Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
06/06/2024, 20:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-06_d3cc7b455f0d903f35aff9a49a88ee41_bkransomware_karagany.exe
Resource
win7-20240215-en
General
-
Target
2024-06-06_d3cc7b455f0d903f35aff9a49a88ee41_bkransomware_karagany.exe
-
Size
677KB
-
MD5
d3cc7b455f0d903f35aff9a49a88ee41
-
SHA1
1a9d61c729332dacc31c08cbd2cb4413f166a3ef
-
SHA256
d2390182b34dfdd3eb11a7c4e203167fa17727a910d14e09c8188b02291513b8
-
SHA512
a78b2f900ba91adba57401a6b01bad5a2f5a7c2dec243622a5c603c6ed9342fc9048170165a806f88780e8bf61a9e5a5b6b01036bda6cee862cdf5dc9ecda54f
-
SSDEEP
12288:0vXk1e4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:Ak1e4+mIJz5IcuMlQHJxrDiSi
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4092 alg.exe 1260 DiagnosticsHub.StandardCollector.Service.exe 3284 fxssvc.exe 1220 elevation_service.exe 5048 elevation_service.exe 1576 maintenanceservice.exe 5052 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-06_d3cc7b455f0d903f35aff9a49a88ee41_bkransomware_karagany.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\dd9e8884bb5459c0.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-06_d3cc7b455f0d903f35aff9a49a88ee41_bkransomware_karagany.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-06_d3cc7b455f0d903f35aff9a49a88ee41_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-06_d3cc7b455f0d903f35aff9a49a88ee41_bkransomware_karagany.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-06_d3cc7b455f0d903f35aff9a49a88ee41_bkransomware_karagany.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_97390\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_97390\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{3B9828FA-6A18-4F1B-A570-1997BB7D5CB0}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\ResetUnregister.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1260 DiagnosticsHub.StandardCollector.Service.exe 1260 DiagnosticsHub.StandardCollector.Service.exe 1260 DiagnosticsHub.StandardCollector.Service.exe 1260 DiagnosticsHub.StandardCollector.Service.exe 1260 DiagnosticsHub.StandardCollector.Service.exe 1260 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2020 2024-06-06_d3cc7b455f0d903f35aff9a49a88ee41_bkransomware_karagany.exe Token: SeAuditPrivilege 3284 fxssvc.exe Token: SeDebugPrivilege 4092 alg.exe Token: SeDebugPrivilege 4092 alg.exe Token: SeDebugPrivilege 4092 alg.exe Token: SeDebugPrivilege 1260 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_d3cc7b455f0d903f35aff9a49a88ee41_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_d3cc7b455f0d903f35aff9a49a88ee41_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2020
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4092
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2692
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3284
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1220
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5048
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1576
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD533f65f5b8945ffab363beb9057609ac0
SHA1fcc46878ba72fcf2ff694d3eddaca2bc48666f50
SHA2563315397fe61c2e9be294756ab16435f0396a4fd7e20e9b8ab36a96502e103c53
SHA51255f624292bd3d9992195816392e7fb0074679ad97edc35ba8c63a199056fe6006e0759c516932366ee04c3c06615b4db3ac4c2b450445d559f7f52ed3093c6c2
-
Filesize
797KB
MD550d24c7608a84b17a0cc07fd501b4be8
SHA1c0178a8178d38427a423c8751ec20442ecf0a0d2
SHA2564f8aaf80628309fb93474823041cf297bdd87fab5590be31ddf0fcf6fa0963b6
SHA5126eca81f5c34901a31f77bd5eea93fc0bdf583feab8f21f3b63d8283d5a4f56a5aa3166a634284c2be22f30fab61eb0c874457719d41bc80bd7db798e5ccb2eff
-
Filesize
1.1MB
MD55c516e7cda7e065169eae89c6a575c2d
SHA19b1f477789a015f3ff8259342f744544507c366f
SHA25691faa49a193db5a8b32177d030fff7942958062ee6fa5ec89f932028a7063a72
SHA5128dac1fba40e7da07ce4a9c27203bc642a85cacd34808e50b7624c087f29d15c2284eb5f88f8f5ff9cc376fcedc989fc7691ed8be6967cb07dba595e378b1e0b3
-
Filesize
1.5MB
MD5b93dbd873a29dd0ec0b1965d942a885e
SHA1230f2c9a53228975c7d95e68f973fb4a3233a00b
SHA2561be00874d12a0da742ad1ef81cf0f9139ca2fdf562d279438165cb2c35bffee2
SHA5123fd3aeca4c9ea6e2241f893debe5921f25f0c60c51db49109bfc99f3cd0ea58fffa10236fd40bbd926220b3ccb6d79b49d91e1846276a355d5b017547b5b11cd
-
Filesize
1.2MB
MD56abe9b621396bee856b705a172ca739d
SHA14c240ee0ed290341af6a5e20d173b2b084b9f9c4
SHA256eb278127d9a62513e1ae0c0d06cba7702e084982eb1218d78235321a28c84133
SHA5126aba96191eeff8ae95808f95544bcd5f1390bcf2b33ee0f60d3b21f429e55932f85a60982e7707d68119ffa76a8a8ab00841193549842aab4f271c723bef5787
-
Filesize
582KB
MD5ae745426fb8937dc1e34b28b1b1a7696
SHA18546966eb57748616cd657a87e8d83bb2e22625d
SHA256daf4ce197d5989e6fd923abf6738e3c02ab2155480d3bbba4b87f5a20a676907
SHA512e7c71e54c7b8aaf031b9ab08db5df1ebc4fca44e77846b99e971ee18ff502c56a4b1b3c15903db9fb593028fdd4e9bd4b7a8daa9f78f184170a66d8f59cc518f
-
Filesize
840KB
MD53a4bf18ac8b668b31cfd9f5250b9e4ca
SHA135a8f261cf92120983a1a6caa03204374ce1f071
SHA2565135afca2b4d11e2a50ebc7af5d29dcae6b99e872e4b782d2524c06a30536471
SHA512e676b8e5da99ea90a421ee816925b3ece42cbd74eeb65d1bdb9afbcbc820b1c48e5075183860c5d2f4473dd8f92ebb9fb77723b9ff72da0d89eed5613fbc5dd2
-
Filesize
4.6MB
MD522387bf80e82c3824b753863ac499b35
SHA19c71fd214aa046ef537d60e94d63097b3ae16b2d
SHA2567f2c1ad18206deca099e2485d3ee26b88592e8bf62afee5580c1adda4a0cd35b
SHA5128d70b7d0ce6dcf30c012bb1b8a944e5e5a794dbd746f0b4e85d6b45b9702c1cf9364fe2eeaab4b4780d67276b1cba5637e9fc36adc01ac0647cd85c9f8d310ef
-
Filesize
910KB
MD5a1bb23ff5b241835cb0c2892d1d05644
SHA1d94725cb89918b6d929e0afecad61b04d3f11d6c
SHA2561d9091b680232eebdb567cab2515faad239efaf9116c2ff3ef6363aa1300d324
SHA512fa801a925915029da3442ae02e2898184858896efed844ba88e401a4d34027bf0a4fe6877ea33037ce9f307449471c5951669767364b67bec80320e0215f242d
-
Filesize
24.0MB
MD52b8512dff4b2c40ad4fc107f46c3446c
SHA10b68588dc016cdd9930d7a6eea69be95231fb62c
SHA256f9d371cadbc11597d2a9870f5cc8151914b5a12681edaabbbed7a8548957145d
SHA512bc05033bfe266f1da79ca26e5d01f640dc8d3335139e9f5454f5793592b35b5a898ab690655bcb4e221cb49aa6d1822731e31d97690e5e210a1d95a6a11f0276
-
Filesize
2.7MB
MD563cc4eb2a6ff86f5f9dec59804571f23
SHA1024e9da2d40d2d4293b1d94143298a5712412b91
SHA256edf280b9631f10fe05870b5315977b138eeece8ee936f1b5de11461c884ccf23
SHA512c2b349b5c8eec7b082d3357fe6ef4370f6cdf407181456317f5ea399c75beb3090317480023ac5f9f9f8c00a7fa323857fad234343e66a4d53b6f870343a09fc
-
Filesize
1.1MB
MD5766e7fede25876d0131f83c4fbe71a29
SHA1d0ce1ab530e5a4ba1fdb7ba6efe0e7ed5182603e
SHA25666284e9ed1c09e96fc38f5cfe1b2480ef4e816494fb7dd2c82e4e98744c24d54
SHA51258ff312b0574aab7e851a43a79789c66a4b2341370e1af12fe1bea48c2d83e85577eb36ebd0a9b6905e0782da2f8c5512a3213c5ba00942e66597b1aa9bfc077
-
Filesize
805KB
MD543d6f56c7268d92e52569e2245a3e3d4
SHA12075a3bd4ddeeee9fc2e12ba6f9202aee3896a3f
SHA2561af814ba50666c3df51a702bb682e52d9f9513f5d2de8131e52e70451709c923
SHA512ea4f48335abd5b7a0f6fa599b4c2c9d4cd98d8fbf9584b65d27506e8475bf94a621996781778ecbfdfef42eb88263d616fc3daff2d654da93bbbafd87871a4ef
-
Filesize
656KB
MD5ed0aafde3a949d0ec656bf696597a6a8
SHA1cbb280e3b941732958f5461da2afa3037b115e9b
SHA25652fb774bc0d99a6e0e375feab446826148998d77825c42601b74da592c7f17b7
SHA512c6cc66ba1abee3b5eb28b803dbd9faa8935cc691534a233ed4dda19a99e7ee627c908be589bdd66d3126f1e6402cd65d56b026235305d9034681bba1a7ea756e
-
Filesize
5.4MB
MD53c7f9b1abf9dbb6e22a4cc08d3ed219e
SHA1d9b624ac99a4063950084ee78eb57c54fdb5758c
SHA2565cd875301bc6aaae155e9366194536517ac5f60e89427198f4b0f6ac704b2230
SHA5126e3ae7d6bfb9b3b70f5a17a5d47ecfc34756171c7974d4ee21a636777d41e4eef3ac47197dad37e75d9c11a2f0b0b50f9ad1d4039e7276c6b890b42c0dcb0fcb
-
Filesize
5.4MB
MD5ef1be17868a22ce7b50ece3a20f94d8d
SHA1ca08e4f2c7586030e2428a2c76b8f170b4ed0f30
SHA256c855d4ad163ae4f4fd362dbf803891dad123f3d6d005f178bd13245502a05d02
SHA512e3896629135445eff71243cc59f16cdc983fcc27f9324f35fa72e8840455625c227ed950b0cc153f268f81fa70b5754facd03bb0c051e5c94036828f4a2a204e
-
Filesize
2.0MB
MD563e58e3dd9a4c38d950d4e20874cf1f7
SHA15f917f4d07d143b6e6677c87e20a7c523e730532
SHA256b80426600b013fd438a75b0513e37bb9bea20c4b8a07152815fb8f399b19d597
SHA51294b9c596447e337b05480a55be145244cf1616b28abecb4124fd3708cfbb2c678a2ac2626fa4efa69a7b27a6c3661784fba63b1beb27cf6bd791a069da144be3
-
Filesize
2.2MB
MD57dc4ebb17439f5a653b2c3f8cce7e5b9
SHA171b28f6e8eb02f745128d8f353f1ee9baf4dae1e
SHA256da0cc51e35a86d861d03a3a754b0d87da512974e5c9475f8b59cbc278e710fd0
SHA51204220846303b510992d631374070619e79b3186ebc5a3ece8054caaae47b808450c1fd01f3844909268a7a8901dd40237b1c16b090e0046cb03a5716b69d196b
-
Filesize
1.8MB
MD5be45654718255d4e9c6042b10c0828a6
SHA1c0b4df010f00af33b91e2554f3281bd131c23d07
SHA256d12b2e8f4b4950e6d65944d899d9fb4c9c38127b1d3db7f1d6eccfc11494b1db
SHA5127432bf62bd1481cc109954d6c500e3660e489890d2b6184025f5221d72a4251721c957073610cf7c8f1c806a1dd80be913bd9428e29bf071c8980ac36b7104ad
-
Filesize
1.7MB
MD5328b267762ce69c321a396c735513c51
SHA103fecc6e1a051e238b8d4dae5e5dd328affabf63
SHA25602ca30e9b7394c3a26fc34b841723b96fbb2a67edcd44d9f41baf735b3b9da84
SHA5122821e78bb5dbe6d3399b30eefc744476503bfc4a4d2499bfb5381231422a3b11e6550d6810d71d354e5d0c69b30fb9f97398ffa43bacc999fbcd3afd05d7f295
-
Filesize
581KB
MD5007127f8f966aecc70bb267d9359ef2d
SHA151f875f4809302370c2071ac3887d092b731f968
SHA2568dcca22a374b8688ef64735952fc239f05aa984c67ad77f11c2a925a8b7bd4c6
SHA512cbdab1abfeda32cc6d8fc766149c42265cbbf44314db4759ec6aebeebc02fd92bfa256829ccd80fb5f40eb5a361073eaff70cb05e88c1dddf9be2eb8208a0044
-
Filesize
581KB
MD59e9d2672bfba65bfd96a27343beea911
SHA12f604fbc2d99b926c87067474e92bddef3c590fc
SHA256cffc13bbf43a061b5b8db60c5cfadcbb5ef28eb846fb6450730befe7ebac615e
SHA51237224fba1976518272d5e2d3440034fa00ada405570d935e607f1f55236ceecbefeb0f22a5339d34afe2ec883b35700480157062b81e9da5e2248970b97b084c
-
Filesize
581KB
MD5f161ae0f9c3e654f18baf7abaad80980
SHA135c83237baae8c3181a9bfb543c0e1593a3ca006
SHA256f24a67fe3070f57facff404023e762c9ccdd22c626a4f63a36d73893a8bf5818
SHA512dfa363ecc89094ca0a5f9514ef3751382fd66530ee3a83ef9046717462634a25be74ee8fc641a8e5f861e08669ab63ebfc488ab53c47482055014b9c1d84a7c8
-
Filesize
601KB
MD5e4dd81bd97d0724e228845d898cd2acf
SHA169beb4e5e13e920c5a80a213d1bcaa0ba26fb246
SHA25658783b82af028cab378cd455db2c9e181c1be0814dbc1b465a7bcc9f5fe04ad6
SHA512bfb05cf833408a4650007bb85b14b9a689a4fe56ab9e20f5054a41f5b2e7b4318d02285fc3ad71e65619af8d44237d507593a478a81d975291ba1f5bd7788523
-
Filesize
581KB
MD532468f08798b6420674158b345d7876c
SHA183cbb77f633545a263d3fcd919b80d0c555c529b
SHA256e86c7bab410e76fa3cdb0d3ca7abf5193117b00860d5625fd752dd7bb0468dd2
SHA5123d1233839495a7b9c52e37010b9f7d18e191b584a732d315916e1fcc28b819bfc117ff21123b21fc835388ee1e4d200af58fef43b658077ff96b632b81e5b191
-
Filesize
581KB
MD58b37b8e42f6e5875d9fc7368b04378fc
SHA1bcb6f97e0f112922070c246402fcb3bb26225366
SHA256132e5eabe25aa122b5aba9edc56e50e45002e83eb16fdc3d652656b20b175b45
SHA51273d783d99334af5339eebd1d039a8fa62556dddeb5639f20a495ab0f5a1f82a37d8c218764e84b974e382010bfc7e7651bc9c7811496cf427ae5acdaaff8db4f
-
Filesize
581KB
MD51a798b8b4ff5c769599f14c320b14f27
SHA1a00725c1eb5393cf019e3b647fdeb22e83852498
SHA256a30810aabce3cbceb53f5cf61359274bd47147e4cb2e17602c9d305cd15db808
SHA5125cba3e656ee2d61ba14ba5ef9d85a36752efbf23f19776e5bd08baf6a375a68b0c16da52e632210c21eff297ced5ce13cfefdea2361b814da72a2eeaee6a4936
-
Filesize
841KB
MD583500686e01a0783741f280a229e44a4
SHA13bd210fc06466eba62f2e56d84c8b5df6f9380ac
SHA256fe62f6fea20dcfa484144f4a53df58c63fe1c6d9e78b13008ff919290c58c7de
SHA512abc24944dd2f433fd6d1fc8d277e4a7ef5ff9cbcfbd8b571f7553bf16ff323b3bf8d79d725ab67a6b3ab28aae770032c07eef6601fe4dc3ac9ec4a70d00b03c9
-
Filesize
581KB
MD5547798421024aec1583b5d8c7ef1b4c4
SHA1f0e71137bdd57a0b29fdb14dc0bebe8dede719cc
SHA256583caaaa47d5418ec56c704f06cbb81c4a072752a13ea97205872564710c8cca
SHA5120aa80ab81cebd91137b51f3968a3d1bb1a5433dd8dfa2bdaeef6bf5e8f82ce9efe13fff3db29f6c22149ab07aeb48b6bf24571223595b90e3d5f7c37b11bffaf
-
Filesize
581KB
MD5649a25823ef9da40bbc398b5cd6d9d82
SHA13b1a0cb82a5f4bd33bc4e669f81a32183d42b9e1
SHA256b1c7966e6c995b9d4ebdff826e6a881dfbac402a8ce8eb9a0741e6c4c546f655
SHA5127a77be01204d2b7eae55374f44071995f73e5d65d482d195a3b02d15d6ee00397721b2b2d0e853113b2935d8c674ef8719b3bed548ecc5a5e39d01a778fc7487
-
Filesize
717KB
MD577bd87e62a0d9cb757542076d526f57c
SHA145b59c2074998dc6558430c5378cc5d46a56cc48
SHA2566e2226bc96bf1073c354804d931dc789c2e167de370bac9e63ced11e0ae946cd
SHA512b8913de0ab7e196aad6d95f7fa0f185383d2240fa6b14c31dde4eec14ed9061be55174d301b213d3cb3634ba8e03e4442c2be47733967353c5655c0c9b1c1c89
-
Filesize
581KB
MD51a213198fd657ae14df70312c3664740
SHA165909d3a435a8f7acf55ae586885105f314d70a2
SHA2567ace607f7c608d74d35492cf481c1b606c80f7ec2f9df7a833dda192932ed85b
SHA5129adf0ae877ca577087ce3253c0e4bf68dd62a21ececf93e9d4c6f6ea19f5960b57b3e010d9cd06366621adedbc34af6319ef80e7edfef8056ad84cf1bebad08d
-
Filesize
581KB
MD5dcaa69d3246c10762cea6a20705804e3
SHA125ff64794fe5b3d1fd9097b1f22a0e55f9f10719
SHA256e1b8a03c145866bbfe05b017459eb9e3f2796686517dfca23e27e04e3c84a0ab
SHA512428b0221714b4ec84b6fa4662c3e9541c613132238e3e084685579d120e6c2dbdc61c592e7cf35e21fb22664fab78065756527d121ff7e3b569423161e27e7e4
-
Filesize
717KB
MD597fc5d68a6bf5f07a87b2d0354ae5821
SHA1ae430b4986c49bc4154c36dbac6667c0ccffb5c2
SHA256004754e8778afe0a00b3f8664643922c761ca28ae685764e3f5365622355c14b
SHA5121edbbac8df1a236c446c10c0f73a59583a93a3558677cf513793e8c30e3c4c8c9ff0c316c8145d6b764210dd8da5d825a7c3a9dd15897dc8f96757eeedb189db
-
Filesize
841KB
MD58499831b90eac2eb6c02671b792cdd27
SHA126dc4ce55e402340a49e0f57793393fe8364a599
SHA256c2462c4d989d4b2371ac4f38f3171c8a6344c620fa2a278b1190b7aa357b023c
SHA51254fba4cbc80c9d6b4602f8c8563ffdcb391983f86abdd4753fc7b66bcbd606f1bf30414fae5ce7841cec4cda630fc39c3118788b52639333996c37c801162fa1
-
Filesize
1020KB
MD58b4e6732e8c35a398f3dba5eb10c8666
SHA131ee0ffe4ade3c83ee92e205a97971acfac8116a
SHA2561e58f16e23e8274e04c71f2666124e3c7526937f2582186b457517f6d28ca9da
SHA512395ef56d35329f5c43f8668ce86d668b1c11c20498d7df947dbd8468c1eaa838e9c6bb07a4e9832cae8971aa4e19b5ece4d531c5b33f1ce361ea5ee01be0b64a
-
Filesize
581KB
MD58964ed3ddac6fd3fcae47c27301a331d
SHA1a77446add2d910e3065441d64344907602901884
SHA256653e20efa4a9cd9018b3ced0287b04a802352b56f63537227468f40ab86d2e9e
SHA51235a97bf5be4190bd3f16a9b914e679f0a9df14c83099da9df5748b42907c50d7467254d61ea709c2b9bf114c30b4cc147120da0ef42851c24c2e6ac9bced9a77
-
Filesize
581KB
MD5e1a84f7c835641eb50819025c4a985a7
SHA1bb6fe3860596c783b6867d44b82a83ee333cf590
SHA2565f041645e63ee062dd9e4262501972cf49a0229ad9d7e0517ca3d3b7216369f0
SHA512454358e6e6a8e084d2a0e368254149aecfeb7b5d91a7846b3aea7600eb5bf592cde24f4c26484ce651cc24f7ec31170a4918465b25227741af73cbe549f1c3a0
-
Filesize
581KB
MD5072e8ad628fb89b795cff1e3869b84a6
SHA1f175b22b6bfc6b09dbc450ca5bd66dc34e87c06f
SHA256d002e89f6e3b7b8488e7b7ce35d52de51dcb538af78a428ff1596230073b1b71
SHA512e5f389058e971a427dda554fc11d20393c65affc0e05f8783f9074531a41b9623b55330af4988d55a3ad69d1eefb9d01fd70ac78e3263698eaee6f536afb604c
-
Filesize
581KB
MD5015f17838b127a93caa6c4aca91d27a3
SHA1643f545345622339791938975b390fa6e8c3dc26
SHA256d62e231c0413d39094fe1a9d9f64aa5b6e8c55c0845c8a8bdc1dbce242f05df8
SHA5121d9c15568810a7b72c69182a4a0980de27da040be54691653fcf1109cda50e68751bf733e6a4f80064d69cf43c7a080550e66aed314276ac2137ca316fa6d131
-
Filesize
581KB
MD596c7056ce9b18917c84e14b44ed40780
SHA18e844d648f6463dffbf6dd7d7fa2bd878f8a417d
SHA2562fb03bfe0831abee382f76d713219495aa9f38286101b8cec751f4eddb0c367a
SHA512323be892d99feb3ed69b7c8c28531e10b4d156d61e84852eebc8dcbd7fdf1388e126a9ff5149bf4474a311cda1d413e9763ec92fa299880dc020972ca2ab0613
-
Filesize
581KB
MD539d3cb76d0c207723060b41effab3a0b
SHA1a28eb9de92c9b21a55bf43cfb13e7622d06ae06c
SHA25683b745df24d57c97bd60b92e4743a3c4265efdb1628aaaa633cc67df96670cb9
SHA5128f62df4dc566dca7c7b14a98a197a73f18b366dadf31377688705e9c5c944dfb3c670cfc31f3bf05213d0eb4b0f86a66d6c2e20deb1c0c0cba4568c254fffaa9
-
Filesize
581KB
MD53e7dd95766d8d7fd7c73da52255830e7
SHA12e4335ca5ebc4c289889485e466cf1fa5218967d
SHA256de301828795207386f95c09ffbb7557813169af4aed59bc4864b6e8f11c1fcdb
SHA5122899820a165d09e2408fc2404a5e125c06d35ff551702216f62ee5831e9964bf4dbf283b8812fbb934119c824831761f15e4b9f75947f84459cac532de3519fc
-
Filesize
581KB
MD5c9f6790610846ca2ce37af923bba274e
SHA19a51e79d4586c5b199e9412ede5d2904c819edc7
SHA256721a447e57ceca4445bceca65cb286f0ff823713e6b805ccf1e748a4289b8536
SHA51261cdb383a6e59430d4dd64f0e9e638a0145895155932367101e939923fcb3a212ef7060362adce2620935d076816481e4aac2fc29242ec8459578782574850f6
-
Filesize
581KB
MD5255a1189aadd0b1dfca3abef45fe979b
SHA1376eb5dbb5f236af483ff4a3ecade701345a81b3
SHA2568f9940df212fe82e61de83156aebd018c501da5e11c3e29ebfc621eb6b5ec59f
SHA512475bfed969acca64453afe8247bcd716cf3504ca9ff9dabad77ceaa3467087141998379074189bb20d9bfa76e4febb25f68d2853510069d198c449d02b0b343f
-
Filesize
581KB
MD5292bca2b713b8ff76a4e7cf85bf38139
SHA1061c0c667704d037dd92d3c44f6c04b8e3e9c254
SHA256825cd53185904c450311e798d731e5b6c9c00a61e5e4b78cc378a9bbc664bb1a
SHA512ae8638edfe6b4b08d8fd387f584b50488482e37c6129e0380b5c48cd84b5360b6ed8f4801f05816fc70a3aa4cd32e32b1890b6f234fae92b4318d0375ee26e32
-
Filesize
581KB
MD5a384278a3e6aa9537d11c5f8c369cc7a
SHA17a956f6acddf58f7066052acac186c756cb58e7d
SHA2562db20283daa9826e9970fa73d04eef33592cdcb73043f58c571a478b3f09ae2a
SHA512a512a0388cca76d5a5a55f6922174563ec484fbe2fa958a1376213ac260eec4e78a11c11291dd086c7fa3afc87f2db9c72a810b7b5c80171d7aa556461e63a54
-
Filesize
581KB
MD52f324f32a391df2a65f061a64da6a87a
SHA1a6e6c5d4f0368b870014e13943e2fc3454ca41fd
SHA256f8c94d33d9556ecdd67ec9f35ee98797854180d13faee3ca203f8bacc74b2468
SHA512a380a2a70d50e652545a00fba67ff968f8227f61f98884218811b011a88b6076db369b5496f695020f898d4976cddbe8c798fbe733c7781025724da213733fd5
-
Filesize
581KB
MD5abb1c4926baf5056c9c4a746a86cde8a
SHA1734566dd002694f2a6a123cf6e5ba16c24324137
SHA2562ab51b056949955171e8179a35bfcbb9672b9412d95bdbdcc5125cd51ca0f30a
SHA51212095239d8f0e094c9384b816123239befbf78ef229c9e20e4b71db5b33382fccd00e0ae285ad62d67507040906cd0322c36a3c94dffeb43075364f84dfd2cfe
-
Filesize
581KB
MD51d16321e24c6869168ba2b9a04f1db6e
SHA1c4fd790d1ab6245dfc816c9a4eaf8af1c4c22b43
SHA25661fa2b4b6f538765b69e913684480bb90781cb2567d40c07f84dccd4926a4e0f
SHA512ec585fa0d4ab0841dd319ffe8ab564db2ee56f2a5adbc5eb5dba73b0b3afb2da88b039cb98a3ad99e5084116f9af9f5d095e0450312390a61d237440dfcaf45c
-
Filesize
581KB
MD512bf54bc66dc2af3afdc94aa809cdabc
SHA10d60705db262b0c7da2085f44e91693ba9c71b93
SHA2564ff364a128e6c8e08ec9f8b8430de43f89597de92c53f8389edbbf5d83bf1f01
SHA51260ad1ed988c712f92957caebd7e4f0d020f8f630d005b8e8fcf40a16c70633946027cfff9dc596eb1d163150e0606490df2e35e0446fdaa9a57c6685e940a795
-
Filesize
581KB
MD50a47aab2b19c5db6614806389803637b
SHA1731fac60784f56ebf9251381d78b3eb153071073
SHA2563176fe05ca0749705347dbd013643d061295c67f929fa0887cfc5e642e780cc0
SHA512372fa6122d81bc223a91b576441c4a9498e6bffda3789fdebd409ecdc9c1de14d30191c775076fb618a5419c5466e865ebae122c7b7d06aace1eaa546e57abd6
-
Filesize
581KB
MD517e88aa28d4959af0a79cbd2dc79afee
SHA1f0c986ef94fccfcced4adc4cab207e1f4220d8b6
SHA2563145f80e74049e69c896e992c6e540365e7847c948ece7bdc339a9e121182742
SHA5122946a64fe9e819ee32414270f7b47d2c75b1f3f060d4d596821a91b33d213cab9b84ee0cb91a8961e192c14246f89250c6f02c67e1032bd785b787dafbf9e75f
-
Filesize
581KB
MD5ee8dbfa7d4173115d801ff675006d554
SHA16ad925d630b85fa6f93ebf02bb108570319e00ba
SHA25610932f899c5e307bd52a5d5018e4f1408de7ce2baf579e40339df065485e5295
SHA51221163f7681ca8b36957df5c39d83f76d338074e7daa1df85dcb19c10c21ade7f5ce2ee431a98dd44065fc79d48dc019beee7fd0b3f186eb6a6bc0fa769980c49
-
Filesize
581KB
MD5cc07721fcdcf4938e522a6050a67625d
SHA1641ccbf5f530adae96c87ed3918f6a74974c1a2f
SHA256019ea5a4af75102aa74c54d50afeb584d63c5860b5533a66682a9e487d84efb1
SHA512256d0886caf9025e3d7c4dc81c7db7924a2ac2dd846956d981f6fefaa3f2afa0b976a6e8ff721e8d9c7996ebf7009f7c1dddc00d392624eb7d57c5eda8e70e0f
-
Filesize
581KB
MD5fb771bc12b7cc371c70e8ea7efab2312
SHA1b8791cd5352a1090c99e5b8747927c164be3a82a
SHA2562723dfababc0d344432afd6b68960e27c3dea3ba04c4cb3dba26d5e0c92995a3
SHA5121141a01ff235e51065d7724eafaaf07c6283318233ab99bbcac0bcf2d8edbbc2b5f1504d67a0b458ca66129b6ff3b06a49b9bc5ebd3279d99e4c90a043c52314
-
Filesize
581KB
MD54b22378b0d4bc2e036b2f2c9415391f5
SHA1141af4755ba9b40e97474a2b48e1f165cc9b3588
SHA2569053d8b367ad53665643405c468b1b2d0cddee6576cf8fa40878053312f33303
SHA512f0b89928de8bec39518026f36c7042277cd8bd2a7b13a13d5303425fc03a82fbe2441212865d93945c2002af62eb7e5a3d95903b9af066fb829dfffbabeb04a7
-
Filesize
701KB
MD52c7699a14f03bdcb56eb14036eb939c2
SHA1955a929b1de3b2a5012dde0d49cd81df02040c4f
SHA25609d1e1ac36afa481d42d9416cc040b7437afe69f6b648923bd76036f773d1c8b
SHA512f220505c0724001a236635f72f6becfd3591f9237c9dfeb9d257c8a8a91afdeb51682cc3f377d922abdc9393afd045e1e2eb7bac07716f09f2ddabb69c436f78
-
Filesize
659KB
MD51f0286a3a7af604995d7b42c86616894
SHA1e79edce65477ca3815b0705188cda3ac78964b81
SHA2562d25ed22cc9fd456e8ac0d8753597602195b2cfc7e5164befef5436f7879293f
SHA512c78bad4f57e6e9496a0c51e07898002260beab58b4cdc520b629b8b6af8aa1df0414f79ac178746c7863866d51b2550264c3aea9fdb9677315c196c474cf2737
-
Filesize
661KB
MD52c797b7fb07f715690ef621f088f2a00
SHA1cdd9deec905d5c2e84e94272e5e61531225d14c7
SHA256ee5e3803dbf878a1fb7efbb14b53aaf18a474107cce813a855a5bcd3e3cc92e6
SHA5128ce1c0f88fbca9a4b0f6225c21c8af063b0ab3f578bfb870f2e1dae07adc796efb832dab69cd3b65a6974a488f523bcf8c3e48861651101aa81c6abd09d23dd8
-
Filesize
1.3MB
MD5121d759b59bf85f02200056fc0678c08
SHA1f7a14406027f794b6e162b8f50a14ba7e579001c
SHA256126ca13e290a275f753e069592fc3a775177bab9191e3547c4b2527ae5bfac49
SHA512a49f5fdc35edb5583b1cb5df6d1e67ad35463b07b987fe31c9e1e3a7b57cfda7328ae87bad1997b7f62d65b3b538c3566191717498b0a77e98da9071612bdcc0
-
Filesize
1.2MB
MD501dc572087508fa08d9d1ee7f19dfbad
SHA14d6ca954fa395b5bd80d0feb404a2f24dfe66e11
SHA25614cd6da4b694b2cd7fc7aff38fd5aba5430f323c1308cd9902a1fb05a4405bd1
SHA51276acba29b0e8321436fbe16516413188fdba3dd593a32c2c174ad0acc3f01f50769cbd5e43d82361b53c9fb6cd1238bcbaad613493208b123e0381f04e71645e