Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 14:40
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-27_fc203a36690b5daea729e6a98ad23296_bkransomware_karagany.exe
Resource
win7-20240221-en
General
-
Target
2024-05-27_fc203a36690b5daea729e6a98ad23296_bkransomware_karagany.exe
-
Size
677KB
-
MD5
fc203a36690b5daea729e6a98ad23296
-
SHA1
ad99d82ca47dec0fab23c8efee8c03a17eb44a70
-
SHA256
233634312f68f3ae777f35a560145b5ac114b314cedc6e89941c923657bbac9d
-
SHA512
bb9cd78792583f2365734158a2806204406eb806d142c88964e0d4a2280edb35d952a7e282434917d99ad6aa93274dd30a5619c4790f2b8aad54e61a4c8b4ef8
-
SSDEEP
12288:+vXk1eFCrNDFKYmKIiirRGW2phzrvXuayM1J3AAlrAf0d83QC0OXxcpGHMkiM:Ck1e8NDFKYmKOF0zr31JwAlcR3QC0OXb
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2060 alg.exe 316 DiagnosticsHub.StandardCollector.Service.exe 4128 fxssvc.exe 4700 elevation_service.exe 2160 elevation_service.exe 3500 maintenanceservice.exe 4088 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-05-27_fc203a36690b5daea729e6a98ad23296_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-27_fc203a36690b5daea729e6a98ad23296_bkransomware_karagany.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-27_fc203a36690b5daea729e6a98ad23296_bkransomware_karagany.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-27_fc203a36690b5daea729e6a98ad23296_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\20d20cb44a48edc7.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95203\javaw.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{72342474-B513-4DE5-9360-4F37AA503DB7}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 316 DiagnosticsHub.StandardCollector.Service.exe 316 DiagnosticsHub.StandardCollector.Service.exe 316 DiagnosticsHub.StandardCollector.Service.exe 316 DiagnosticsHub.StandardCollector.Service.exe 316 DiagnosticsHub.StandardCollector.Service.exe 316 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1128 2024-05-27_fc203a36690b5daea729e6a98ad23296_bkransomware_karagany.exe Token: SeAuditPrivilege 4128 fxssvc.exe Token: SeDebugPrivilege 2060 alg.exe Token: SeDebugPrivilege 2060 alg.exe Token: SeDebugPrivilege 2060 alg.exe Token: SeDebugPrivilege 316 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_fc203a36690b5daea729e6a98ad23296_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_fc203a36690b5daea729e6a98ad23296_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1128
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2060
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:316
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3604
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4128
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4700
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2160
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3500
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5af59c567c6a22700808bfcc56d6a07ae
SHA1ccd68a6875475cc9d3fadc956b837041a107d99a
SHA2565d8eff2807c987d4cefb851b2977f72b2eeb5c444948ec0bef501a20ba7515ec
SHA5121ee230b181b45f9aa56c047cf6ab5768b1c87abcb74b612e13aaecd9f98d8df606f5cd61ab056a618a685377ab8b976fcfe1f5bad32587d036451585cc01bc46
-
Filesize
797KB
MD525b17cd67c8ee432c297501c9e0d9281
SHA15e7555124785b316472eb5c261b328c741ec7699
SHA256413fbb3f00babbff59cf1030bd93b1ef79701371188bda0b42133ce45e40887f
SHA512fe98cfd91f849dac9c4da5db64a10153fa3b07c7746af75727828b1eb9804fb3ef19e954894636eb3b7418e835a7e4b227c7754081ccf8cd5583b5614ab257be
-
Filesize
1.1MB
MD5f8c169d34bf794ff11564df05165475e
SHA183319c3d161696bcfca1ea066f62e92ba19831a8
SHA256b097e6b1a9cf6e9d572341c3cfa959333797ff92c92a15507eeac6cf3dfdd6a4
SHA512b82e82d31facb8a102fa386b2809f3f4570bed897ee07dfbbce708fea721ff53c45a5dfe8cebf65c1433c097fd3491a6f490cb2193a9a142b8ec3e32f813c9f9
-
Filesize
1.5MB
MD556321be7d7a178523ee63381788076ff
SHA1624234a9b6507471bc42489841c92a50ef58d621
SHA25659f6f1a66cad07f2e00d446a6f4797b060330352792f42e2ebdf9ae34f730587
SHA512706fe59ef545b8b56dcab539d9c591ecf1a4f488ed5727c7711b3adcdb9f79d799c989dcc555fd542fab9af49143b544c433dad9b76267a6a3a32ca25eccdc95
-
Filesize
1.2MB
MD51c6955e540b89b6f93b42e802c5ff923
SHA1a3ffb508746ae35e57b3c9219d705cb2f23c105c
SHA256d23076fab96b08db89315a6b42bf459885c301c08d1920d932ce67b817836168
SHA512d75d102b6de257874a80401068308c61769b169adb920315c5ef8fcd018809fb356d081143863004be3a32e8c54fcbea01def85d6338d9f7db32faec5b504fa9
-
Filesize
582KB
MD565e21bd2bf931c1ae4c2a9554a6c777b
SHA149664c44aa38ff1cf91374b2647abcafdb7091ad
SHA256e24e64465537abda77933a3f3a9f3548b8944d2bd347c19b91fb3d76f944c872
SHA512b12eb3337808f45d0e107a15e233645cde9cd142b6c8e68674505e75c88fdfebf471c7bc214c98566e423a110e014e1c05bb901e4cc53780dc70533179620a6e
-
Filesize
840KB
MD5b20d24851abd364c72c2c3523f328454
SHA133b2dd51fc91d47368486b202773759786438720
SHA256acaa97da5be8700f68e66145e2479ef83885330960ffdec3bb69a6226239152c
SHA51226195d9ac18e47e4c1b3b5229685009a924e5f0ec8ad2e4adb9c390fc387e1e9639c5c9c7c0a8dc26c3aa90829320a910ead9b03265fcee17a15c4fa458a5416
-
Filesize
4.6MB
MD5f6089a9946d213e70df6f55b2ba1df0d
SHA136656d1746a3ca214296249f70c10462152dce55
SHA256a69a576ea1fcdbb9f770afd726a6d96fb56e4de4309295c3e6e68665a5a15c50
SHA512bee14f81452c186a6354840cb0a7797bb290aa90cd7f5092ed2ba73616eb7f5dd3734f6a856223575083508659f57040a92143cfcbc04594b7d9524dd3f7d436
-
Filesize
910KB
MD5a7e33d23cba09438ddc22b76a948b8fc
SHA167f3fe457153ba1c320cae25d364922e0a6558fa
SHA2563486a5ec7586a32e196816fb2dd9b9dc0d7ca22c917df6d15416ce68a5c5c5f2
SHA512c537ead3560229b7a57ce46bbbf7d88a323034080466b62f2e2a8a3726f4a4fd443cddbaf4ed04784d9b1c5dea3ff45366903f8c42a6b42169b312e797df75b3
-
Filesize
24.0MB
MD570f5e3a5aa15b2a0aea3e512abbffbdc
SHA1c9c47c314c058874c32683d8e0d8e0109d9ad67d
SHA256c7c4368c4e17a359a4fae6175cffc3665e1c68d844ab8ab7c398367ad2ad626c
SHA512f81b18a764d3b2b565d354de5b7d89fe430c81ea2e5b8d55b76e81ce90a5381d80e09be26245d5e18b225ac0b12eb8cea8e7e91504222c3988680b0fe9392c4b
-
Filesize
2.7MB
MD5b490f2fc6a8e9a203772e2336d16d47e
SHA1d84605a99fe9e173c42daa5c12a04d50e2fcd4e5
SHA25606478f3f15f8c0d6f27c236a3961690d17dce67ea3bcf35706f19534cc70bb2a
SHA5124bf34f6f24132d472e03f1286f2a3d24d75956fcdd1cd0b5579242f30902dc3debe53aa414aaa4544a966b2999e72fc0c9dd9d87ec8847356231e5c6ffaa186c
-
Filesize
1.1MB
MD5465fa650515371920f278f2959739316
SHA100d4d55950b7c49c9b0209df4b1767fced09e02b
SHA256791fd5309216e370fef9481c78bc6dd7363ba222a17bb517844b6358ad5f8f0b
SHA5128fe69f192d282c2803c2cbeb3020f5a080e2a3c2c74162ad96a1cf40cca3abc44fccabf25db12214d6fe20a0c09d3e1aa99b6cbf8789e25040f08e7ac1868f38
-
Filesize
805KB
MD5a28cbf3ee8c8e359adbb7b077a17a527
SHA1d69676eb847b06163dfdd2e972c926ef6781439e
SHA256cf4cad7ccffcaf1fd623b2c0c8e9e25b08560d7913ecd1e9e7d6798bcc120f7e
SHA512b9b278782631b00e9157dbb5bf5ea06ceb2a409ed353f42f969271dc51675ab97793cd2d9e81e5e007843a5c32b679eddc5268f99a0d8dd014a402e70187b1a4
-
Filesize
656KB
MD57ead0a35b23f33157f2d52e8ee7229b6
SHA1760dc817595b9236ce1b02226b19ed827be8dcea
SHA256bcd5137a40703aa5259debae7d3f9b5a2a3fb9485b57b4e1e2accc8f4978e6d4
SHA512b2158c7d2186c89ccdb43f0d475f7f424687f76dd0b0fcfd3af4078dd259ad6ec85df553f88b61967d2a7c7f0d8b0de374b83f9c08876ed559a7be9b24097761
-
Filesize
5.4MB
MD57b8b12b78f46079895be9840b176cf71
SHA1dbf0ecf5520515ca1095f3e4026da178316e37f8
SHA2567b7bacdc4b3b3536188ad08788043ccaf65a8d2f2d037585febe0eb617168d93
SHA5124122db6b96342a4a0700947c7089b2ce43ca025a6a9babfc03b45c8ee9af3de8f1a79f05cd688f5c8158db35534d2df6788b5d1a0b7a0c11fe9da84962a32a38
-
Filesize
5.4MB
MD51746be58a15ba8b528460e1064a3a8e5
SHA18432d702874e967e7ffe930200a754c935836ee0
SHA2568ca631601b4edbb5c14e98650b8a8fee07bdf9fae3261b697543f07ef6063b19
SHA512206cb15460afbaa2a6576427f27977c685996e1d76bd5e7c74ca7e8ec5860c065b2c9d71e616ad92d2f349a7d5430385fa0bb58da5b007ef3f224ac2d1bbbd2c
-
Filesize
2.0MB
MD5cbbfe9b991d51eabd8a2c3cd356c792f
SHA1662789c5066efe76a2b18adf7b8f68541a746753
SHA256e98131b9ca2a07eebbaf5a4be336736e49621cbcf22e7b12d94faefe7ddb06c7
SHA51285935235040d44a356bfbd3ddb41dd0976d64fc1525dbbe83207c3c82d8aced79885ae693389b815bbfc7079f9262bfeeb3a1b3b677b6364b84f3104a7ef0ff2
-
Filesize
2.2MB
MD5aff3ed60b023d4e26f45f2d26c2d4234
SHA103dc230e41fd988150f256400af3494fa10c31ed
SHA2567c5f722196b5091c1e1a18a7062265cdc797882da2be57c65c2b0efe9b169105
SHA512ceeaed4622c2d2a5ad0e49c343da153561ddd621d04d773a089e1c6783c82dd3ae6ec6dad43b77db119308512d735193c21ac88c1d9138695369a05e449d22b9
-
Filesize
1.8MB
MD59dfb875e2b8211d807e4ec0c85c59df7
SHA1681f69ec670f839cafa28cecd3553ed7bdf307de
SHA256378291ab3f0481ff12ffa0c540eaf51d6a0df9866675cbaa7e3565dc1a9f9679
SHA51263aafeea8e4c197e78dd88585ca478bbaa4f876f86592d6391c430781a08f902a879d7eeb23a42a83286f8fe124f77b3b9c5cfd030b3ca8cebefa901f69c056e
-
Filesize
1.7MB
MD575c53df1c00172ba920bc387370973fa
SHA1ec4346eb85a3ea7b1a35916824a704cf0c721883
SHA2560d2e4afd149d6aa2021f7fb27455de3d12e0643cf0ede75f6f01d4d857f1b3e7
SHA512d6852686fa8de7e2f6a972c04d08af1d052feeb948bb458bfef4879a7ac0bb5ea0c0a438f3c84969a5c184c64be76d0b039a00363e5bf2a2f275b7e0ba71dd42
-
Filesize
581KB
MD578134312fde192e1a4adc52267f254ce
SHA150b50a8ea907ac67de156c5d3b21291275dfc952
SHA256d9aa4ff5ec25768d2faab0f5c33774bf08fcf16aa4aae302539d7a1a3639b236
SHA5123624d92544cd19ade870e25533513ff452977e06b80f7c843d7ad3d1b7eae6bab0a484860a01d55a5bf47f25e3d2521a6749b00e2e2c4691d9e30fef23df49d0
-
Filesize
581KB
MD57733c48edc9418caa0d6c80c8b85cb5a
SHA1abaaaac2b8b3f66ad289de5958b6bc386a14fb65
SHA2566abd4d025dcaf9817c2b97b7aab61a655ffb84406965c8ff3cedbc5f0aa539b0
SHA5128c8ad4221ee1c97f324ee0dabb5da3204c2a520e2622337b59bc4f6f66368ba9110a5eccb69f7d7ef48991916cc9d398ddf5ef7dee8221eeb04c7ad2a63be83b
-
Filesize
581KB
MD540b9950b2f779fa0a65af8e788b5b901
SHA1359de1b749b3e0352302c010bf26d9813082de30
SHA256c9b3c988596b73086f7d2af8ef23fe80cb47bd078c1907c55bc37a9d0104cc42
SHA5125140a551d7f4daf5a1a0313e6b82629218d762dc9cf3be1237fbbcf17d3ca904ece1e52342dbcd0cafb119197d92d59d43c9d96e62590446ff0bc439192abc2f
-
Filesize
601KB
MD5c1ad3c76b5feac9bb419a5a96c2bcde8
SHA1bd827a881236c12591b3a0f7270462368cf84d1c
SHA25620ee79acf869a8db11eac349e2c44834becbfa4745033af0c3a25df55dce7cd1
SHA51266db54a674d143a803953a14638175737ac9c887e8d0afcbe9106c4d5893066e8ca872285870598f211cbb5fe98a292289949db296ac315914cb91387ed4a252
-
Filesize
581KB
MD551a8f2b5427a698e6a1f66384ee192f1
SHA18305e0cefdaa3906fd3f2c592eae6f12e53d46cd
SHA256b5b0b99de346487507aad24689f72eff42991fa1f9f33ddb1f233e15c90542b2
SHA512efc5b81054e94602fc4b301a5a4578e01baddc6c4a7521e69ce3c22bc43985f84a5289569ab54985832049015e1c34d3182637b1396bb55f1c78b8c373b0f0b4
-
Filesize
581KB
MD5a9f16c311bc3327e1c2b6a6a2f19ee43
SHA18fc75895d54f2d73c20b0a7e79339b5c1ea44207
SHA2560cef20646f5fc6702ab3223285e19a29450cab45483d0663ebd1c8393550e725
SHA5122de5ab168af6fc0c28b826db3a6b15ee667861e38f8e8b526322c90b5bb62d9a9b275060fd703d0ad7327c4ba30ccf9cabac8584b4296246694a0ed9e8a7bb0e
-
Filesize
581KB
MD576489e71b3d5fcfdf996c43e6244db4d
SHA1b8c5d28ff7ec310c23cc7a0d02e41318a21399da
SHA256bed42a62f14d13071ac2763216b0e2547a256fb5d93eafec7d0bfe1dc8e6ae6f
SHA512302171063a8871f32d5f96ea74f79c7137507e900d791e0e3a34ec019e0bbfc98f1e5616bb89950db55efbe1dab81169638781560a286a1c230b495f97f991c2
-
Filesize
841KB
MD56819a2662f49a7fb49c1d9837a47afe8
SHA1057b1c9661e90fb2f447b8e596353da294aaa71d
SHA256f515749a06f4567ccd3cb7ab077ae4d1a0c5dec4f09157674536b9deaa6a2ae9
SHA512e37e2a3272eaafefa62360073848bbfb9f654deb08a79c8b0d760030a0ea1c159e5f91cb81c50f8465759b163dabecfa6e9f2b72cbf3abbcaab040a004b58a57
-
Filesize
581KB
MD5e3d2031fcb90a4a6c304e4d0ae42d787
SHA18f2fe2db6981a63c48b2f5f84f68e979ff781246
SHA256b1e92d8ba123e9c0ab9ea1ffb611df8c5c255fafe956483e286328b5f01a21df
SHA5129316a94af05688f7810537b40884ea9584b05d73a3940668d6993b95b5da9d832b0ad592cd6a2d2f3f93b4dad8559c9611bef4cd84e9d8044cddda896832d4f6
-
Filesize
581KB
MD5450bbaad7bcdb3f5125c4e7f763e1e49
SHA1b47f7795d22809dcb8a7fc39b8a390a0bd6b57eb
SHA256bd5c48289e54a48987212e6f5934932f49e54e77e9bf1ee6a4c5984a2d14df66
SHA512c8b78bd138808b9607a998e4e2d9f1083ef7eeae40f6dc3f1ccc46e6dd776d16014e9515144c8197830e4e1298a4c798d78837457970b9bd943bf327e35f9afa
-
Filesize
581KB
MD534d489ffcfad4df252b32dbca489d4af
SHA1fd2abdc34837da7d73b6d4acfe7dc4fe0fc56aaf
SHA256c35d489da5dd4d27df62c544df4301a9672223ec14966828fca9948b4e208055
SHA512559acdcc87c5860c138a26db447ca51dc767e253c1aad891351a0d69307795b1720fd40a46b9ba42549b994d71144145fc5354eb7c173a72a7b79df75dd4328b
-
Filesize
581KB
MD5ee20550cc15f7ea5f43de094fe6e7865
SHA18554150a22438e2a940156b45bb611e7cf8c4f8e
SHA256cdb9caa3002a06f576072817d4d67204c13a2b38caabdec8097cbecadf762b11
SHA5121a8ed3fda5131ab9ae018287113e81f4cb294d2590664e018fe073fe398457f0ad91200e5c3fd6b73dfe24043785cd1a159e592d4c5b32fc73196b0eedb4e703
-
Filesize
717KB
MD5f29b629f32c4be9425dacfe4f9fc3b70
SHA1dfdbd42b64614e4902853772a8deff841c4c915a
SHA256d8f59d4914685af8eb99100cc1d496047962d21fc089c8fba1572abf4f3c8084
SHA51289b726a03045107714058c1236e1cba162cb00a351bbad101b5fb33e9fbff16a1b3d0008dfabf7c4fdb7c5294239616ce787457a689ac2459d55fe1c98549173
-
Filesize
841KB
MD50bb944f3e24dea2de831ec58a1a82ddd
SHA12df5ea37e62ddf415ee8406baaa9c07ad281ada3
SHA256f5e1e5c46434729c207befebca45597dc084b33b0418d9e00b27a56805a75813
SHA512108861561fedb9f6ae8605355dd788f65c392a0e73493dd64a1a0fbc2f269e61a46bd797776cc42dbf30212b3bbe6e3b27b58950eb4407fcda63c28a6170152c
-
Filesize
1020KB
MD508b810c926652fd6137312bc52761f35
SHA13bbba79c8c516a665a2ac14fc3f67f687fc582cc
SHA2567e7e0d0aa6aba6bf528d66a829585ac26dda211d799243d304392e975cb423f7
SHA512921417c59215a41d7b8f0d124f06fd446ab251a1dc68b14ff4963e026f3bcae887ce1bcba3ae3467388e6a82908c577ed61b6f235c2eb298b0267b0e380ad30e
-
Filesize
581KB
MD58af4f6dd3ddc50519f6943ffdb4c2578
SHA16f42abd9c9363e1d934a602e778000c7c6924a58
SHA256471266d6dfc9c3ce7d0195314f82b8096b2105cc626887c17d54a398eeb4b83f
SHA5123e7efd0ca7ee9a1c40607dec638fc1d5bcd9c93804effd8d4214187863af4d22975892fc399ed1d2fa9b59f0713184bd39d8bf97c49ced5356d8a7058490016d
-
Filesize
581KB
MD5660129b1e97fe34ea1adb1c7f6983705
SHA1a9c3cd3932371adef95f40fce60916758866c71f
SHA25639f37c64e190cce21d43396b5c055973d7027d0058cc5808138d7709107f4503
SHA51260231642759f19639cd7d2682393d06fe6029813a40352098545ef1c382a6d3f57b730497df8078769709dedf95878984e82848ad1015e6a6c37e8e536d14f54
-
Filesize
581KB
MD50d22163bce5c88a107b6df2f57542672
SHA1b4ce7d1b6855d9799c7d92a24e66699cd8da855c
SHA2566d60f99d84dfcf32f32c2491fa0922b480ce3d5da6cd03da5ab982e8487a775c
SHA512afe541bcef08d730291f82275fd19da42603c3b5d1a94528ac31d0e94632f9fab4bee8271bae702ce5fdd55f98ce4ce9f87e8aa18b5dec5e343c2a5fa322b61e
-
Filesize
581KB
MD58a15f1a955af4db76456f922de1a2fd8
SHA137685b7f92b34f56c2addda83ebda6de052efca4
SHA2560d3be8874fce3c8a12e8844e8ab4b05fbd3cb29f437821fc30ed0b3ffa815e59
SHA512206e6c72e3c65ef232d80e76406db2a328b68880a2e2ba4d94b103d2a463503aa29a95bb77c390750dac94fe7de5957c4134adef0986e714e2eaaf9a3cf4e2a4
-
Filesize
581KB
MD53315bb2b8978f22f00f8e70230db7582
SHA186ec1cb842a31ca954570d736b43f93e93d6aec6
SHA256ccc4552f8f15b253da47f0079205d2a007f358dce16af167c5627f6fef130abc
SHA512ba36d80f4d66b19988836334778d405942d1b8ae7b118519a7a20d1289ec04011b2fa5cea76f9724bbfcd2ef5471257067652a7fa8c492848fd45398152e7392
-
Filesize
581KB
MD5d0cd2a3925013df64ebea163addc909f
SHA10c16b3708e3599a63246a8292d1d4b9c05de7b7b
SHA256465b35c1edf39ea196ccc5bbdb912e7738fd56681d0d038f2477321ea33f8566
SHA512b6907b07b7b7ef205c723dfc22977b5a7daf8a39baeeb4094d8b5c3176206b2fd42b265f7bcd70615661d4f249801393b0c14553bf73387a5104268bd3d75a56
-
Filesize
581KB
MD519774c41bc3aa9bf657ede368ded8fee
SHA11fdf93ecac0b447f192ccf5575e910eeba533fa6
SHA2565f06f60086e42e76d39a5deb1bbc4f94b2f3e4169b0a9ca625db5b8851cac23f
SHA512ae3890b9bf55294cc8db486282b93d7c8985bafeab9bb97becabb722fcdfbfce0933f5c2ba007d2eeca11b06a327edc261d022473229c423adb86fa0468bd7bf
-
Filesize
581KB
MD50c96c672d1a636238e9a936f87229468
SHA13cfaaff695356981bd922fe83b60c0f518f41cb1
SHA2560f07f8259c62910e25b3c1fc3aacbfe9e0af72bc342bc8a09099674cabd4a752
SHA5127f8965709cd86365cef2b8886a9d9a8132602bb8cfead40b5d0e804ca66692816cc0b6104a2e57f67820cd4efeb0a7fb7f6ce68d49e64324c4dc83c8bb4e56ab
-
Filesize
581KB
MD5b067329309ab2c6812acdbd3fb92fd37
SHA1c587061084970c9ff60411298f56d18a4efb489d
SHA256fdb0fccacded53a03bf1ac541911c8ca8247a73d9a35bcd9c92498bb0ffa693a
SHA5123cfa8754c5cf00d0ce5631c7009d1318ac30320a7009ba9357a10efa86dff56e31322d25648716bc106fbd19669936b1b2c605b80646d97599b67182dc43df4c
-
Filesize
581KB
MD5fba5d914c46ad6f564cdc49a0026f9a5
SHA1e4b87f786f92a2781d2c6358298b28afa59718dc
SHA256f1d8052724d937b22478d87d4ee2f4a5612166b7c9ea103a6918e2b9c2fceab6
SHA512459fd2bc54c52d6d66ba21f0088e77e46c75a5a19db49ead2a08ccb147a847b13e9cc4428f21f4dfeb12d8b802c0c07c61634bfcbae5b8b2d53f289ab2aabcb2
-
Filesize
581KB
MD55a7338552e68452cc92cf2796f355134
SHA180c2b43fb4025e29eaeb531fc79eba75e56b104f
SHA2565ffb37aad809838d1e3baa78d7a73a610c4bf700335a85fc28e837368cc11487
SHA512716571d02997671c7ceca057a0efb9fc15050f48f52b6531c48a3c83639fcb23cd83f8437936f24abbfcbd8e32ab1d080d5ed93e1150c4b702fe2156847b2341
-
Filesize
581KB
MD568c40e0c656854660320f7213ace36d1
SHA17566a75e922a028462db78cc2189e297bf0b7df9
SHA256f6c7b8d4aaef67cea319ed5675752acee9c394b58b15cfed26ce4e065a51d678
SHA512d87c1db25ebd5f2ff7abd0b4720f34dced4afced4c650d62358fac116f040b753c34b3823a664dc6a46a34689658732a5a1d43cf240782cce651a3c6abf3141f
-
Filesize
581KB
MD5e7f7117e096bf7b8a4f8efdaaf59cc86
SHA195abb3af423050a623617e65e7a2b89218a19312
SHA256ab3e73962555fd5dbcf9b023b7cd9835f8ac48c253c166510c5ffc9515b935a1
SHA512b90e2c019b0642742467c3c12c4aaec9cff6c6e540d3c7f3e6cf5821f7c9c5b21f65ce440cfc557f5425befb0caeb539f2642613b1960adc079ff67970d6801f
-
Filesize
581KB
MD565b86fa0c9f2211768b512ea280391ea
SHA1fd3e36110d33f8b5e79fc24f397ddfb570775b45
SHA2568bce5d4c7943bb8996b7203419ca55c4dcf2c6cff98e3076c11aa7b26f36d604
SHA512c3f03e2d75d47b64eaa3cf9cb886c6490d36285680828c8286ae888c02a7825e44fa96b398cba2e151e042f2b532e5fde4d1c84954eb38f90be6d6d0a23fb732
-
Filesize
581KB
MD5c9328f8a14d06e5b62826b25fc51476f
SHA108277f9186f6958a4ff7e15ed7e997e0a72e0edf
SHA256f6fdb4c7599bcff89f9f6980c6626e686ace0cbcb078520b89c05eedf633dc7a
SHA512968fa55c391a129ee7df01b30231f9a68ac67484c7f1b0c8d89c2db49064fc9d005858c2f51a54a738a6b360634a06a6450b074feaec51b44c99d6ada686fe86
-
Filesize
581KB
MD5fa3812c280368271b1bab1d9836cfbee
SHA1c6cac2383654cc57afa2329c4634e50d73203cc8
SHA256024cdd8a5ce2e0098fe1eec3122ba4c2def12c6fa34b0378d992a4861638df47
SHA5127eeeefe3660667fcc794369b4afece8cc7faa328da4999dcf30836c2fe4cb97db2e72277e7f0f0892fcd50d1ea44fdd82db955fbff63c5c0964b6e4664490c48
-
Filesize
581KB
MD54a5f951c581430fc3b8d5a9f46d6e525
SHA17ed08f2f5cad8b03cb21bf417f620ed17fd40bda
SHA2566cf4e20ad95836de3f678c9ab65dc735a4ce8aa5f1e065f11fb9ad23aa2db147
SHA512a737b11353bf66614f23067b35f6535a43fdbd5d543c448170aebbff074b8af772cd2189ca4f7aa27d57a563b70a6feb2ac2112078cee32fc22c366101a6ed44
-
Filesize
581KB
MD518e1c1aa1fc1e27138915ef656b814bc
SHA1d7c474512f10bfb4407a1487c0b4d1b39270d4ac
SHA256ee9faa91c5ec2fc9af69b860746b159064679434b480f8a29c74c30d461a5796
SHA51255b720fb14c2bfbe07f4717d6648d0e2034d546660ad06208961a7ab19910cfe11db817f3e74a6b0d4d118294a7ddfbc656e52f1ea7d65409d6f4d924dafd86c
-
Filesize
581KB
MD5b9d9766dfab48e27660afbdd8b8f236b
SHA1907fd560c0b7652dfc6c9478c3f581ba699822f6
SHA2564292041e96579901571886a7bdf6b6c2675b4986ce6b0e223fdd5c6eb0bfcea9
SHA5124799ef3891a8aa898e8cf2978adcf77644e9377c110049d5df41d8342e2988f8815911fd591c2b2ab3ef72d89cc18f687f7f2b14108a09775fd5b0ab0274c16c
-
Filesize
581KB
MD522ffe57c2d7ea50e7a2f7885125a121f
SHA19e29ff002bf7c00cfec9af9569c113b88e8e5829
SHA2562d94abeb6174867d7014a3f27acaedf6912e3602c8845059b0d1f96afa08f791
SHA5125617407ea83540fee5bff6aaec3aec4e3fd9f802217c81dc61a363fd3d8e0ea7bd632b1ea9a98667a171e1b193d7022cbb5663bba5c7112e5baa4e041298d861
-
Filesize
581KB
MD5f5557bab4772b8d59bb69a21c273df8c
SHA177d3c5777c0177abf8805484984c92ab9c915ded
SHA2569fb5640118c7cc1e64ad9dd190d267ebaa844b04ac58ffae1fd7db331459a8f0
SHA5127907b440f6f704cbcb5272253c62bbcd56de792c0f8eb5f28b215251ddf02604cb3ea77b1ddf6f17aef2d1c884a3a30a41356949043ffc5a8e3cf7a4b2a5bda5
-
Filesize
701KB
MD579f34ad41f3d8cc01101e4504f318a32
SHA152e83f62767eb1dbc06512ea2668bef73e59d3c8
SHA256ba3128d4a62bdf2a146c0e704533ae2152543bd3b3e57d8673010c0ff760809f
SHA51234b31456d6017ac48ec957e4d8946ab02a3379dc8e6ef7a483ebf5c6503f902cb4998882e18e1b3f5cd1b068791554b8bb6b129f48350fb0f73cbf853d787b39
-
Filesize
659KB
MD5a6ff2062517f8a4268de2b53f76801f2
SHA18cffa162341decd6e82dca4bb40d07e17cc943e3
SHA2562952d456421c32eed027e152cabee4cd83634edd6d89ce4985944c344e2cd825
SHA512b9fd4cabfc3379b2aca6699c87424dcdca189cab66a1f6eebecf96badc7fbbaa67d20e02efff89adbb112f1e6e653af5f67ac0ad5abccc02ea6be30c8e78ce15
-
Filesize
1.2MB
MD5d4000c060a4dcf59c4d88c39769b27c1
SHA1eaacc1989404ed2564a2edd97e447cca68c0ae27
SHA256004d4e3b51e7cb8f59ccb5c373a3b3b95e59e9fe25eb6072b1e3e4991959f46b
SHA51284076b84f47f6cff194502a55ed27daaac91118daa872c1779b463a0228e3a66fd6f0e5653ebd979b1eecdcedafb89053b918da218e5dcade42f64bb485684b8
-
Filesize
661KB
MD5484204d8f3beb52592fa87b2bf541adb
SHA18138004343dceeb3ed3cc02cd60d384bc936d171
SHA256b141d7b40b54a2d025859e8ad92fe0782f1b0293ced92b74a45026eb0f5b3591
SHA512b4851ab06a9c426eaf0176580c5629018a023a4f3d13b130d4519d3f2de91bdf863e5fda50a4f1ddcf857391d3a721a45c9ba2d06080c3ad3b6734ba7f0037de
-
Filesize
1.3MB
MD55e195a914657aa8f0466a72962cd7a48
SHA1d11b8a364e0c28237c1e78569f15910ab99851d1
SHA256fc5982c36cf0a2e2f2e6ab6f59f09a345a90bab059615fbb35994a957752f8ba
SHA5120e85057bcb0116b8cc610595dc91f07fae02b8620322e1eb8723f45e5cbb20ed572e0b91f855b741b4caa4d396283b069b59ff3c04a7547667c127a6d20ec7c1