670d
SHA5123e37b350faf5ab9a3bc62e04a1428b0881696403b816b86a6d443eb48dfcdffe26c730498d8e329aa1f5e94f744d276ddc64abf1a5c9dfb274d6da62f359957e
-
Filesize
581KB
MD585d95799cd62f341f24592ce52994059
SHA10c68b20391791dbdc9abec5043757d91edbf1bc1
SHA256e961f68f7eb53990ad51244306eb6557429dee002a033cd65294ba7a481008e9
SHA512b8e0fbaea6205b49b7fed6b665df6d96b8a3ebda12f2258509d3635d3ed7cd4d8ded013a8f6606a3ffe65a5e83bd0a66b3fbd8fb17a73190c69c082f52b0bcfa
-
Filesize
581KB
MD54e3e6fdfbb4febc336093b932a19f178
SHA1500677d74bf04a157136eaf13d888280c1bcf383
SHA25680a791e01ce93eb5d0504b6a9688881467891026ae553cce6b31f1ec4a20d1fd
SHA5122f5200934b685065b6b7e40da92e805884a6d3a44c784302d3131948bce761fe473e2cbb2f6848ed13d87874b67976aab649a66eb28273787797d914369a062d
-
Filesize
581KB
MD5ec6cd4f86cf7c9ad1917f60a90417072
SHA1eed00d2e7279348afd8cca6f42076ad4adf5bd7c
SHA256682e6b3d7076c8ddba7e43e934e23c8c867bb8d9ce6926bdeeb57bc2b6fe487e
SHA512ac306691392cef5d76b292a10a874afb2874f3563bd99d1e70f0ea266e0e698faca9ef685274d8266ba186c6064ece37607b6fe64ede4906ace7fd4a25e9911c
-
Filesize
581KB
MD55a40f7ff6e939b8b5ba6f2217161526b
SHA15dbe3d10664c05dd3da8bb759a7e86af669f4138
SHA25643bc398c63ebfd97217c03f73125c103aa68b7581e2fad3ef0fb2ea9d1f0979c
SHA51233df935e6891aab3f46e51525e23d23bf21dd3453fe5a290292a204ad5d4ebb0e768dcae6b5e69e31a50c049db7280c08ac1339c07273a1fba27a1f50328250b
-
Filesize
581KB
MD504b51df93d4be4bf8470c5db820cb766
SHA1c77e900858ee2131c15376c6b102abae8012253c
SHA256cf58e68bfc71394066f54cd033a0fc23dc28fbc92e2f81f5a6c7bba09f02e6cb
SHA512694806284302a79ff743fe7f60c86a5a432cfd6c74ab7989ffe307df2ae7cde724b1cd9d7a84e3251f69dfa37a1586c42a7571526891ca53b74c5ad93cf3d370
-
Filesize
581KB
MD5b8036f11fe825538b6e94d51c8745d1e
SHA171eddeb89da6143bd211a16d6b870d39e74cec64
SHA256c670239021983ad34f7fa48ceeb965134082af792541d92c5652d7ee58467039
SHA512135d403a9d2ed3a74d594559020f4b4f55292ebd3b217df2225d4297405c3cccf178d2c4f9651707f3f89d66eb2a95a20753ce265931dfd44278f44c4b9d4a9b
-
Filesize
581KB
MD57c9673c1d3809940feef7a9130f6b224
SHA10127069b0137798ee9ba978d43b289a7298dc163
SHA256dc6678962c83df160c2dfc1fbdf8e9c8f5c2e599c7c50512c43ff83af8aea3b6
SHA5122711299ad8487f3b51159d46435937a7d34c11f0d4bbe339e40047a8297a48d05d5e39ed546dbe1a3d8567f987cb443d9b42d7d772bb3aa8b9c42458707ae0b6
-
Filesize
581KB
MD525a3ce0daec5884139b9af2bb4314699
SHA17085256ed4b3f76d5ae894325ff614f9bbfcde4f
SHA25685a2892ca2591ddb8ebd05b58b44f2e726af6f8178f7871550027690e87fb8e2
SHA512142ba4530a5d156ad2d6d3d22b9973c2aea646548cfc843d99d945f118fa0dcf42bf89c888aef6df765cbc0e1bb81050dc8e1b645588e0161f0bbee5cc7667c1
-
Filesize
581KB
MD5be648378109e224e4d8a1e45e3464180
SHA1e57beb87d69ef0b7b8db9377e41217e1e1c8492f
SHA25604b4d5e42e51f0d7caeebc444b7186160cf3dffc313ad90e01a683dfe150e49f
SHA51206c3fadfc10363d1c0e0bc33ddb46efc1dd0e57ac59cf522d7b7798465d14843be8dc7ab0a42927601f085ba788522f8eeb8f00de852c5ae14ab0246d2e5b43a
-
Filesize
581KB
MD53c37cc8d4bcb6e2961ea4f4f0c6a4208
SHA142273de12194dbb2826ff6eea7434f44b40163cf
SHA256f896702f557372412dca595e6464ef421df225ef30ba97a3da3b1aaa14f5de15
SHA51200abb8484673033b6ddee066d76efcc39cdd92376ccb5dac643b3ffd9bd947c92f25c6b7a8c8053211490eb476f4e1e33074757699ed472dc22eb4049d19289d
-
Filesize
581KB
MD55fcad22e871de4552b8fd854663352c7
SHA1ed1e7a68a1811a25313f527eb016630e792d1145
SHA2568d8b9ebe563de260177149b7f57f2c9e0212a629e552e5772bd77dc362b78d7b
SHA512fdf4ad25ba2678da33e40772fcec6094c4c63febef3725dc161eba0eeb47a73acac4202ef96681dd4df412bbdc3c7264a101a7a2cdac59f4f65d34a89bb508bf
-
Filesize
696KB
MD5c10d263b4258ae9699c7e3eccaabc346
SHA1e8ccb50e0db0172e66821e7f18b135330e823f47
SHA256e40dae62e3d393f2925b13dc49bca81a50bdc7f77b8e5639a18e86f1ccd29a69
SHA5121fd2636a758b4baed9a6a5020ca36dcd6df7b4ff89ea05b63e9a2ffa71c987d6d20b01fab9ea763871588bacfe8f80924d0646320ee8bdc759149959eee3ce29
-
Filesize
659KB
MD58a34d075803e475ee0fe9f243ea5f9b4
SHA145927cdfc285d39bff82bffb441bac7808228256
SHA256879061c957e988cbe04f0b9b69bbb9729d0c894072a0bffc92cf0ddc78776ada
SHA512a2429eb08cd5a327877a5716ff6e15461eae7c78fd8c602cdb3ca156890af45912412f5c510f4f937a96294945442126f1aec859ac906c0790af3996b1cb4d4f
-
Filesize
661KB
MD5cbb4d8563c4b813db006610c1cb9dbff
SHA122f87369bbc31229a2eeb780fead8dd91662e88e
SHA25640cba48431bc23322917beba3305d06b8bc9e10056325d601fa7d62fe3014386
SHA5123607c758962faa771df202a4b8dcd1c595c37cfc7c62d8fe8e0ca48fb6ad9dc2515c7308036615f775efac78d9e62bf19ddbf634c8db61392f6e276a82c7abaa
-
Filesize
1.3MB
MD546bdbb176d35e289b8994cf6f746cdd6
SHA1e153131980af806c21c2b1b24eb5d1bef687c6bd
SHA2560e2b8a850e29466d51f055c62b83f9b1723b908f3157f0c8eeb041476b10dbc1
SHA5121cdced7dc0017d08a6d9f4aa8a2c35eab12ec3cf6cbf20d90bb4a018c8f7fb45a631d39a5862635b1967ec6d49f64647a918f52de8db7d53acf3d8b72a9d66da
-
Filesize
1.2MB
MD59e18c9c42cd9972e949466d313cb0211
SHA1d199a26e36cceed0a82f58badbeb0973030bc1f2
SHA2563653fc550e5fa9adc23c79802fe8cef0783da82cbe99f46225a9455d8de4e268
SHA5125e49dc635977d55e6d6366b83eb977579116329cf54eb7ecb7ddaa0ca9115c22840d67dfdfb86772320cf5eb2989c13f08cfbd9a6e0f3079cbed69e57ea8d1b7
-
Filesize
5.6MB
MD581a48c6aa8c37c8028f3508ee60792ae
SHA174f0d0d38a37974f68377739b333e95c29d7f7a4
SHA256f9ab61f1eefb31b7f6fe611c53894301c3e6109060dccfc927b2494943e76a56
SHA512e3b1496352b5bfc15a9e8e0a3f467db340d744c5df347cf21548dadb0c2be2b40da33d644d46342747d3915146253feacdcc39146c364090a30c9ed0994c3d75