Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 23:16
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-02_a2a6eacd66ccd601ed31d8eada737323_bkransomware_karagany.exe
Resource
win7-20240221-en
General
-
Target
2024-06-02_a2a6eacd66ccd601ed31d8eada737323_bkransomware_karagany.exe
-
Size
677KB
-
MD5
a2a6eacd66ccd601ed31d8eada737323
-
SHA1
c011697ce0cc532ee8ef05a56f9f448dca9d58d3
-
SHA256
83ad6f64dfa3c5210cbac3bd881c279e8a289a58b1f58def47d83c29efec0d2c
-
SHA512
1c10a3987d581cc0770f11da30a1e025d80e9ed6705e17298f7d0eba1b682068c7950b9d56f99dce01bc64a8a78839931e9cc07b83b07d61bfc47a4d80d02a20
-
SSDEEP
12288:3vXk1d4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:Pk1d4+mIJz5IcuMlQHJxrDiSi
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4812 alg.exe 2036 DiagnosticsHub.StandardCollector.Service.exe 336 elevation_service.exe 740 elevation_service.exe 3752 maintenanceservice.exe 4740 OSE.EXE 4412 fxssvc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-02_a2a6eacd66ccd601ed31d8eada737323_bkransomware_karagany.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-02_a2a6eacd66ccd601ed31d8eada737323_bkransomware_karagany.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-02_a2a6eacd66ccd601ed31d8eada737323_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-02_a2a6eacd66ccd601ed31d8eada737323_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-02_a2a6eacd66ccd601ed31d8eada737323_bkransomware_karagany.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\f7da16ad8beeeac9.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2036 DiagnosticsHub.StandardCollector.Service.exe 2036 DiagnosticsHub.StandardCollector.Service.exe 2036 DiagnosticsHub.StandardCollector.Service.exe 2036 DiagnosticsHub.StandardCollector.Service.exe 2036 DiagnosticsHub.StandardCollector.Service.exe 2036 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4376 2024-06-02_a2a6eacd66ccd601ed31d8eada737323_bkransomware_karagany.exe Token: SeDebugPrivilege 4812 alg.exe Token: SeDebugPrivilege 4812 alg.exe Token: SeDebugPrivilege 4812 alg.exe Token: SeAuditPrivilege 4412 fxssvc.exe Token: SeDebugPrivilege 2036 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_a2a6eacd66ccd601ed31d8eada737323_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_a2a6eacd66ccd601ed31d8eada737323_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:336
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:740
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3752
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4740
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4864
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5c849ed7348885d5a75e390ffe8e8fd20
SHA140fbc0478661ea862c95dc02e2e0caa20c5becb4
SHA256fd961ff4f3c32e1635c43c0902bd3d73fe1cd61bdb625965b9c4a5f3a6d459d0
SHA5127c80ba7bbb220b8dd7df0c0befcca4b05380fb459287475df3275f51ba49058c39fb76ae795152a88cb747ba653d2c3107e8bb945bd7c302c28b259225745095
-
Filesize
797KB
MD55c84c1592309915e1e802f603267c1e2
SHA1d806714f98aaacfba99c095799b7ad2fdd8799a4
SHA2566baeec2f999f783bc6d7226ed527d51dba7326b94000132100e3f81e19f4c14b
SHA512d34443b486dc75576d3e442caea35d3bac60e1f61d295aff64e6ed7cdc95b192b11590ff68a891d6a015068d7da0a1a1f4c19d5c7ae15ce1758218ff5bd3beb7
-
Filesize
1.1MB
MD5db1acb01b48f9bf55e9304954a09f72f
SHA130e955dcf690fd20742d7395e1992bcb13c9030f
SHA25605a685715afe157e8ecec1decf5a7a9ab8cc6fa5be9d1ff20fbde68bca4d9495
SHA51206fe1ef40ef8e32efd789d430d5a1e8983d01ddae88deb499c63c4fa6f683125bfc5146231ef9a687f004b335a82e1e5e8809a71d6100a008b35205b4ac42a60
-
Filesize
1.5MB
MD5c2e08304e54a374f6ec8d5b76eea0057
SHA1082f281b5ba9ca38074073116d1c6e0dcb5b28a4
SHA256ec7d43e942e75afbe3d36080c81d31f3952b490734f0d289879eb35a4c6897a3
SHA5120dedafa9007456e2ef2a85131a4dedc43e9c1faef3c653f9d4b45d888dba704f83681e019ad19621e94f7a00352b2efd189ed73ce5faf5c27a9560cfa76ab8db
-
Filesize
1.2MB
MD54acf7cae4ab871ae12d4f2fc1858c92a
SHA189f00c3bd577638e1e56f56a65c9d6702aaeef28
SHA2566fdc38758cd631e6261a3df9d2c66871a81dd6a42dd466ba16f9fc20b9a07f60
SHA5123ea64bf8fb0a2877ddf17eb2fa64847b0e0042c957e1c4c09752a691d3ab233b19c4bfee4358ab2e0adc989787ce2c33ccc9bf6af80950a3bf69210714aad380
-
Filesize
582KB
MD58090dab0d36206bc5090b8321f6001df
SHA1f8c41e62b0bda969b4f98bd951db38c090bb3b6a
SHA25650abc6042e7825563f34e47677f0ecd1a0fffd7787eb0063a5a7a2748cc87ef8
SHA512d72b306c27c2b4f3f69530a353283c7235939d330f849182220a9989eea41bf9d409046f36cf69d00e9fe9b4fb60e4b10bcf001aa5dde6940375287aff334be9
-
Filesize
840KB
MD59e0afe00515c3fe1adeca6969383de5e
SHA1442df26d6fd8f47dae1bbd8cf73b15b8ee163cad
SHA256c217debf68ef54f0eba1a5e5977e4275ee78126237d96f1e7fd7acac84b2dd36
SHA512fc21745ede895ecc113c81eac72c94f1b287b0cf1d6ff85dff0ea62ffb59594f45226f2bdcc0e5bad334fd2ab0275bb6606c3c2e504c9c2153726d2d0ff6fa11
-
Filesize
4.6MB
MD57587f6cb9fee44e88b2c4117d5fb7bc5
SHA13ab3b1d07b29c17f87dafeb81d482212aa8a25f1
SHA25631a9974e694d37de5afbdb4886f3b71e6bac6c2518a943c6a343e8b443bdf54e
SHA5129969edfa86adb2d01278f80e4a08fea9a5829db296b83aa167c40d874f67f1689356297c1e0c825881fcd535ef1524d50f4aaf0820c53fec7e88a66b5d4d6a1a
-
Filesize
910KB
MD5935eabc6681b6a019af16678e0c035d3
SHA1f94665cbaa256485348e0f4fc5a00991902566da
SHA256fbfcb9166e3fd509ed1d6ec44f794580ad253b63f28f06bb02aec84d254e9f3f
SHA512bb60a661a68616042d64f1b127ea5d262dc31a737972c18ad3c54f21a365195ad6f27336cb5ba354d3d31604181666bd62c9db330619955d1689042ff4acdcb9
-
Filesize
24.0MB
MD5c6c6c8e42ae41e3aa10d19a574ff36e1
SHA195dbc88f55bd22f2b5fcb658ba093d9fc99f84cf
SHA256904555d77816546ad79e2172eeb7c504a95ce0c388702063ba57738c54906846
SHA5125359c74573ee7d589b024ad364f1dfd44cf2a15112436bcd0cddb22e1734c9c1fd114898f0c8dfea4e3859349a2f013b960d33000fd6a4a1d257ca8933fdcdcc
-
Filesize
2.7MB
MD52fe1bbb18c5cb3410576f3260964401e
SHA1a36ef5eda73218efebb65399d7a431e84f58eab8
SHA256843c89d6210c91f22fe455b3f42b26ff00b67ed3cb65ada6c770ae5d47c21cf1
SHA5122a9614b5a7e943d040c4ac2c5bd68a66c2ed57be473df83e3e0c5d62ab34a1166e962354202da9be03b9846f6f0bd856f42cb08c6ad8360d154b6ccca71e9583
-
Filesize
1.1MB
MD52c8814b72adfc554a812588dc5452302
SHA157756e9a345e81f3f6af8f9fc092d2a225bad99c
SHA2560ff4fb85c253694315a7b2eaeab1aaedfff4b11533442499cdf90963a30d3d1a
SHA51254f44ccf59062f4ad3762ad13e6850ce2ca1661ba8b41fa8ca7ac583fa4712909a96e922325a19b54931afa7c674260f036603c02022446842e9666808383416
-
Filesize
805KB
MD56768fb5454627ceb2282119dca3c4c0f
SHA147c1215709bc392cc0f710fb18723a40733fe5a2
SHA2563b7c989e2c2777fac3743352dac4f7aef76f245114ae0a9734327683845bc001
SHA5122907e588c9daf3d7b3abea9c05ae7bc9cd66cbdcd76eca5477afc240753509370f5444d63839ca44f005757b00c383747bea960e65e9de427e2bb02c8f621278
-
Filesize
656KB
MD5dbb8ced0f0b1ec5e6be59a090d7fadbd
SHA1eaaaabe16049df9dfe76a9beb762c4b4a397bd52
SHA256ea2727381da6042f94934a0af96e12bbcac29b6228aa4a35dde851ca66bfe551
SHA5127879a34905e4f32db0af747d232561c446e91e450f72a7b98daadf61f9d4e38241ed7a607aa7587bf4c883e567671bf59715db23f82fb6959d3e49c47c64a9fe
-
Filesize
5.4MB
MD5026927bd77c7e83115b2407482aa3812
SHA12d407eb2a0a5c4243e554cc1c72e9e5c0c9b4939
SHA256bdd142a457e1f5a00fd0a5b2ec8d337eb267b87f7d7817f769ba7441fbc9008e
SHA51267e131d85f9f62d8d5a92e230fdbd6a3fe31dc4c4e7ba21e052927466e5e86895b2e21a44b7f63ca9a0b30656d9edcc67ee16e123b98d02c8f5e13844aaa84b1
-
Filesize
5.4MB
MD5def75269f14d0603c495e20f435d6cb4
SHA1805a407d9b366dc2b639ee9bcf39a217ccbfa9f4
SHA256f22028bf0500091fa9410f0dec99e255ec39bae0d528454d287a0aed7efbe4a3
SHA512b7450a99fba79ac12ecc432cf2be59cc1e6622b9898d95a0c389b3278dda2d00c06b2da59f04002d2667b45b218bb71cce5560b9b51065a46259abf9376314e8
-
Filesize
2.0MB
MD5a645ece23d514ddc9a6ac0ff5fb77d86
SHA1a965f4cb6b08efba7462838f151a7296600a34a8
SHA256ca05671b5f5fad81294d6a9aae3cfd2d3403216c07aef037b9c7a08f44624f22
SHA512634b7927682c7a2753adc06d52f6b4bb9a6b76f8848942ed18ea2ef26cd237dcfc87d389cec44e88112488b2116fe5cbe8f7fd69367eed9f48c614cbd7591c6c
-
Filesize
2.2MB
MD530dac2df28e11f229fd1e91a92c3ad0e
SHA1062e1f824c03a32cd5bac291384827fb11c13c2b
SHA25634b268218746f8df34fea8a4b816a71953a3e91013328045a2e39646cfdcf6fc
SHA512006b0c3ea01c1add28e71976903cd8295b446e8f0e0a1711bb25e53b86d3d1be83a949c25eedcaf44c80a95a357225070e208c9c0b5ca303fd69ebd78babb488
-
Filesize
1.8MB
MD5b57c69386c4c5f3eb7f37c313e76e5b3
SHA1e9189c7260682c1c86e1c3df100590ad9afd7f20
SHA256d9492cbb300625a2ae750f8d6da81e318a346d6a7192b502205d1f218ead49ee
SHA512b733c0f1d77680891b58850683e6f9a930814e26650a7ecb1a8e7df12bc895119f3f2c28ecf8355722c5fe4eb1eb89a82f2627a375df4b94000c7825512ad64c
-
Filesize
1.7MB
MD58458ff6928701f431fb9398c986b9076
SHA1d1d1d4af9d4647824b11146bbb07684d7d1d9995
SHA256ec7e4784a114a2f8daee661646ecb980476990a95e5c74d485f324ac8389ff1b
SHA512740426aef1043e19e777451f7ee18a0793e9f80f831d1afe90fcc7d32166aa83cf03b085c781052a24a87d6a9e178edfa7a2fcbc4ee249cb08655833e6d8ef97
-
Filesize
581KB
MD5be4250039b4baa1c3f3c9ec9dc8c34b7
SHA14f9d5c5d37cde1f26aee4a37d19dd24fd9183640
SHA2569c94cd9ddc9f794e91093b56d8efca415245eb64628e93336eed77284b2634bc
SHA5125f3af7361ec866d98078f9756fb0753dc1f048cd246b3c85058879a668f8539f59e2c1fd1b3743f59de3622648665a936bc4118e8e9687b798a5237385fb3d72
-
Filesize
581KB
MD5f46488f179eacb0838ed64227c8af7c2
SHA16aad81e0c4cec4ca88fb5589b59f49dbac109c86
SHA256c902aa7ef98d52c676d5bf081176e3f0e8af57b456f96555c22f1a2fa1fb5911
SHA512ab13068303bca0ae889acbb9002f2e8f96a9fdf4dad057d18c1e8de30cbbc1dae1c05d76b6b35c5d25631bcd65177b3787959311ff43e81c27c5c7a2fa592239
-
Filesize
581KB
MD5d82fea80f63b5098442ebffce49dfc00
SHA17bb0b705b8d95c21430b235f36fd4e82a25eb8d5
SHA256396bdf81b8bd02e50c8ef41e5fa42995f56e461034eabacc63cc7564856b1cf6
SHA5129e0823128aed16bb747cc35d77429a0f59e3a8e73502c318ebe2dc3fe6347eced59d641d0e1533891191c10bdb9abdc632783b14591da3991ee4adb719df6cf9
-
Filesize
601KB
MD536e9bd8bf38e647fbdd20b8bfe572653
SHA185dab1ac7bfbfc959da722ff6084cdffa05c1095
SHA25655020f9a1597e161f2ddb888e2103fd730e90821c126640a2d1c983fe9a5526f
SHA512d5ca9be3e1cd3fc3e4ba7835e6545ad86e5006488477addf22a4db2aab39de250e665ddf69ff48347b772bc31ffe4033c739bd427547e0054f3a085fd4056861
-
Filesize
581KB
MD5b06cece274eb7d204500966746b7ad4b
SHA148b7074420e36e9a296fbca901ac4cd533a59c1e
SHA2560297bd99d9c823402a32166c9423003110e1b80f98977bb8de29fc9799cf1263
SHA512706b9463536213c310c1d4d9c8a76f05a2c21b006c47d2e3b94561400ad327baad127f032bad2e1c7c6058df4a859a9de1d65c19184e91f85bf1072c138f51fc
-
Filesize
581KB
MD563ec601b13c4c95dad0fa8b2a2d92b12
SHA1670e4b66370cd8228e5d755ba384ea0eb2bd0161
SHA256bf131d6d3be0028071e5b5119cf8e25bf287ac55ec423373b3468d4b5ca74e13
SHA5122348f50529ce468bbfe3033dd2300c3ed5a543313cd5bec281670571f0a09fc6260ca6ed02b77c5bb500717322f0e35f4e69dd14dd30bc4675ddc268d49face3
-
Filesize
581KB
MD526b9d20c58becf5209a8758b32595918
SHA131426da821a47961b317fdcabaf9aef1e5bea657
SHA256d62cb48852234cd6b216867be5f61b5593c76c5e5a47714dd9d1ebc09d4d57ee
SHA512208baae645c642a52710aee6c0537190de99c563898fda77ac6df854cfe009c43d6827d4795d1fec36dfc4d461d92d6a6b8452ea6fe1c34d5b9d4516bd7fc443
-
Filesize
841KB
MD58314778d78c2ec1a857d751d817660cb
SHA1f5eb50f36e7ffa08a11d1f8746e4835bcd61c890
SHA25695c2f286ddc6942546441cba7b3a807eb974f6ccd186aefa214f20d392a1a807
SHA512f39b22a2be77f77669a60081aa4bba798f36c31592377542118e9e2428bc8be2fcb35325bd15658b175a3f3058c396a4bc7f0ea23077bcf74f21610bd9db180e
-
Filesize
581KB
MD5e6166646cf762951961e3dddebbf0620
SHA100381d31be3f76a336fe15c9456154355f199e23
SHA2560bd84d6ee61c41ba20a3fdeda9502de5c05d060ff51f6db8f8ce3497c1585aeb
SHA5120ebe20c4e558a86c8f6c82b0e330eb687929965d1a29c595d04ba756da95c573dfc68a49cb5c9b6870bcfb138e7036747e8414be9ae87aa60a13aa1249f11501
-
Filesize
581KB
MD516a3056b2db1b4819b201205f269fdc6
SHA12a5cc0b2c571f0f5e30e279d01a5f0e5a00d3855
SHA256a0ee9dfc706fbaa0ab21a907de11441ebcd75d9f9a8b9c1dbaf133aa15ea6e4c
SHA5128c03ccfcc4747d9b43fcfa1e6e6dc4206be01da07f07946ee8cf365fca29a60d96eaa3edc48c690d322e9d1daa57ff422506f51b5e003305d264d66538b91a9a
-
Filesize
717KB
MD53df5c1579d2f69fc5192fc7f7f3b8bc6
SHA156dc47e4c0bf7bc23e2d0e3c6f2483d504778285
SHA2560d3dc35f8b97b5049484db1981bb2f0723cef7d60c1e7325877d8dd31c7ed36f
SHA5122fed29f66c5861fab36730b9855291903dd4a46028cfa3a6bfa51fb58cb6f4b436fd53f0dd28137fa04a121cd5a3bc97afa39cb1ef4c876114923c14783dbcc1
-
Filesize
581KB
MD52800e6df96d3bb68c39686269fe0ed9a
SHA1fe334213b2949d5e325e84b8c699aa78abc3cdfa
SHA2561ae0f669f8c36be8d38880c241b112b8280b42f8af9a9c2f79926d359d5217a0
SHA512a136f843d3cca03d87e331c0a5c7e6549d16b85340f2a339600c1a6adf4f0db00d44f4512eeddcb1f42f81d08933fc45081e94fc922b5caf8b29ef8810e2a5d4
-
Filesize
581KB
MD5e2a070ba4905d42dcbdc93328311181d
SHA1790d072bf2019b4d497a05d04c458b0ab2222588
SHA2566b91d61611c5b901f9fc8de8a08549f689370619715bdb76f2e581e8d5ab525c
SHA512014642ebb7bbd531a025cd90dd549a348347e8d23ccc811fbc2948ff0b410af93b87de9f50835d75ccedf66e74244b11cca6f5187eebefda5b1578d0950948f9
-
Filesize
717KB
MD5732db7dc2fc61d2a2f64c26b32b45bac
SHA103a19858122a672a0eaf15d3617e55dd93dfcb01
SHA256a3994d5d71863fd07eab1d58f48c65ae765d84785fabaab2a1d0e6c2a88da52a
SHA5126806a1acd0501d50425ac9cae0ac153a53ec7968e897d4fa17358989bfdefbea61fc1f8ad86c7dc14e421a71db930e2aec632b7dfdeaa0fd155f510434a6579d
-
Filesize
841KB
MD54701b9b3145986420d2a727d522ef0ce
SHA1693c08e384dd48f30c99a0b487675ba6da2dba2a
SHA256cf75d5f4ed5ad2f1b94ddef7f26f35864593f7ad9a0731870c7b607bf7fbaf5c
SHA51280f0c77c8e75da791d22953f22e4d1bd18b56149b1cf4496080a35e2862cf194b743b73e6c19e05d38dd4571b0374a9e9475b6742cddb74ab809268763bdf5a8
-
Filesize
1020KB
MD570a916d9cdc38b224520526b0acbda44
SHA18876124da51afc93659d1f3522eeec41ab2a5a95
SHA256957ac3a45e7a6e5a6f8a8de7d988c489ae218a9c24ab7e5229f62d21c73c7724
SHA512f7242632d53f70165fe40483ba5b73e7033f536a318ed37e19ed127a16d3cc0b125a470b1eca241d0d2c5bca6948523fefc0fd5619c4a93510849462b927f563
-
Filesize
581KB
MD50a70ad459f3d7890dac1891b199811af
SHA11889981e606408b947119d2cf9db4a9a28145277
SHA2566c72aecb995a23631b53125ac9014c089544054eb9ac57452c5f1441f42529e1
SHA512bf65eabb14671cf72fde70d6e9c4876236e58ca127b0071e312bcb047a73d733a76949da4d72c16e6fda7a7ec98f311a5cbbd7193899889f843fa8923d67ed2a
-
Filesize
581KB
MD586c72d2f351114cfa2f9a8d6edda5b09
SHA10101095d93830909c7695a29c223693ee7b0f30e
SHA2569788ade80c08e18f14afc3eb4e92345091e98832a69debb93bacd2e4b621a004
SHA51253cca505046c67d01bdc03cc9c6b96f7729c04d8bb00a85be0c262f2657137c764262c7fa6c1632c7124c147245e8e789704dedbc06f5e0fd6c0ff3d40ea2057
-
Filesize
581KB
MD539a0d3d1c1aa1052714323e393ea94fa
SHA10b8476e52b57023ddbe5364d2961490e3e8fd3c0
SHA256bf47fe58ca3e8c01799e5cb1dcd2047581da08b0dfecd8c5d31c56a0fda55c90
SHA512650f0f8d84306081fd3b1f4032bf9f30c6a27e30537205fa042d679c806cb0d0670b843a9c731304d9ed21851627c06cbea18ad27ae0fb9d8cab6c6c41ad03ca
-
Filesize
581KB
MD5c45d66a8064e639d5987e7ba1affee68
SHA14da7ce82c8090eb3144c640d23930f056bdcf409
SHA256168e2d586360e285bff9e84e4c1696be48d130b2cf79bff7ffa74608388074b5
SHA5129b379a589d4c915454847f43b547776fa3e5df951562a452f8eece6feeed7792e0222338b0113419d1e213f2c5a570705280edae5a90a2261b178c0523d063eb
-
Filesize
581KB
MD579143d9d960662defe01f1a47fa6eee2
SHA17bae550392f39c6bbfd5dcc21260c16cf778e70a
SHA256b7dec0eb13d9adcc5b6c28b82265100c3b97c833550e9a59c9923d4263f70224
SHA512ba4696fcba3cc86ae6e187a804ae757888ace2d8b440a10365e15f2d8200b87244be71dd27e9cf5003853b6c37868c8ded7d949ab75799ed6d62c1804e5560a9
-
Filesize
581KB
MD54a8b1907b7873a91642ee85ece0aef1f
SHA1e1426e6ead7cef6c34dd19fcf348d0bdb983c9dc
SHA2568c2d05fc3a33f6bac6e9c054c07606e8f6c20c0731c2bfe721fd03aa966d8eaa
SHA51272a278bebda295c2d154392e76b5262603e85ee30fd5763b3c10dc52926d7ebf4af2aa0101b717810a77878426f03f6d012cfef2f9bc51f45f31a6263ebe5c68
-
Filesize
581KB
MD59567714c354034a539ad03419881a8e6
SHA19cbe9a438f763efa224c90365d53cd9cdf23984d
SHA256524974abacd6ee30125644972385ab5ef1cab633c4d454b770cb8e0e30eb150f
SHA51289c3256240f65d9adc08ae9605742074b7846a9a194465bbb75c6286ed7dae4cfe538dccb740be60262ae74e75518e22060f60f7c95ebcc2f2b2d23934485859
-
Filesize
581KB
MD5693429c9861daddb0322393f5febf272
SHA1ba9f703a8fc777708d8cac2af6c152c95bf58760
SHA25679e4dc074d1098da39f3c68a3a04c4da31bdacf5e8f2841adab20ea4fb49262e
SHA512b3f38fa09e25a8fd437df451555bb2687a8d484bfea1bbee66ad129f8bcecb8f62ad215ee999f0cbd2d8d76a3376a823e61a49b17c6befc460c613cc96077230
-
Filesize
581KB
MD5308eac80af28e3589d669d556124b79e
SHA1939cc2a0736e2363c3c221d7da7d8bbb3bd42ddd
SHA256805a539f22904d646c388b6ffa44a897b3b697c1898d7eb288867dce54806a69
SHA51238b97b7eb94c0571f6ff44d275002df4e31756c1442494626f778f93cc98596dd50cc20151a7e1e20f8a4c99fa91e333d2ac1132538080950933ff9f792e54c0
-
Filesize
581KB
MD5618f945c75f6f0fbc6d63e0073eaecc2
SHA133df01685583557c13dabce410505cda28e44b99
SHA2569d5882f4b970e158ceb3e2ad4a424c22734e81810d1ab367e00d34d641ea4aeb
SHA512d5e0af18ae4dfa9041496bb0b0346d9413c7111230b4753d58a1d490c211763fb82bd6e28dd8f5bcc3d06707099c9a0c7abc907655b92f1c260188fd1d16db75
-
Filesize
581KB
MD52bca22f3b73f12676cdc6a42295a3e85
SHA1fec55225774f37b8b3a7bb7215bf4c1940b0b819
SHA2560dfb75803060c3cede9001e1e0f7ff68900dba8e1564c2a908aa46dd05c1d569
SHA512c68ad27d4fbe29f01c019e78373c7a54c0f8fcb2cdf04b84a3f7d018c1e0ed4c03af33298fc7837975aa1adde2ba4e9276fd06c5761e96b22efcaddbd5c839cd
-
Filesize
581KB
MD5aa5d12aa870462278f5ed75a8b543d8c
SHA114376e696415706223ec37b59bb15aab68862173
SHA256c3053576437d92b4c3bd955cfe3344cb76b5b94dc8c146ad006a9200d596e566
SHA512f2e01b9b5fd0c83335ffcb762b413efe6ceef1b01b819666d827cf723fb89d066d6a179b5526fc304e9be8d4d924478005f299ac84d62fb523bcd0cef745530e
-
Filesize
581KB
MD5bfb24c10677c3429bc6e3440812038a4
SHA12bc7be951d7a876ee16682ba08745829ff07d690
SHA2564177db363cda7d48bb10cae7c352b7e30cd26853587d25bc58dca77ef78b96c4
SHA51254c5b7f27ce92f0d48b7bcf9f4f1445807e64c949dfb09796bd3c7e7843d394bf3ac461f2b844e65e0ded66f4fe79385e5d995583570d788e9bf769ff6b2f889
-
Filesize
581KB
MD509bc4c1e184b5d06f4a14b19bbd31f03
SHA1f1fe1ac6d764e48debe7c2275ad9d45b4885df1d
SHA2564543c51a84b16033b47c75bbd90723427b321933c623163a511b0fd359985bcd
SHA512760f20d7b1a9da0b146de5d6709e71e474127ea40a2244aeef371fdd26452a03d437c49f569776f46721facd77c8ebd9c73e82105acc86f4a6a1d06bf393ead6
-
Filesize
581KB
MD55d4065d7c033dd53c8b2ce581c05c1bd
SHA1c2eae478d6564cbf740051a0f5209bd285048b1c
SHA256ddef9ae2e82f588e3f0760dab7af5a960b8f0280aa89de1bebb575a19c8b2ef7
SHA5128b63996438b44d589f12b4b3b1982a38678ffc8cfa7fa09e024acaf3a54b5b35b5fa05f070c91f9ae8f7f12e13d476ffa5baea3c60e12cc8be279da2d488e8e4
-
Filesize
581KB
MD5ae5de3085d7914f41eab79499014ac31
SHA1b0e5e3dbb38bbc564247e8de5073b1b5c98d1c70
SHA25654db3caa3ebae49b37a0dea8684f39eb952e08cd59d6ed49fd8fc8a3a216ff5d
SHA51203d5257b929c03b2585a12e15c63765dc6e8f50a8edc98daefe8fd1c044e06d262d98bdb98891e8fccb2e2468512aa9e2d89c2ebc87d1f59b9dc5322dab339b8
-
Filesize
581KB
MD59d960cfbbeab909e38d579e676e462eb
SHA151c500354cbbeb3accc1daec6e3ef2e574fdb6bc
SHA256ea3d8f0e881a8f32d50cf6e3121187237e241f261e8cc5aa6af0471892e3ed95
SHA5120a37417397e6e27e421e7e610d277b5e8b2989bf8f4ea7f8e14c531622bcbc50da5b90c1854d28fef22814fb033494fa011dd45f22177b2c002755e9d103e88c
-
Filesize
581KB
MD52e67e07cf1910719ed98c6c11cbc9316
SHA109447304afe0cc014d1639d03772c07e22eace1a
SHA256c9b06e91631f2ad32c094580d75e53afad566640f4e554cf036340671fc72e3a
SHA5121f4204169889e83f7fff8abfa3372d6cb89b98f2b1204647448fa95b4c54814b76c84ced0552a895f72c36667d8700a09d23f6dfef614792cd962d65016d9400
-
Filesize
581KB
MD5b97f0f1bda807f693ccc3d9bb1c67e21
SHA1874ac402327555db4db45a173d1f518908e0f8d9
SHA256e345a3041c0d78462a45adf2352a4f5e1619d232325caa80b06ea650b9b324f3
SHA512171ba38dce620520af6829edf61a42ee40fbd41255e640f2fdb8d867de3295dc3f2d33f937d43f06159588668069ed14d4af7c72e2c3b1afd8c5b273d3d0820e
-
Filesize
581KB
MD5eedc14071aa117e7c790ca18a812c400
SHA1687c7b07266efffa4e6e2578752b251a24227b53
SHA2565b3c1098bf348e1d29847620a71aa08d86dd7fc00d0b40bf67527723c8a0c5b6
SHA5125ddcf2291d63d43fefc56fbdefa76a94fdac36f318b25efe1e70c65ff03c9c5f5f31c58d6e7068972f28082e1442b841b1efbdadc84664861cfe318f294e612e
-
Filesize
581KB
MD5aecc12a580f3e0291a9af414f47ea770
SHA17bf6a4daef7db5c99aa8eafdd88f0574cd927af4
SHA25698387397ad35c3bed1a66c22ccd100895f911255bb3cfa982289410755f68780
SHA512668453ed360d6d1f2ed5b695c75d9c735b8e1926cd93d1ea17f63f803ad52dafd2f88e878cdada34d02a7a14ed2a85f31f921d5e5d10325e9e83967acfb33142
-
Filesize
581KB
MD57af4f65fd54b5705b4143e766771da45
SHA17ad8fdc7131ff286ad2d800b7bffa125533c109f
SHA256bc29f1c421194e4b5a6c490dfd5b4c123701f8027e61ee201195e1f3e6b92d84
SHA512bc8df48e09ff767c59bad646f9680171a4a431014f01a8500f91effd7016e5240118a1d3e47c61864ba3c94f585b9f422fa37a5106d7c1c82179073057b66070
-
Filesize
701KB
MD50cb00e33fbf85f65211a43f7cef3609d
SHA152acd9b74ec0895712dfce7dd23ae84391552a6d
SHA2569f460d0a14240084909c7e8eea21e232c2180035f35614d3e2dff07f6dc2e89d
SHA512ff5088daca84dd0912da7ac064620949f98fe0d2f274a5969f20048280156c5b1a8b7354c7ad6256e7a60dd6feaf43108aa2d55cf2aad4d9d83e4472bd485ab6
-
Filesize
659KB
MD514fedd67cd073e15ab39a9c8a4878d15
SHA1906ba5173b83ef24a478cdad9635833c2a3db102
SHA256089990a2b18aca3f0c8e1d4483c7752e1b3c18051db935f109dbb11c8950f1c8
SHA512987d9cd93a77cff67602477fc77d8e7089b9119954f07e949091ef398d3b3cdc6c383a24e98d81d4ec01434dddba37665144aea90f77abd1a05ed036cc26e956
-
Filesize
1.2MB
MD52c0270ae3c2f1a7469c2f70e08bb96da
SHA1b8b9bfdef6e72a828c122ce348611d4841cfffdf
SHA256739207b557a60925a946bbc12a85676ef43e8144beb9574c4e9a9ac7e8406c8b
SHA51205cd163a42650892b7e675b1cc7b858b46730ddff3af6c7a6fb8f0e85aab0ddb8e72ee83a022922cb5e1caf88d14df869ba3fe13522dd9a4f0b0b9ebef820336
-
Filesize
661KB
MD5d73b165756e26e1f3ca55404e0ad6f2f
SHA1c46bb6f57333a40c409066ffad0874e1f86f37fc
SHA25662c62bb51998e30919df8dbf4b7e42253db7f3c9b3bce74e12b84233c1bec78d
SHA51285f81e92c0c94c4a94897cf7350273383d84b7de3d57add71a870103bd93224d79852856546e130143fada3130d99a527a20ac1fd3d2c107de653e43b272687a
-
Filesize
1.3MB
MD51afa03c5732c4839fcc3c730d5dc9e4a
SHA1352ecc09da4cb7a34ee80dc4357c70777edd06a7
SHA2569ff31b20045caae3625ef305bfe6b7bdcc7bc9c9af218e4272e64cf7e44726f9
SHA512a05c727ff3a5661c258069e7694c8f48caf43884b8531cd2e7e162fab38ee719ba0fdf18c288d1c7ca1a5b826ecccc2e83ae85b406957a66066a6b07536335e6