Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 19:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-28_c8cf250299e89432013d3065ccb12d13_bkransomware_karagany.exe
Resource
win7-20240508-en
General
-
Target
2024-05-28_c8cf250299e89432013d3065ccb12d13_bkransomware_karagany.exe
-
Size
677KB
-
MD5
c8cf250299e89432013d3065ccb12d13
-
SHA1
590d6042c7b46eafc324925d90fa9b749da2aabd
-
SHA256
451dc6a02840e28fcac9a8bec43e557a35c25668c173b98b3cb6b766f1535ad5
-
SHA512
a634b4f5d647b5efff42e3a6304f614da12e306f59152b065b5ef4bcf447e203be64cb9b3f28350bbecd9e1b4fb093ceb2162cf80bc17d084447ceaf7d5391a6
-
SSDEEP
12288:DvXk1tp/SInr8vv2BDeT+bVYHTb3FRk/rMNxaXqqlPbJKTGv5DYFXOBnXREHa:Tk1b/i328ab4F+rM/aXq6bJfBUam6
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 4764 alg.exe 5048 DiagnosticsHub.StandardCollector.Service.exe 4900 fxssvc.exe 2032 elevation_service.exe 4100 maintenanceservice.exe 2008 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\191979fcc3136770.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-28_c8cf250299e89432013d3065ccb12d13_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-28_c8cf250299e89432013d3065ccb12d13_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-05-28_c8cf250299e89432013d3065ccb12d13_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-28_c8cf250299e89432013d3065ccb12d13_bkransomware_karagany.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-05-28_c8cf250299e89432013d3065ccb12d13_bkransomware_karagany.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\java.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-05-28_c8cf250299e89432013d3065ccb12d13_bkransomware_karagany.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5048 DiagnosticsHub.StandardCollector.Service.exe 5048 DiagnosticsHub.StandardCollector.Service.exe 5048 DiagnosticsHub.StandardCollector.Service.exe 5048 DiagnosticsHub.StandardCollector.Service.exe 5048 DiagnosticsHub.StandardCollector.Service.exe 5048 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5092 2024-05-28_c8cf250299e89432013d3065ccb12d13_bkransomware_karagany.exe Token: SeAuditPrivilege 4900 fxssvc.exe Token: SeDebugPrivilege 4764 alg.exe Token: SeDebugPrivilege 4764 alg.exe Token: SeDebugPrivilege 4764 alg.exe Token: SeDebugPrivilege 5048 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_c8cf250299e89432013d3065ccb12d13_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_c8cf250299e89432013d3065ccb12d13_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5092
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4764
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1716
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4900
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2032
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4100
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2008
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD561b6296489dc4498111574e2a28bda3f
SHA18150a1a399b1bb22625892053113e1ae633827be
SHA2564d874fa78312c093bc9e4eef9605e0a7c6105dfe67e1e2b339e68e10b0ac1df5
SHA512296c7cbd2572ca29b7efc1382894343b97925cd45c14d15951aec5352e1f86c71006bf6095738280d74bf3980f7087d9c578dda79a9828072ea5ec610933060e
-
Filesize
797KB
MD540b1e6e47045a782c4237f584b70716a
SHA128623e9b8a603faac842bb7c8f6faebede7a24e4
SHA256ec403d1cf3723bdcd8e64d5e70a0ac68f078cc3cc28887a7190b20ce3a3b40db
SHA51233bd44483a62dfd8bcd2056c2675d7b4b60cf15e3662b6cad79d363396f81b707422405cc446247ccd9c84190b7c61154b1d043a4d12ecb942bafd32ae0903d7
-
Filesize
1.1MB
MD542d121155e3eb3779c69baf568bce231
SHA1f781dac0af9af1d0977ba9cc6b2c75252fd6741b
SHA2566c0b7e230f08867f291499afa2163ba431d2ea2cdfe3538e2833759463b42fb9
SHA512a4b7c28e5e3b8ad94a8855f0bffe5d55c2a1cf4f4113846193a758d1ebdd3695e7f18432c282fce30f31870961ea6ed2205566058cb483f1a58aaab39a5133a5
-
Filesize
1.5MB
MD57b5a10f2b63104f0a51758b6efde3463
SHA15b0c6bf57742bbaca6d64c15612e5e8262c29a74
SHA25685d5a08f473646be905bce6bb028929a82998ac140e2fd4f69b55362c4d0098c
SHA512babc94b4e1be5fd277a69964f2dd9aeea0222709b9520dda696f98fd8775cf17443e4ac635142c87688a7eaaa03adaba6e942db3e4ab20165af6de6f3a89d258
-
Filesize
1.2MB
MD50bdc4d6f10cd9a62bf0820d0dff484fc
SHA17214cd45a448a50d515286aec1be1b58f18cf009
SHA25660b1534115d2b40a8695aeed0b7c1a806428b80d567d0221588152bbc1b2fe38
SHA512fece86011d8893c60db0eff3f0bfe556a043141e88b005baaed5c818735a4c7296e1e956cccaa74c4334d977a123c581eb7c8df263a113d4d129dea157cad0b1
-
Filesize
582KB
MD581a736df30e2a96284f8f02485cf39fc
SHA1115096036137c53f1d96297cd053c968f62db62f
SHA2561cfa5d7ca853731dc636904518bfdfb7b2875a6c3b5e243c2388562a61df0d59
SHA51244f974da5862cdaaa5a627713ac8c94fe0424b41d58fac84feaa9231dd6c3b38d2568240f288e0767abf35bb9b70ef4622b14b5719237de84704c541d7daaf96
-
Filesize
840KB
MD572005c527d0c0206613d2c3e45fa4d45
SHA1e5a1a721edbddebfc12a588663c10f11234cf2b8
SHA2563309bcb72b7cefbf846f2ae0aa3105852510c60c71b2f11042c6941d989d2453
SHA512b65e24ee8c2cea7cf9de053900b107a5c41f67cb48512062f557abfc2a6cfced5bfa6ef7dc41feac8b045412aa27b16cb7f89737ffbd4207838662fbc6f5c5d7
-
Filesize
4.6MB
MD50cddf0afff75637354fb2fe8d3d3f0d6
SHA1ed5da8f0481d7f2f45883c685d314d59c27c0a73
SHA2565fffb7baa02d7e1d9e7ef1a6049eff7cb591180b41c28846f27b54cfb18a8378
SHA512a936896da261200f060d71db765723c9e34405824394fb712c640fbfd7c8e0dfa5441514fec2ae956585c65d824b757f6f2a27ca95978e03676d616b2d0d5153
-
Filesize
910KB
MD54dc669e3e1bd300926dca15e9bb9aab6
SHA17fbf11917f1d34bc8969c5c7c607c173e72ae0e8
SHA256447187ac661f880b63e2612c3788f9062ab0bba3d05878109228bcaa981b8f51
SHA512ac6407e0c82c87202ad480809f920bcbe433204725562d45e33f711bdb2a288c29751ba2cd485465c55add907f9bf33fdd641ecbd0937dbec1f19ef201c266d0
-
Filesize
24.0MB
MD515c6f4797b263b1819f1ad05a74b7b69
SHA175dd80a625b1c724c2ebab6a782dc1a24dddecf1
SHA25644d5ae16a4ccade57300ab98bf8598fcff4fae0f2b70703c4d5ca172b0d717a8
SHA5120ad3d1020ab68635debd26ee8e6b0b4c9a9f39c37b5365e908444fbf69517be37657bd7654041a4dfd4cf3bda94622e6ea5eacaaa7e013d4ec5f31d063dd3e37
-
Filesize
2.7MB
MD5a44cff61cd74a96401902ed65436277c
SHA11d95f9a416c4526ac91ba11dae9ea7918be50fd9
SHA256e67055f2a649b46426c65cb31313ec803c523029d5a63b83e7c43d56fd66f72b
SHA512cad91114be083131b0a85766f4c50ffd68da2ad82eb78433e2198aa03e0c163a9ddd5f40e8c34565581ecd249364702764a7e76fc8db9ef437ac165022afe8fd
-
Filesize
1.1MB
MD55acd00cea1f18d692b9f6a0a6ba0c8da
SHA1624b9b7e011be833d3a224406d5a27067a29daf6
SHA2566fda151ee9670f79b68afe4eb66a46232e8962c356e1608a8f6e4dfc9e6cf491
SHA51214f3a507046adf3a46f4cc77d3131c5cdff7f6ea4175ff5a7777a756f10a13736f5813ede9fa932c93896142c04c36d8d4839cd74ba78b481f01159c3c45600e
-
Filesize
805KB
MD554a77cd060e81526854167015d9ff22a
SHA10efb1e3082cfbe6791754e7bff42a6c88c310e37
SHA256a3dc28578a40013ce810713c125d7a4fac59dd7a6be64b559a933ff021bf2e9a
SHA5123759c993bc6c2d63518d2d920a3bf3c4da70e839acf7624be2318834c84a3e13c910b605299246cdac57f1e5fe9b7cadefb40f2b44971e4b1f3b88276c4a39cd
-
Filesize
656KB
MD5d58e3d7ea91fec6ec92a7203f50971b2
SHA1a7ecec4144861f17ea59e837e2f1d40900e6f8f6
SHA256dc90163d9c9d73878eb470c2095f848673913dc232160e8360229aada6be6df5
SHA5123c6dd4dda42a675f173624d7c8624f3cec05cdd4df5b1dde8b199341671f1172a99a0149037d4531ce3b644e3b378b5e1547e98b33dc3759092a2f85eccf25e9
-
Filesize
5.4MB
MD5efd202cdbedfcd116cb97d3156c10761
SHA1cbe2bc2868aea9c549b215a264c59cc47f39e0a2
SHA25670c8ca673d7bd94c77e0dd1336688a1a02bb6f23dbe45d0d7ed8f3c487a96d6d
SHA5127dcbf09d27f97cf303c1d54caf3efc09945f2451b09f2abdca49ca34fe699b3de9a08fc5002ac176f9f62c3382b781d567f7dcb0ef097a9aa896e6056d9b02fe
-
Filesize
5.4MB
MD59f3041c400b9abe0f57b50ca2deccb97
SHA132819931f11932ddfcb687a273dd4d85169653df
SHA256e99b9738bba2d0efe0e4e4593221ae982a727b75ad32af2920ef635d2a910294
SHA51279807dd7aca164c202aff150115d70fff1c37a38b2ff3cc6a292d2f9de4d2335947765d1567b27ed73e29666e1e9f1fd6fbecc261ea23dfe774f728d026bef61
-
Filesize
2.0MB
MD536586f429e8b742891a2f08c93728e97
SHA18b11a8753150e97d30ea8de4f2d24fb13c11cf86
SHA256780cf1a0588d910904b3956139145a27276df68de14df148f7228db1b81a2687
SHA5127024b5e2dd130766d4d7204a91291d2c19a9880a30ac38a76e7017022482e9f576ba1f1f11ac0936b9e3eda1c867f96eb936c6b8845cab388508d1a4341d3c18
-
Filesize
2.2MB
MD5ffad2dfe9b467b43c00b8481910f775f
SHA1ceea3cf971d5d7d1a5c82512c520e20d7ef478f9
SHA2566683eb7cfd3dfbafa2ee408535b867857d40a3e22e9c31d2727d353b88f55267
SHA51201e46b17dfa1fb99b7617186ae4fb4a52b8080d5bbfcdb6637eacc431d3971ec57ebc1e5b94c409924cbd17c5367cc87297ffe532f90989ab86a8d87f67cfcc8
-
Filesize
1.8MB
MD5942a1783e9fbb32c4bec0eaae1bf088f
SHA1ac7234c23746700f36a0e34865546010ec42d3ce
SHA25653945edae1f89068ea6fc71a553a268adececc4cb77e2daea96cd61f7748a1d4
SHA512e68a132278ff21c4f9067d87a3319fc5484f3611838ef1b7a41cbdc46253ebbe3c14499666fec581f1c400c9f27b45a932ea72a727fee8c30baabcca72c5e154
-
Filesize
1.7MB
MD5af7751cb016180ff9955f11946e8b814
SHA1bdcf3b305224f2006c0bb71d1d4e73b7e7842b93
SHA2563fc9e0f5d7f129f7c862c6ba1b848b35892ef034c0e08a236483af2ba75dacef
SHA51232a0c4c7a39ff7281a9db8cb6d2516c7643914e9bd11ac4d73ee1a07678fd9cd499a21acc117f8b1b224476934a2f740c8ff3d6262e72df3eaaadc9d49dc86e8
-
Filesize
581KB
MD518359b4ebfb4d010307df70f33ed89ef
SHA1f39147fc968cd9be9c290328feb9bf0e316f3929
SHA2569d38de21301dc1d6ddd74b25b2b1c18961e1e0c6b175a3b209eab680e7bfe531
SHA512fa6a60a300211fe9961480a1f7baf488aed4a3fb4437f025dbd3f8d857019f2aa37231ac9766dfc668a3e72fb47daa162490a373fb24947e1ff74d49d99e5075
-
Filesize
581KB
MD5826fba0bc346b7029450a2fc6e8894cd
SHA1880eef616557142f3b151e2adbc1292aceaf005e
SHA256b39a6de074ac8ea3e2d1d174cc78374f9c3d55655a7ba839b5cbbb431f2e3a01
SHA5120a174d20874722cad9e8c4d1791873fa57dd6bb0e905f94b3b61b819b69efb5e8e94e50bd7668a0f60931b2e249c229e92108cd51406d17375c7f18756bb7d52
-
Filesize
581KB
MD5f1f83c9e026bed096f20b38ef1255b2a
SHA11f8337d85e1112ede780fe402c93b542a04847f9
SHA256d11b98617a7f9f0f3713727fa33f10b4698b00cb619d9b70c6039fb44f239762
SHA51261f651f347d889560a28c68f83cf2244c633adf67e4dc09470bf1dc1fdc45eb4789c98766546e5b939c42d8489bd92d2b49cef74237abe7f07aec55f48d4b9a2
-
Filesize
601KB
MD5be7a6d38fdd5d4c46b2fe563e11270ad
SHA18e3d258d71939e04701ac009a4928f9eec9964a5
SHA2564cff9eabeab373bde2d24f2086dab6560253057c09168c92f8c4ccb1683b7ca3
SHA512942efb57375778dc68434404e16d82400b16cd38197caadfe6c25f68ffaabc122f018b52280a18dcb397ebcad1cdef1b98177b526a24c5082ca56662abfd26f2
-
Filesize
581KB
MD59c2e1836e882e307bcb4a550bb35bcbb
SHA10451026e82ef0f070567c4be9be095be4e844090
SHA2567eee4237308d0564ce67c7d76bfbec2b8605c5165624e6682fc77321580a1be9
SHA5129d81df2f2be713a1ae54ab3524c43a2f989fa9ed1054a75a2e4b6efa3297b3a2f2e3ec21e801b2ea29ff374c982f19ba7b8a780a2b0e7721baa5654064c8539a
-
Filesize
581KB
MD5f516a331f01e0d5546586f15afc48710
SHA1bde8c96d71e99663c40c773fdac1cf64a6f08137
SHA2562b03d0a2b729e9c19ac0ca2065dac239f4c4dba0d5d41597ee438fe71aa82fd0
SHA512f9a2efa96cad1fd00c83f44b16f1bb1d5f87e1e385003951daa642c6cf2cec8ed67e15ee0b67d0f114ef2941714ca9ada700918e9e9e0bd914cb2e8c91952b32
-
Filesize
581KB
MD5f1e21cc515f1726d252421e9206c63a9
SHA1d7c7a49e906e478a92677d1b34ff172447d9b7db
SHA2563f2836762fe4def00a9f7f8a37c7e00d83de078605dd1476989880ddafa2f4f8
SHA51255061c189bca66b44ceca2eb87b71181c57f213534e829366681e34cd5bb2efd4e221273dfe93066bc1c55d49ed4c0ea037b4c17020cd6dc5e19cf290d9b74d7
-
Filesize
841KB
MD5c9c2cf3e7779b10d76231ea45c07778e
SHA1bb4b3fa1c799fa9c5b603ee677e8df2b6e1067c8
SHA25688fc308130ef109faa53b8ff10860d173589b426b744752ec27d8cc74c585199
SHA512f05068381f0ad1152ed9117bcb75428611c7b79727f15976ea40a1dfaf3a25a95efcd2f1f4348a086f9563134c48ae49d0fd37546f3105c889e206a27d2c07f4
-
Filesize
581KB
MD584d2aca7c1e2100e1b40452b06b7d17f
SHA19caa09d1ec955eb8d1007f66ed71df854b8f32a9
SHA256e1c2f54c2d43e72b9e4bab4b62bef62e1671115a8ee0be4272badd4a097bed72
SHA5124799d47edf4d635e0c6177da4a9ec8f620c58944ff6a3c1714c32e01ce6468812f391cea098c06b1fadd5c0d86cdd57f986e5ea8ca62f7f39d1bb60714008524
-
Filesize
581KB
MD5f14906c651c2d3b6b08df8b95b7ba755
SHA1fd46c71621bd14b4e9754b5514e3dfcd584c4bd1
SHA256d90c3dcacda241af3736778d1fb117caa2fa23b1e9ae821b5ee12257f549f85a
SHA5125f428adf29eb71a62ffe3cae6452405f1ccec634a9a57ca3ef2b0ffb6b3acac0edd606c2713aa0c61a740971b586950232bf81265b41cafdf6d1920b7c2b6601
-
Filesize
717KB
MD58cae7577c1092f55b5b876153ff8c049
SHA15ea4040a229c6fd2374c7dc35fda04e201daf1cb
SHA2561c0e6fde61584817f7d49f712f5f41cd2f461fa079b522e81743dac21dc79601
SHA5126d2fa9963b1a294429b9cdb25eead07e1a383c7f55f27fc4a6599968c6bdc057e3109ac23426c564f75ae7ae6704f3f380d99247eaffd53b6958a196c53fc0e5
-
Filesize
581KB
MD546900c68cc99f293ad4307004c39b136
SHA139604b1893aa6d3e755fb92faad2c57f0c36b94e
SHA25649ce16944fd85a75d582d63c3c15dd9cd872d0835653017654e5d725329becbd
SHA512c7168d2af91dba0235c04f3b560bfb5f582c19a03bd508ecada90c89f6a9ad165f687e2b6c2663ce00884fab404ec3078af5f2c3da8aa732532211d71de5183d
-
Filesize
581KB
MD5c23402cdae1137ddd5d96aec0e690210
SHA19cb973b1fd18c820d45fc0882b24c5906e719b1d
SHA256f566de3bf8aab13644e2ce9c8e1b3652e5261af920a68f2b9121118fe4c5669e
SHA51241d7f7fcb7a47c015f73291779275ddcaaedc7c61ecfe7f386bba815d0e2d94cfda01b36130f831f22cf372daf2898ba07f441527a3e6ea0d344a020368f3918
-
Filesize
717KB
MD590f5eb95ab841af306141225fd68b7be
SHA1b75eee71e329b87ee8228f55284e0e44060e3266
SHA25630767451e62cd2ddd807132707f678551a8d76ba9e7789eda3c8e9d0ed843325
SHA5121a03578990bfc1dc5cb4bcce56f9cd2d05d450818cfe136fb387490145fb656716d3d6e9d9a174400e00d70b738be8c3ffe9d7d5a6ba347d5da232d5fe426572
-
Filesize
841KB
MD5784ea7160094aadcd2640f08824a5183
SHA1beb64239421095c931d9b96c5a219df8355e024e
SHA25629854102946b9e4a41fc7c80ece8152e97a4dd46b91f9c3284066f3a10e2b88a
SHA512b9a384871531f436d8b89852e13c36c7f5b2a18ffa01ccb768cdfff1101cc6457f7465549f9f5fb3a8962f4098d8a5b27c3759e25e15535d4c4c12107647bb87
-
Filesize
1020KB
MD5bcf6ed992b452cd88e93fc247bad02a4
SHA1f537a3b3fe0ecda88dfea84e2c6e2bf17207c7bc
SHA256566ddc016f13d5d3441b4f90da8c9db7d26f60cf408e2b508e645f30434d7c23
SHA512c170803fdd175e75c263fb28f14cb5539b7aa38afba9dd4958f32d69766f4461bcea055ce915e1304bcd66722dbc90d2dc27971cea93e633baeee3a850421fd8
-
Filesize
581KB
MD51852df6eb988142a7782a95747d1d9a5
SHA127e28275dfa2821378bddf13bd23bd52b647f300
SHA256545a18aaa3807643f92153f3b4eef0794378840e9d294288ac23b400c2dcc99b
SHA51225c60c4330cecaa2a3c3f8ae0af38799c50e91f476782a09d9214f61604b3594580d8d75b73de7bd3389a297ab2a06ee046c7a4683d5cd4a9b27f10e48f8ac80
-
Filesize
581KB
MD5945db26f26fd1a0781fe545b90cd0ccb
SHA1b37fc608d4954993f94635d21bf77834c57101b7
SHA256a4a1081091e41204128b988601ddd66e4bdffb4bf3ef2aa3a10c5b221ef8253c
SHA512fcf92c462c7b8c60d7fcf189637fef0018b5b5f5b692ca5893019d6a68dfe76aa3094107fcdc3ba9e202f2e2cf605ac10cb9bb724328e394d8075011bdda417e
-
Filesize
581KB
MD5f9abbdfd5e0bff2bc93079f3144f7091
SHA122908c35bca55c077acf2d4daae9381fef59b211
SHA256061ffa6f48c0e990a9cee46b54018fd1524cb1f15c1c8414fb4b9f09e82585d3
SHA512ec450c66ef897f65eefb3c343f6709ab0013d0bce45519f0a0f13764b27e8200a0e5e53d7d713096c0d1370cab6cfbd504be2d96e8be397fb40805d08953f303
-
Filesize
581KB
MD5be3628c134c60f7bc61ce1d45d2a8f95
SHA1a7f4e29a3a95d088c77b795d7f49bee58e17f396
SHA25633cce4d8bfe32d791fdd91b4e11fed34634ac68e0c1732c2f382ffc7646bc550
SHA5129b8af8b656abf95d9ce4f8bfdd3205486d2323669d360f31f3582182df105da09bac27f5303015b21e4ce69e2382be9515ec3c50fb35cd0c5119e0fde1ac7643
-
Filesize
581KB
MD5e71ed1f658c614e5858fdc02983985b2
SHA1c1ce1e065c53e205c89e0edbc05edb1516df2768
SHA25642857a5f64bcbb0b88ac25c6e033efecd63f2b0249b85f78dee77dd7614dec4f
SHA512c5e85e79aeb123913297cdc320c5a2cb30b6c91e76dfcbea96042c5737582a507593ea5e17d27f5ea6b7de7fab3285992f1e450a84bd6a778364f5f262697ac5
-
Filesize
581KB
MD59ce60f7306e5f9b9f3127b897bb8c7a0
SHA1ac6d8a376834b48b80974ef675e35081af0f34e1
SHA256a376e91700285f21202113aab5158f1fa8a9b024878534fcd2f62ee9b601783a
SHA512ec81cfac747d93b2d4713fa7f94bb46e8fb0148633795a7831f44a5b984fa7625c17dfaa5c80d170f556aae64fff0aa34872a7c47e39b753f26a982512ca6a81
-
Filesize
581KB
MD569ea1e57eff73068ec7eadcf60ce233b
SHA1e8c864a0967d1aad3c45dddef5ae8c1fe2ab8ef0
SHA256b2eca41028a889aeca0c304a4a75cabf7e6bcba788cf6e377112d4764c187c3b
SHA512d5ba942949066717ed8fc2ef9ec293e3e995bdb84be446cf1285248eb8183fa528c593a1ac28a57e817dcbfb962297d94fff647b487498fa2e9a84cd0a6cb759
-
Filesize
581KB
MD5936040d74cbeffa9f2195022fa0cfcdb
SHA15b5cdc2591a39d53dd3760bb2f8b7bc45a579c45
SHA256a22e8c303a5ac54e9b2076d100b17f033b07793a59745640bd023cf2a19f7a06
SHA5125b4c033048525726d6219ca92e029f43dc01b79d23e93c306502c4c1b6155076d714be543e6db7f25184224d3b0e67d96221a9e04387707e0aee2853f4399993
-
Filesize
581KB
MD5f9d93cae680bb4d75d8a65a7d821bbf4
SHA16a4197d2c0ef04904e17536709f5955a040c8470
SHA2564339358b2a03abbef0561b18e479ec6526a1bbd24cf7d75b58e6918a50012d30
SHA51245a2128c2c09756c6736edecc6a8edb3b288f48a002be972e6bbf2aa12892d9c26b79a2cc85337ec2d40620efd35ad8a6d097eb8c1ed207bec6263366f4b4c9a
-
Filesize
581KB
MD5bbc3a08f8b60967939e3ef1f2800dd84
SHA109d40580019f2933b92f8c1f5fa4c3830017182a
SHA25677aa2a00dcbee782342fad8f20eb1fc3a57bfd38bd39816fdc82a56840fdab7e
SHA512dbbbbfc7430ac838fd0ddb4aab6c5abe6c4445d86989678b3870f8a04f69962941a3d9952dafad9dd0b6ecbc307ff461e96c65940ca86d6f025a41a8f07b9383
-
Filesize
581KB
MD541d135068a2e2e8888daa5d44ded34e3
SHA19bd42188b1e1e903031498c6fdf3b2aa2dbcf9fc
SHA256a2a1b0c749671d9d08138a98283fe2ed95de9ba93aeef077569533971532fff7
SHA5123892b787c52d8496fbb891369fdf0938d348a8d5039ad01423b3cc68d84360f3bbac5ee1a58047b41e299d9a6d724770139304e56efc70ae186a9bcc727af4e4
-
Filesize
581KB
MD5f15f1335fa01b20027d861d060d13bb2
SHA1fab93e2d671b292739436475a57f262dd9775d70
SHA256c1aa6343d424dd8d18d8044342285ee9f5239c88525d88bc0d6955d5092fd1ba
SHA512c84510518184d665a2070725021a58181afa7d6baf371d9dd7295a3cd038b9ca8f90167941c15f20a9a64d43aeb1841f51b1cb5da38939dfd6d0577d2c35cda5
-
Filesize
581KB
MD53c265ff54137ffcc569342510dba0ca3
SHA112a8aa9dce0ba2cd3b12702820d8e4a6ff803e14
SHA2567d2fefe49dd8d2307a90849351c028e3cdfef381438b6e1759c0f8dba793d2df
SHA5125b5378bfe1e85f4b40fec79dc04a5f312cb05a4000cbe734683ad43d80fc4771ef3757bfe90d12c1467de233f43e46f728f918721f16b0778da56fe2ed2581aa
-
Filesize
581KB
MD50cfac70398162289008d37701da93bad
SHA13a63e179a8c1392bd2f0b227d2240e95cd813136
SHA256ad4ad977479376f0f96cf5b47bc30e80200299bcba38d1dfb35a4c02e868eb68
SHA5122d9f8470157163f124afff97f86d77ad80e8f3d96d91e94bd79406d34bf09ccc0091f433cf3789e2240f36cd6bf3478e054164d39ac3b72be640073d2b5dd68e
-
Filesize
581KB
MD5905f5ac41189424bdde34949a040cb77
SHA1293be0a80e137096b9b80e306212de3100f0156c
SHA256ce7174f96471c158a25a0f37e60a846fe69fa9916064f64d747745052a4540c5
SHA5127bece98f5b726ad9229f2fd7b1847cc0ed9c93af3111ad2ffce5877aa88646392a97cd8f50bc9421dc121ac1d6129d1041e8524a56fb7b97fe777c1e1e68ebe9
-
Filesize
581KB
MD536b521201b0e6c520bcd71e462f2c898
SHA1302d2b275fe633046f1519526a24957127f791e6
SHA25610db37868a67bc1ac34b9f855c72d158dde08c69168a6461c8575f3d5d99743d
SHA512e1552eb4ed247d6b1286d7995e7e00aa54690e80dae7041d92580ef715e9fef77504ad4a5319365f85ff60b7c7d7c5179101acc1a31f2cc1dd4523f7ee837440
-
Filesize
581KB
MD507d4b16b655d8812f9dad9947ef6c2d3
SHA14f6579bad5eda91cb06560a39b9a05122435f142
SHA256df225eaa88dfadea011306ac5c111e444e72a48e8cebdcb909447de33078ab06
SHA512cc83c94450af786c248807ba0d725cc4e282112af8ec609adfcf9bf93ea4a3ee8e810971aa20f6fb7206a9f17b417f74fdc3f1b11b9c815924efe81fe48c348a
-
Filesize
581KB
MD52e4f90a3fbc1a8fd07a271dc0d2f0023
SHA1d8949dea05ae0a22c67836ce2b6611f5e97be0aa
SHA256c6835229508186abf4a55e3f1cc95ed968b080586e398372088f34ce5081b8df
SHA5122d2bc7379c3b2add300be0cf4d8e2bebb37857b15574fc382a55191184a3d00ef88f342ba17b9cd221b7691955b1950e802b872921570148b1b7e239e3f62494
-
Filesize
581KB
MD56ede16e4ee9c61c5bbd50d3069bdfc94
SHA17c8df9bcdb15202a3b408ee429d2cc4e447ef097
SHA2562fbf0f8134d36741d2e807386080a58184d0a53b571e53ccd309c5ecb72c4903
SHA512e3a838eb7fb8a18197c8f80843c19ed646206c852a5839f4e94c2846f634b63a5c0a6489bbb6cbfd4668ce908a9e28d36df3a2d76131870ea194dc97b79e3c9d
-
Filesize
581KB
MD58f27450259cd7bac8f20219432e9d2b2
SHA16c66ac51ac55b9e075411505baf27bbbd4429047
SHA2562b5bdd9002605eec898bdba8911415a6c9e5123b39cee453f05b4477d847ed6d
SHA512a0a6def19f1d46ee5808e94c5923c6a278f93f7f080fc3bafc81f373c169473ac04cb6f550c582b73d201201b27e3c9cbcda4a5c1e46cdb20fb97de6440c4489
-
Filesize
581KB
MD5fc85c0a117c3a1ba34e2a02b3400e64e
SHA105193ee50de570e9da67e9e2cbf1c46faab55821
SHA256014e73e564e2ed273f4c1ff3f51996ec5bcc68ce1560be1e282981b4be7a6400
SHA512510c5be735dd13fe96a0d954269c9eed2b5e40d9b4a3ddb6d573beb10b1a04a8e4da03b8897a1a770f9bad17f1815998b566e03811a6978cd8fbb410e1a523ac
-
Filesize
701KB
MD54035b4a255ff6998f41c08f6a9377877
SHA1cdbf87e6ee4410807a0a0fd58dfe4748c745f2cc
SHA2560b995aee70e6ffb3bbcebe183306d671c92909479edc301d2c1bfc9dd6fa9f65
SHA5124b2e80b978d14d8f3858ba06097f1ee48aed96b0c04a12dfe60a295aa622e1ac84d56245fc5327aab8e0b1d99593c6524b86af5b96a44718887bfd1aaeace903
-
Filesize
659KB
MD5fcd5e60ec82b3be3d582052a286feb97
SHA18ac8fd658bc547d56dd5ae7b600f20ceb9664175
SHA256821aea94f2bae8804646af97fdf08331ba707d75ff62ba54f8f5272a78a02221
SHA5126dd9528513f4099ff048f3acc389d84cdbbf85722b3f08bb31feab22dcdae2a24fc658ccea651fb7d873082868cb33f52400bc00bdca5a43dd2b79686ee74a21
-
Filesize
1.2MB
MD5487f40f3d3f21a2512a0e4d23611bc68
SHA111867fd52fe491fdfb8c43a23819e2a3a994f209
SHA25649d26060d2ab7ed7222cbc8113762d8400b2dc46d56fe309d77c5368c4251184
SHA5121d6ce4da19b5e414e9e555339a629099361417af5f293832bb2346d2d3ab760b6879b9820919065209bf4891f8cf3865b9ae4d611fcefdec2a36ede50c48021f
-
Filesize
661KB
MD51c548ca9f01aeb53662ad34aea6935bb
SHA195e914887f3721b730f94bb33a5b894478c6c527
SHA256383f588bf32c45587c3370d2071d97089b85e159007540d43a69e0f7115e6050
SHA5121d452e3aebee046f13e5080702a8bdd3f01e1b389aa233629adb35faaab2517f2619972973e5e84bdf6d1ca9c8bc8c1ebe3ebce9d790eb60423a685d5e546d40
-
Filesize
1.3MB
MD502466bb9668758d45f07a9867660eb67
SHA1baf3a091996eb65d7e82f6aa5a82e0fef8d86f9a
SHA2562c8cd113ff1974f18813e2debc43db6e90d12b70b0c27fbe14dbe38f2840c48c
SHA5127bad78c24a3bc5ef4eef525e04b9fdeb8207ba05e1839ea5d51153e4d33579972adcf70fdbd4b6613d0e8f6a07916152810ad2b1fa62342c6ad55413635fa09b