Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 10:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-26_966f43764b271361d40c7f193d55f338_bkransomware_karagany.exe
Resource
win7-20240221-en
General
-
Target
2024-05-26_966f43764b271361d40c7f193d55f338_bkransomware_karagany.exe
-
Size
677KB
-
MD5
966f43764b271361d40c7f193d55f338
-
SHA1
80b3f2e7a7e2e3683c053758efcb7c0a9ccc91be
-
SHA256
ad970f7cf64958f6877a8a116602a556a3305fd5a58a2f7c6a849e3529ee3ce0
-
SHA512
35a94cb0e7d16906558f29308dc474e68b5d1f65a5777c2e545a25bed0bc82ac60e62085d259fbb4d06ab6aa5c6bf152d8cc6ba33538fcd70c9dbb810db89127
-
SSDEEP
12288:7vXk1ZcH3F4SOpFjn04R4gq4HSUQH4WT65RShG605414IQanx8/6:7k1ZcHV49pFT0SLTQYWkK2u4dax8C
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3220 alg.exe 5004 DiagnosticsHub.StandardCollector.Service.exe 224 fxssvc.exe 3116 elevation_service.exe 3068 elevation_service.exe 2084 maintenanceservice.exe 3564 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-26_966f43764b271361d40c7f193d55f338_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-26_966f43764b271361d40c7f193d55f338_bkransomware_karagany.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\2364be6ab3e2edcd.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-26_966f43764b271361d40c7f193d55f338_bkransomware_karagany.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-26_966f43764b271361d40c7f193d55f338_bkransomware_karagany.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-26_966f43764b271361d40c7f193d55f338_bkransomware_karagany.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\UpdateResolve.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5004 DiagnosticsHub.StandardCollector.Service.exe 5004 DiagnosticsHub.StandardCollector.Service.exe 5004 DiagnosticsHub.StandardCollector.Service.exe 5004 DiagnosticsHub.StandardCollector.Service.exe 5004 DiagnosticsHub.StandardCollector.Service.exe 5004 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1444 2024-05-26_966f43764b271361d40c7f193d55f338_bkransomware_karagany.exe Token: SeAuditPrivilege 224 fxssvc.exe Token: SeDebugPrivilege 3220 alg.exe Token: SeDebugPrivilege 3220 alg.exe Token: SeDebugPrivilege 3220 alg.exe Token: SeDebugPrivilege 5004 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_966f43764b271361d40c7f193d55f338_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_966f43764b271361d40c7f193d55f338_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3220
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5004
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:5088
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:224
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3116
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3068
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2084
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3564
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:4412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5951d45531cc90ff249c6490f9c484966
SHA1e436be0a2303a85f1ea7dd08e44ce8c1087211ab
SHA256996f6d2c5ea52eb43764d8a47ff24eab079588521477367f3bac2791c0daaca7
SHA512599c4ee5d99a3c9dfd2b218de96011b086c71f9974b61fafe1ddd47f153f6a43c17939e43ad31aca9fb9c8a40a6ca2e6c2f28ee2b7ef31be5c3b7e104922a95f
-
Filesize
781KB
MD5dff185568df3745bb648d4e31fd40903
SHA17a2cc6205db2461a5792c16395a8b970f24e3b7e
SHA256b31ce88ef535ac383294f9fe4aeb3c720b9d0ca0f6ea21b4fe83ff2dbe6a779b
SHA5123ba5b502b3770da8d73e6c6db5aa9c5139dd08f7964edc74b216df344ee2a89cde43336f823693e028daec893dacd703a9bede06dfe53bad94798d6026964d8b
-
Filesize
1.1MB
MD51f1d52759de7d74204b796730f9d0172
SHA1c16c80a59bdbccf43493a5de2b236dd1a3793249
SHA2568b7d5ca6c722428a666538fa01e4d2bd6c0de1b5436cae137d7aff8f41effce8
SHA512046bc796dcafac3a9ebfc39c8e31f17efc47cc6accc897e880220c127257841300a7a16a67581dde951a1326217942d809bd941d34e4731a2dfe2ebcd7a6d32d
-
Filesize
1.5MB
MD5a23f4d0cbb4781adb85d36e6b3cc9843
SHA1aaa893312191649d8c79f401a8dae56f3860be7f
SHA2564003b4dac15c8978571a7147b10f4900b5fe51e3c6310fb02f26bfc12dfb71be
SHA5122295d18a6654fb213f586307023a56393e761a6ba26a9bc6aa363df9c0798b818614abb49b50889139ef3c9861f0a7b778a616ff4220085b8eb117f1c6f44781
-
Filesize
1.2MB
MD5731e304207a47580b7ca3d10203d6a61
SHA1e96b2d4f4464f13081e05eca70f5b95e967419b3
SHA25605df4e2e31502da0771b65276434079b0fc56e5fd80bc5873ce25fd802058dcd
SHA512e610e451cf2262115d968fe5a36e9f60995c3d31ce01709cda7cdd88e5f4125d4b3799aa1056101668cf51535e62955e1c7b8bd234b1bea0cff4437283b3c892
-
Filesize
582KB
MD52583b3cfd6e54e49214780258ae1b231
SHA1606ca11c44c643df161d706b0616f3fd1733401f
SHA25618747023bcb390a80e4a67c7c57a808e8d35192352465367aa4552ca28b577f2
SHA512bfa6f208eb00debfbac5bbd9cbed10fb8ce42634b4d422724bcead4b41b7f813b5ac885172216f2ab36a7165afac2c980c95abc430b34b5546d9ee0a1324ce7d
-
Filesize
840KB
MD530ee02d03fadbcbabeae93025e87f91f
SHA15ce5fa3f7885bed57703a60a60b5f965d4f3f1d5
SHA2569f6c362c2c43818803b99fcca1ce29c939c1c5101089a5b6e6a9a1a49cede039
SHA512a9ef3dce1039719995cd4fed434d463ee846f4638721ae89990f6934ab157e2cf51a30c0c1b2ef1d84187092dbfda26fa294f8656962a8c52fd7fd2670ad4bb8
-
Filesize
4.6MB
MD5a8645b93d415f09d44ad764c32053190
SHA1ab25d0790c65f5b22b4bfaf24573bee21e0bf9af
SHA25685720f67fceb525e0d57582787ed66f4176bf048b066a9dd9b453a3a620ae50c
SHA512a45f92fe871a862ba30f28808c0491ee91cf7b5a87010386a9c0f4e7ba4ff4598340015a773078b8dd75764a3e1ff013d4dbf098c869390b6e9f16aed3f20f11
-
Filesize
910KB
MD5cca7b4040dc579112b5418ee8160ba5f
SHA190657118010c9f8621d00c1e3a871d5f480312cc
SHA256b11f93f730ecb3c4e6c0c22c36514988d96d8cb8f212ae1bbaf50ad23dcfc833
SHA5123cd7c7a9d5e3a766cbed58d58ea43ee3bef8312e604b6f2612376a6708741062683193d74814da67b61749cfa64b9caf5ba0954fec259d137a655fa4a5eca8c5
-
Filesize
24.0MB
MD582c9018e607829f6efb5906c0bb40fbf
SHA1b552619275c3e7e663052d97b97d9b0c1bc93164
SHA2564256d06e5d313d167d0f4518889225440e56ad00edc5014f8b30670f574c4ae8
SHA5127884ede7c965b72c19686c1c9fd1e5ce690c330a80a9400ed7ff22d935393d8ea027631125abf913fdf941c60ea2fcd93e99f3995696c2174c00d9298a8fe201
-
Filesize
2.7MB
MD5ca9bc693873b94df92a5507d4b4da1bf
SHA128aaeacbd8c1dbfb988c60a99564e521fe3e58e6
SHA25610eb0d796ba5585abad2d3417e4bc0447267b61746bdb5d274af0c27bb3f4c98
SHA512c94707d3462c4e233e816ed0d1da14e368d6f3d5c4f92ad23fdb561b9d755b30e0ffe376463206ae497e632baa5197ae8b767f17000f8cd82d553443abbd6a69
-
Filesize
1.1MB
MD5ef976390f2303df96da9f172ecc78e19
SHA12c1f60cf5f1b010c328073e5f0bd5107a5062ab0
SHA256d23e8f289e300acf2b63d2971e4ae5fa00df9c26326d35a604e6313aaf7453ce
SHA512689d315640a322e12102b53fbea624cb1306e798ecfe4a301951b5a894fe82b692f331bf1c37b89b56c7bc71cc385c6ba50fa6be33c4ede7483f1df2c42c828f
-
Filesize
805KB
MD5745d240e2c10fa2ee1a60c8019c4bf15
SHA1edf7087679fe22b995429b295d68b8aa08ccee74
SHA256c33f84a69705557234043d7ecf61bf1af72f5999e9ebf63e1b480682586507e3
SHA5122a7e7d804e3d403fbd8600b5e85eca66ec8b4714da512347eb724a65f984e0a1329ee96283e02c3ca8e6552673cbfca14177382369d4f3132d6a904841eed823
-
Filesize
656KB
MD56782cfebe8723589f593b98e1273a403
SHA146f073b73640e484ce3d51dce7786460d9aa22b2
SHA25672cdb249c5871ffc621e653be0a6f03c3e8a0fb7a64fa8418bbe18ec4736488b
SHA512447b993264cb8ec26cb4a69e1e589afe7d164f4b91a08c0aa4244c7c1f6e799a80254ef3f00bfab1fd0134f351e9837de0a4308212be2a7273b00ff998bdd37d
-
Filesize
4.8MB
MD58296e90fdaa754f1910dbdb264ef1085
SHA19cb7c387a279c8ad97123fb5ab097f335aa01e97
SHA256094b8ca1ac0530359ec58a4cfdf0bc3865a1c14d79bf66ec2f5e7c2dd95af430
SHA512cbea8f25ba0e2a0215fc23a0660bfe876e713c89e2b3a55a7d09f9492f375d1827324bc64c06d02ff8b939410a7a26b7c26a98a6191a23ad7abaaab5e9077b8c
-
Filesize
4.8MB
MD545b3cbf1bfa3ebb4bfa27936a24ba141
SHA12fd6db1c92354d19f95ccac2e01eccaa1a507485
SHA25613849bf4928031cf8b2adbdae960f956b2de4dafc039ef22e65d113cfa30de1a
SHA512aef965a08a55bb22fd7438e146fab60294954c3cfead782cf2d776e80f815d8231b137fdf9956cc32ca5ef4180667e0b1466ff28f4eb5227c9a436465eac90a7
-
Filesize
2.2MB
MD5436fa8cbb11a90dd91ef7a087014ba04
SHA13fbc38ade1a50d6b65221b297446ab06055d6e85
SHA256769d8918ddbc25d460c9c998a736ebb6e00d0b39fd972b333c2dc6c7922fd217
SHA51250c878dbd212ed33ea55061360e76f3ef5d9bd2d8d22666677d6bacf200c88cc9e2fb20e45efc16a16c7bc23b707d1b8dd1b5dc9885364eac7b9c88d058e77ff
-
Filesize
2.1MB
MD5a7654e6fa1e14f9a02b936542160a5e4
SHA18892ce992c908fd3b4c31f6fd8b9e1b87915401b
SHA256544ff2e11d770e4f4dbb63d67e50f90e9f01ee40a3058979cad3af2600e7eb0b
SHA512d99f20efe41ced97360433266d03209317b341e9873cd4d3c9a5f8850193209dc4975ca9a7619aab5ecd63b36b68a21b35b77b7a1a8d07c44d675a097686e316
-
Filesize
1.8MB
MD5289781a236a5abc7e038ee7840fa6660
SHA145cbdab7ab566e4e54d408f24d0affe6104b46df
SHA25638e6be7ef0480f9a825291963a2734b810dacef262b13ac0595b30674c06acce
SHA512b701499e353958e2456c5c8559715d85da4157364ac13c712cdd474bcec87629c563517e9c5eb7664d9e848450b278a92f494fd8d6a92699a82356760d8e639a
-
Filesize
1.5MB
MD5bc90fe9711df183dbb0601d788ddefdd
SHA1b30cbfc335b17967f7e5268b9f1c7cd3f7274df2
SHA2568e89c518c022d3221e8a4722df8b3157129265d169f0600957191768ebe639da
SHA5128df2e896c6c769f0e8339add1fbf8e87e8d5741fcf7eea8fb7d17b4263d07ccaf644fe9974cea7686eb4b6915cc1d67db5ad96dc4ab4d5f53dc85034f5cc243c
-
Filesize
581KB
MD5083882194cd67ae2361693f18d193e0c
SHA1a090e16d06f372b97229d759f998272a9310be5e
SHA2562ee47a59ff3599a6262ee953fc924cd830b96ee55fdfee6b0760732cf50d61c8
SHA512e499229dd4e5a872b323507e5b531299f8dae53854cbe99c408f97901ffe23b16ada241b0c77708200b7d80aecf7fd3e93e94f3b408b9597a551121b198395a3
-
Filesize
581KB
MD5b68c70d0037cb9f6c0ec1da8d61b2e62
SHA1a238c047c6605ff3aadb786dd99ac4a0c6aa6f31
SHA256d27d68bd9af1501c156b951189c3ed047569c61928da11cb6d52bc7ab8b701b3
SHA512d9862ab0a56bd7b3cfeb65c018d919f815597b1e60326eed15daa65b3dd59f0a2e7943232934ce74239cd3f240547f2ba4bcdbe30918423a4f7f7f7277e95c7e
-
Filesize
581KB
MD5128452031f1257f948385971cc29fc22
SHA181526527418f164cd081f38e69e4f72c43f62923
SHA25644b2db38651b85be3176f7a1e765b2b937afb18b43d1e52702dfcfa78865758d
SHA512c993e79be90762e54fa1527c87ff95869ed0cf23c16a306e87c684778c122af09f9a5801cb1b67ba8ddf691769e94e2a11a0629ca9d2ea8dea1fad32d5c30de8
-
Filesize
601KB
MD54c76477caecaaccf4c56445e0824c46e
SHA1d7e9134a235a88725ed629e66c04d73d11c8e14e
SHA2567ec299791d91ae889c77c13f6139bd6e7aaeefc007413e0f50d7e9f26f88e7c8
SHA512bdc70f79992159fb258bda0f86200a2dab97e5fb2afa239e060f8321c667e054f2ed7212a31ab860d6238e4be9c2f466f79e4e697a61dbff6c405f6b65e6431d
-
Filesize
581KB
MD5de0b977f27786e7c9d40e16fc1a290c2
SHA1d397285557ddd43c41374b4d8cda742da0126287
SHA2566731245a89a0d3c94476a8dee9b420744115a4b43bfca9b853e575d114fe8146
SHA5125222e3e859bd70cd77c6471b82dec6bab073aa93074c0391492eb45a9e32d78b7444d80bfad0dc77d790584d0e0f95b7667c85a88b178448fb7b5c3e42d4b555
-
Filesize
581KB
MD5cced6d87c8c0a222a4e34c7a03fae4aa
SHA1760f5f0c38356769c2a2ff7a852e0eb79b1b0f2b
SHA256cc6d295c2ebaf903d4def0caf51add2743cd37801657ddc74991477f781398a4
SHA512a77c763ede0a75b572e2e32057369c569f4d13935d8da1814006f2ef60f3d2125ff438d7a24cd38885f168fe78e9463c63ff5199bf8102017423d360aa95aaae
-
Filesize
581KB
MD5ea2077aa892f2e4e5ff7427e6518f373
SHA1f1c0d398ba8a4c49078b74a0debc96796a80afb6
SHA2562ad69c9e8fa91cf14ee0e33289184b7f6e3f891776fb5fd7a725dc1bd10ef03a
SHA5126b01c4375e9c273d8a408dfb295420d46b8e485a67a0f999e69f7d375d0fe4204f8400aa629969accdf006162bf94df90d1ad605cea190ca2f81917c04a140f1
-
Filesize
841KB
MD5788198167e48d74808f2bab6f1a7577f
SHA1b078ff0fb711cdbe9cf241a7e8db1be0127a620a
SHA256be7102a24278bf597b9504fcdae99686edecc135a587f2c2bdb87550c46899b6
SHA512556d90fd56a33cf897726a816482187a00554f1db368526df7f8b18cf10b347496c2b09ca037b5610234b3404676313fb92eb94d216bf32465f30958c396f0ce
-
Filesize
581KB
MD5d4e77f5b2df1345f934fcca7c52e22f2
SHA11a33d8eaf8aa0ee19060fe613bcb77b89f89c354
SHA25692fe3494c54041b4692d6fdd1d65dd730217fcfa8b25dbd4dc9e9758436b4c7e
SHA5129a40be02c89a50e98070022423fb22599d34707c451b15fcb5369e4f868208759d879fcfb8131f0a8eeb4c8185e24ea9790287d545e6af4511818f8dddff75fb
-
Filesize
581KB
MD5a1ff77f71022e910c4e065043ae032f5
SHA1c6c7e1fb9ad061db94fbb891b8f607de5e64a8a2
SHA2568205e61a764f274b0108765b9520532c3189850ed6846d59b16618db2365e526
SHA51262ccee4f106f4e1dc7aafe253777b45614a4d0579fa83fab16ed4d0d8f46f1e52daf73eeb940d2d95727e4cb164de28876b22098baa18d16f453e19c80360b2e
-
Filesize
717KB
MD5b6b08d604e0695577efc69e6b011e5b7
SHA133311e533457f8071d4d9d2221efa63a311cec98
SHA2563da43a3cebab3ae86789333eb471cb657f01a39dc1de437ef98222c6b9b88d0e
SHA5122689332bb23efdf8bd6d6bcc9914c12ff98a5b0cac7961f5715af053c919a2f6228adcbdf6fa7be39f1885e978e65c466d8eb312b65c9fc658bc439de0b73a82
-
Filesize
581KB
MD5f20c8e7f742ec62731331d2bbef2a57f
SHA1d5ae6b86b78f40b4e8a22dc02a5ec3acd95917e0
SHA2568bd5b343e351a167fde1835e385b0695a4e960a1fdb05ae22a38654784e0d205
SHA512e8b004c9606524d09a706c188cc3bcf3984215d6770e04916932fc6a6fb7777b936d154bafb058dfa9a7a5eb37f014b05c2189371f65ce0c95d1f56257f4b299
-
Filesize
581KB
MD5659aed65c750dc2f25ee80a977c6f46e
SHA1820a6648fe0e2f3576d11c1b2178d087774e4df2
SHA25694b2faadc4b85d4b6a9b7c5f5ed1d0945a073e504a234c2eaa2329efd8bedeb4
SHA5128a521e628f61a45b44edd47895f78813ce4f08a37ddb7f142ca199f461e62382c281ad666f41d169e9d763212af1e4114ae34048983885bcde9439500dcad4fe
-
Filesize
717KB
MD548209956970f7d4d552802ff3249d8f3
SHA1fa0fd4f10f8e6f85e7205ef7f0233937dbb0a564
SHA256e8f73e144bb3a5d66cf2430c2a71c43dde5eda4659d9900993d42a357731d4a3
SHA512b05279f80978dc61c0b73dd8e2859c0c7ab0906ee94c8af5e19d76a74582fa0c0419ecf69de94587b867e6a52b3e7f7fbadb710549c36dbfaf40cc02a4597fa1
-
Filesize
841KB
MD55abe14b87cba9e79ab7a07a52a56d5dd
SHA1f5598a809c07672847ccfe0cada99e76f3ed748e
SHA256260b7cbd1f0b5ce90183b06e1c66767c8f685469e0d054b7bbdfdb9b3b0cd88b
SHA512d3d7e7da6a9bcf01b158922fb29252d294b23b64e2d745123669aa84fa71534a9048fe487ebc2b045a962aae0a46b18b516913571113163e900ee9ef3185f34c
-
Filesize
1020KB
MD54ac29f577d0246c504321d20195202e1
SHA186c2292de4706c39730f9ff1670be21c994dbf81
SHA256d70dfb2e5a377d3f85fd53b1f9eaea7dd6d8c11ad59ee776116ceb13b64cd3bc
SHA512f86a5860f67661a7bed065c849591657a6463b6970ebcfdae40b42986c4c5030354b2a796a5916de1703ee6765c7b141a138d35c58871a701600e17d8164da2f
-
Filesize
581KB
MD55db64a0aab6c6f18c9cb95a9dc0390c7
SHA11e4416b4449f7ac87f2c4a33ac1c711293336203
SHA2566378369807021302db3bc7d527645d4838724eb9a76c8c5c562f8662d49c9286
SHA51230df68f6633757c6299842f95841f782da7df052f92b7474c18826b780f21c1ed1dd0fa19efbc50542ed340e4c6c5a0056d6c972b8561d1dea6182db6fb09ab4
-
Filesize
581KB
MD5756e1f5557053e8528d14176ae36241f
SHA1edf8c77fb85ded994fefc090e16bd891671bc270
SHA25666f72ed33f597bcd5b2d9db61cfc9946d76fa132ed1ec84f7434415ac7943ae7
SHA512209fdb69af156d622b373ee4b7828a7289e58887bdc238c34c3b62af9b082662663e927cec7e3e05af95b4424262d6d15be4c3d836f0dcd3528b4ec3b1f6a708
-
Filesize
581KB
MD53d0cce01e1984b1b7661156a8a4f52b0
SHA17299f1c385866855a273b18e6177b32df2e0e663
SHA256b2d9d376ddeea2aa840c58b5c9d817cf8f30ad5122a1b9f10a16db89f201271e
SHA512d227bc5ae50081b5be56e6171638e3012302671385e8381ebc16d1bf8a209c678ba52239c377ed275d1fd930b2d5294ef62e02fd2bdd6af12b23bdec7653ad80
-
Filesize
581KB
MD53517d133d7edb01e85de22e2d3220522
SHA1526be7be78eca258167e045d1e8a25a0c53c9584
SHA256cc843ef1275ff4af476d5bcc2f799b7374a7463c68d8f60b8da568fcc40d2050
SHA512285c4afdcab5b7316d6420e401aae5a9d67f747c070b918f9d5ae6f7ea6ddd1fc43cac436e9445ce39e8f70c3a186e1e4c790bc90388955a9a623551d4ceac78
-
Filesize
581KB
MD58d14c75d2f224fa3b68e3233f2f418ae
SHA15db79dc7a5257019656cd0937c7bbfdcdf3e3a46
SHA2561670eed8239f195eb51659798ce044af7b894979b40e40394e12702ace4c757c
SHA51271977931ac4f1010504bee7f92261e42c7a4a6e6ae913a20c94e144ad10db9abf8c4d79a7b7080dffa98811c42b41873428aa314e4222aa1ab74e6bc2204f4d6
-
Filesize
581KB
MD5c970fdc39c80271becb5fd0b0010e1e7
SHA10b34152cbc17e754aa4ba4551572e815b140abd6
SHA25608e8047bf90b98b188541a83b3826d51bf14e8f4a7df2946b63ca16d4e1b4bbd
SHA51270e69714789b64da8b97c3fb40f2e0e1e1aa36586cdfd61098f04d6c4653765c09627ad7aa05d468b59953229174802c60cd854765a33499ff901e43856b0a9d
-
Filesize
581KB
MD501907ed3fc1090c51596fe59f0d4efb6
SHA1a5b3d8adbedafe130b6bb436e313ec6df27102a6
SHA2567fec66a51066e8c7243a7bc5a54649d04855693e117a02a32c2b0a44e9106d39
SHA5122edcaf597990fd9a598b2a8a6324b4a01cbf9f4c65b443f373c998e0ea51de0bb6583e0e8dc697b29d72690306d278acad8b869eb8400711f61cef235deedbf0
-
Filesize
581KB
MD51b1d9327fe3575fe6ac83118186446d2
SHA177945fe2210d095e9c6b33f043da3992ddeedc3d
SHA2566c8652cbbf92cfa3a87cda08492569baae3aa082119ad977685e06d62aec4389
SHA512f9ee987cc700c548123d33044e0767ee445c437d1d406c469c0f85fc7f881440d3c297ed2bebcb7f163ca00f9d833e8dd2094a337ede3629518cf8d109ce9a85
-
Filesize
581KB
MD5fd0d10a60ac19ffb3b9a2eb099a81fb0
SHA15e608682ece7a037766d999547be931f395113d4
SHA25659220f86fdf9e0ba292e12496c76981d6f243b704793550d5451b1b9e8d2a37b
SHA51226e3f8e0f4bba44bf9e18d962209d2686f5cc8f1632d0c5ad9ba0fea529604e6b1265f70598dddf19cf9ec2943b1a64a7de0fa0825c0c0b3e41531b2edaaf942
-
Filesize
581KB
MD581151d73be01a26d1b2375dad49a6e5a
SHA1c66184914ce2bda5f9fd828c4bde0ca08426c345
SHA2566b5d99f7eb9e19753cdf24ab7a78827f55bbd1117af73e06a4b73633dbe20e5e
SHA51249b0e770bc9d16d8a47e3d08cc3541d9c82b8054ae9936c2352215488fc01e98592af7b1ed50622107d521c30f1902a5159c50826b9e8162fe0186a57033058b
-
Filesize
581KB
MD5da9c6d20b512c81e263ab7f9bf4f35d9
SHA1551d42d396c0336f2cf20d2648cfcdf4c0d6ba61
SHA256a46945e108db26ba3c72970b30ef454d80f08ef5668dce60571e628256b9ce96
SHA5125ba12f17006a9c5a0f876195d9f514dc41a9ebcc330ad9a97262ef50809e1029c54b664b158f55ab98014fb9e6f49b31b947467188489e91d29406b8cfca75d6
-
Filesize
581KB
MD5b3b0c78c4978200ccb4c412da016c935
SHA11ccfadf65978cc2d856aff0c23ba188319499301
SHA256467414b3e1996e80be5fa3784b54d281535f4e59a15987ac77f507d566aad1aa
SHA5120a556f72f4fb8a0ca710b502ffd7f7eab94d81e01642a36d60ae91b3e840d8a2555a0832abd7940ba6f449823e690266b717afd6c723dfc6150719cc37b4d6cb
-
Filesize
581KB
MD5d054167e88b7e1517a8640f6203190ae
SHA124064ff97037b82d2ae1c1dfa47fe7cb210fa4b5
SHA25695e314b0aa02b84c940404e8acbafd01ed6675aa1f38edd85ffa30a9d342a458
SHA512c017e7e3c6dfe81c631db5b29156e5a305b1203ffde8277e1025a28c50ef7c6c267785c14a255877151488a87c9f50effff593b9f2b698d0672b0b0c154c9321
-
Filesize
581KB
MD558ff52d35315704716bf12e68089141e
SHA1ad389ac3d42c6ea68d94fe6903c97c8f105790ad
SHA2563f7e231c26f7c677243b37bb73736622fa15e1d178cc47332d75f408ac8953c1
SHA51293b73bcc0d434261fb8abf7a5d5762a33386f7f2720fd43b7d306dddcb7b435291fdf09e823c328349e57f2785fc5e342c40fbc48d2b94c4311c4c5aa36d3821
-
Filesize
581KB
MD5de622d1a512197a3ed1b3cc0551d4e07
SHA1fb74110fc9e47b920e51b118e09a01bc19c4c9d3
SHA2569836519f3dee620bf8b96c23118d41d19836280b4271b6ef26fcc7248cc892fb
SHA512efe635794340356727c313a49545e515e19758b265b9ed28b10b2e543f2a428d694dd8ba74ad050a27d1b6e8eafe6c0c6dacd1a120fbdc3e0e82645dbd1dc248
-
Filesize
581KB
MD5e1c9874e3fdefa54bd206174aca2d631
SHA1944d0b24bae18065d66b528c31528c5a21b988b9
SHA256421f2c27908abfd9cf4023f0d67a8a116a7553706e1ccf022ee63c19468202b4
SHA5123feefe714b1dcf967bfe083ed4b2b82078de50d8de58ce6b11d8345c107c29b298a9c318dcc7eecb17083e9d7d70bf70108a61ff4e4243390ac2578841b1cfc9
-
Filesize
581KB
MD528e99c92d0896d9e41ca0484624f2a24
SHA11ec26d2cdd2286261b5d27a23ef0bce58fbfcb97
SHA256dbea678a560c5ba57e506fc3ebea00784d17fee3edc8eec63e60f40e4617fb2f
SHA512447a0c4ca55cb7857a6112bfada08951bbffd22f8828cf0ccc24d5088b820ac853163bdebd281aec58f26de11ea191ebbe45608fe7ad005a7e5476ee9c6162bd
-
Filesize
581KB
MD5663f9fe13b981b2eeb3e197b0b4bb3f3
SHA188a5226b5dc1e685d9a4aaa1d3f681c757693405
SHA2567d7f2d5813d27eeacf7ea0bed7ca837dce4d7eeed74714f1751b0b0512f106b1
SHA512967b692c9277de1e1e7820404ec57c4615ebaf39cd8409c085721aed2c458108421312a62a0eb8ecc45813c7a4fd3f65793e0c49386e07a7465b65fdfac5be9e
-
Filesize
581KB
MD5c0ef13e0dedf817887b7e74d5afb4861
SHA1d503673184b46b57c025e9ce0449f3fb31cb8062
SHA256736a203ae8706aabeb322e75ce4ba7815a52229eaa06c7869c30a891ff8c6444
SHA512e1021269bd76b6d903bf2a4bd69ddddf3be078516d9870252cae1441be76059398ef884f471878cc0409f3441686e4c959932785a9985f8871303024d38b778f
-
Filesize
581KB
MD5e575df4d1e4bd519a5d8978d37b2c213
SHA19dd4fc9fd49803c6fff20a332158461b08dcf677
SHA2566ead1d04619822f57580ef6db24c869f2bf5d5493946af4306a5f3fcff0a6954
SHA5121433a8df5944486489c57e071d2091681f5e4031c1e0e67911b27f40a1504bb75d0196bec203a6d7e626533c74b59bf5eb4af38cf00207330d5776aedce3bc37
-
Filesize
696KB
MD574204b092cfe306d7a16ea6c3d8286ab
SHA16597019a3441de94a416715486228be039d4c6a6
SHA256f36dc2dc58082f96a546518af9a8da81b78eee7f4e759a44a07e23fb2f85525a
SHA5128fa356dd43b564a4e9ec3104f39aa2b6215310b97e3492656e97257ffd7f565a21d2b69be215eb9773295b8d23fa678a832320201d699c82dfdc2644dd9c5c72
-
Filesize
659KB
MD534a5ecfa3ec2ce096f471a7707f55e5d
SHA14f93613a66216fe29e132d0a266b24c1121ef580
SHA256b8c4b1960536a9665fe477b6612992f115127eb7ff916bbebb6b10204a25567d
SHA51212d9cd171a4d463b17bfda88c158a57d93c06dbe7c2e6adbe8dec0f43b0856a59256378067a86f86dbf0e072e166e55ab096c51bce2d45b034f0b148b7723523
-
Filesize
661KB
MD512aa6053f8adc54e39d6768674820ca1
SHA18363c27407175b3ddd6f901712e040ede244a84e
SHA25634f1c82008075850f897cb1a7f3771f06977ebd60e9193d428419b81a17ef74a
SHA51233fca249f0644382972a954103a743dac538bb057a506cdf9de0fb00d2fe8ce5d92e3048dedb2347144ad909c1a281dc23f6346233f4b1235a481d180a12e42d
-
Filesize
1.3MB
MD5f27baf908672ccfd81d2097cbb588991
SHA14650f0c0cb0f9aa7daa21342027f654a602c0140
SHA256e1aee7f059118dbdea641d4caee769d803f8f444d997ca42997fd38bc5599325
SHA512e6f1e0a3c68f161787fab58e80b683dc1aa2401e565a82de29a790fd90628ff79a54d86f2618cfdd78cbc3681b03fc8c3c22a04294b576dae2da71af9bc130ae
-
Filesize
1.2MB
MD5766e6652b058c68cec77b16cc3b0d7f2
SHA1bf883dd8785d9e1bf3bc3329e9f5d075795ab9b2
SHA25663e050b8cc1f1497147a801a3d448bc1c18a427b15fefaa8ad33432a2500f47a
SHA512426e5001a2173609421a3c63f0677311d42b2760c3dbace9cdd6101a6555962d4520cd57adf1028f413eb9ae2d5cd59a3ee9f15c507e6e65f605dc2b46debb0a
-
Filesize
5.6MB
MD538d4dca4bd198c6cd89913c0a6b6ccc4
SHA15bd07e69a4bcea7795a45c6f75bcfb4a3002a785
SHA2561aeff8a14d0260c3e3538006dcff86a9ecf63c797aeba94b5eebc870796c1bf1
SHA5123b89e20ac42de9d945c8e8e9d1bb2374774d7dba507352cfa885a1a2118cd49a6afb948badc0fb6e00c603eb0cf87cb59ff0f5358fdc8e33b1d0b1d985bc8710