Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 17:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_82f6cc5617107da7eb58a7e7dcc86556_bkransomware_karagany.exe
Resource
win7-20240221-en
General
-
Target
2024-06-11_82f6cc5617107da7eb58a7e7dcc86556_bkransomware_karagany.exe
-
Size
677KB
-
MD5
82f6cc5617107da7eb58a7e7dcc86556
-
SHA1
91f316291f96eaeaec789c3655d99946d6be029f
-
SHA256
2bf935a1789b2a9527b5dae3bb79daec94f230a4621fbb0e7b90e8eacd930503
-
SHA512
0e310529cfcb2c3e863d2659d2b821487a6c8c1cb9e5a0c407a5467605fbab7520c091688478613a7ee99ed539a2460799ff065fe9f28f59c92e24527e695a22
-
SSDEEP
12288:mvXk1bIUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8M:6k1satr0zAiX90z/F0jsFB3SQk3
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4872 alg.exe 3616 DiagnosticsHub.StandardCollector.Service.exe 2484 fxssvc.exe 3664 elevation_service.exe 872 elevation_service.exe 5092 maintenanceservice.exe 1628 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-11_82f6cc5617107da7eb58a7e7dcc86556_bkransomware_karagany.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-11_82f6cc5617107da7eb58a7e7dcc86556_bkransomware_karagany.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\bdef67bf92be0f3e.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-11_82f6cc5617107da7eb58a7e7dcc86556_bkransomware_karagany.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-11_82f6cc5617107da7eb58a7e7dcc86556_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-11_82f6cc5617107da7eb58a7e7dcc86556_bkransomware_karagany.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3616 DiagnosticsHub.StandardCollector.Service.exe 3616 DiagnosticsHub.StandardCollector.Service.exe 3616 DiagnosticsHub.StandardCollector.Service.exe 3616 DiagnosticsHub.StandardCollector.Service.exe 3616 DiagnosticsHub.StandardCollector.Service.exe 3616 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1984 2024-06-11_82f6cc5617107da7eb58a7e7dcc86556_bkransomware_karagany.exe Token: SeAuditPrivilege 2484 fxssvc.exe Token: SeDebugPrivilege 4872 alg.exe Token: SeDebugPrivilege 4872 alg.exe Token: SeDebugPrivilege 4872 alg.exe Token: SeDebugPrivilege 3616 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_82f6cc5617107da7eb58a7e7dcc86556_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_82f6cc5617107da7eb58a7e7dcc86556_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4872
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3616
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4792
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2484
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3664
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:872
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5092
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1628
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD57735e76197826c11bbfdba853e0eac3b
SHA1744639fb1086f55d18fc32484f4101c09ed527ca
SHA2561940b3ca5587434d4d30d7206301e1359a81ddc3e7f44ce8a50e4c2bb2b7879a
SHA5123c1b94baf7a75cc9b0a86582dcafcd40e814b68a9d7f5a5bf23fcd180dc3663d37f0ba7d059d2d207830d9ccf29cc0d4dbc73e4be4de02f280278009b57f0e99
-
Filesize
797KB
MD57d48cc69b654f96b3ae819d293494ce5
SHA16d8e433b4a62576eb4ff999bd85e1b4ca89e0f5d
SHA256d6ad354608bfb00130e17c6cb8de88bdc59df13d292a72b9bb7010ae2efce4d3
SHA5121fa9576f5534f22616e67420424380094841361ab0b95b3e347c7ecc3c6bebb4ce7d20708ab4761ad9b3d4884b2a7a750c42212f99c6b5bea75a32b2448ef934
-
Filesize
1.1MB
MD5230f907a87ae40dbab7e980e25cf698c
SHA1afa3b95d01c7555cd170401f0a1ce9788984d7b7
SHA256beef069a082c8a1e955b25b1464b36397e5cc3df7bb54d685f1b9280424aa41d
SHA5121421881fcbdcc881e2b3819bc4b3e4ae8540b2cbf9bd7d3f1e8548611ca60bf1d49c4dae007df76185d57677d6c612361cf73eaef2078d5e7f67fa1add57a532
-
Filesize
1.5MB
MD5691e895e915cdbca3db48a4590876b57
SHA14d8539919acf40aa56149bf7c86b68a62de5dca5
SHA2568deca76f632f764e5de346431822d23341da0ae0019b0e31f0630f347f4f7e5e
SHA5127e0ba39f03c3ccb4b47c64a2848698577363483c05b7385fa07a36ca667997aa0066f7e1b7f503b2c31d9aeb46298497a252b974d932d719a42759198b642b1d
-
Filesize
1.2MB
MD5374aae1484eb57587f1fd81f1358e237
SHA1775fa459f6976492d2443f771c681937573f4c7f
SHA256ac83ad2c5d716f26185e015e6920061e56f896224595c84a06762630ed5f0ceb
SHA51273f56690a67957890cb107ae36688ac49c08164c2d32305423a4ce2b81ae00a70244d5574b927b566b54c6ebdfe02b6f9365c301f52616b5f32098c08d0b4f15
-
Filesize
582KB
MD5625bc086ec81f16d38eb551b4fb5bb38
SHA17a14ab6d79d3c8be5af1af290728a4d659df821a
SHA256d239b500331d675407d0e4ea4e841f95ce79b38b4dc74cca3385ce06e46587b0
SHA512f3bf29f8b9e07725cedb0f0b5a6c71c5e60daae597e1ca0ef1700832ac84037f880cc53491c1945069294ad293faf09d6264540863922df856c6fee0ddc3dad0
-
Filesize
840KB
MD577779e4657ece671d4579f986b4026a9
SHA1a4852b59a1bad5db3f5be072af126bd41c59484d
SHA256028768dfd3b7602c15f2c38c52857d95733ec8c835e286ddbcec197f783c6e38
SHA512cbaabddd75a392fe760a4b5265fe686b0cb6f099f3a2a2c38d40deffffb31489a8fdbf9be5c3260589345f84f5ab71644c0344ea74553c403710d29691f1e71c
-
Filesize
4.6MB
MD5ef4f52aaed98dd7dcfe8ebf0cf52813a
SHA1ad653c06ca5090d64cd029951d4b461c0d5a1bd2
SHA256a89ddb4fa7d77864d7fb6f2b2db0f50b62efc0921fbbb498b2464a4d939a67dd
SHA5122589742fb17869a2e90569b760ed0fad254aa4b194da0e6cd2d4df40bdb140fde881c66119dd52ae42cdda48a2ae934e2e97e8bbda074bde569ed7e2294f1ec6
-
Filesize
910KB
MD5160e9da137b5cf58272001336ae092ea
SHA14aaf9ee1d2e41a79edc63ec61e3f0ff5fb3c8279
SHA2569f704efa4943110616ce6aaf8862c967fd35f9fd2754fb2dbfa450b77e2a0b07
SHA512c9cae97d0f3e5af2ba92895db2c52c3dd5ded8d3783dbcbc82fdbf114224aff6fadef7cdbe7f3ab6b3a029cea09cf1825522cadc350c95afc6a73fdf64360240
-
Filesize
24.0MB
MD53182127f139bc24dadd0cd006c89b735
SHA14a1b22d3dc67cfd815c50acf7df2cff4e2978a4e
SHA256af4aba2e9956d230470aa4aff91bba13430675c3f62c15bc05cf37ebeafa851b
SHA512225995e0bfaae80803317065dcb101d50ccb12854c857774a99ca141af6cf55c16e10eebad524514b27190257dc613e196e35afc61a429b13d32ac4ac7a5579c
-
Filesize
2.7MB
MD54284a924274537a3911a1e8af09a8977
SHA1354cb11c07ee72b9a4d1ad3034bb28054ab70076
SHA2568dd27f267dc25c781d9a1c35dff1751f3a59b5e3ed77677c235fb254fe1f3971
SHA512c08da9797de6cb2806dd8e3c4b25cedcbfe07a2d4b09bcfaad40efd8402d104875b064218eac14c04ec02f8bb1ebeea5c0645bc370ae34b69a2a5b3ee3d2579d
-
Filesize
1.1MB
MD59107f75ee585a65379ffeedb78d26aa2
SHA1c75f07fdd231c88ab57b8823be9cd50d617e708c
SHA2561eabba3221234e167913e78157c78c3315c43a11b93f69c6766a924c73cc4432
SHA512cca0a97b52f39e0167ee218f008d04860b18549be49453161ba47d4d720221d633ab6593c7673dfe1d74a65abd1b46d900946291ce478fa984bfd9575aa53236
-
Filesize
805KB
MD54fa2d0d5baa0de761b268486beb9318a
SHA1ca9bd788673bb5ee5a3d593f2883ff18d6b185be
SHA2565eb562c6ff32beee39594321a5b9e73052075eccb5688fb19d19d1b81502395c
SHA5127d7ad4eb923ab09ad0809456d8f9de6acbb517f1aec548e3c756d5d6a15a690568ffc7d4b2a254e80c01a6f780c9c9d92f148c738756074811feaaa0fdb5520d
-
Filesize
656KB
MD522abb0559632605e5a12a250df747eca
SHA1886e2169fc8ded2caeabdd2116511dc95f34d4e7
SHA256362c5955f1a0d7279e2aa3bf572df86e3cfc0b548201fa96a058bf849e66828c
SHA512aeff7fb5250c7b39ca7e9d9166202338ae577528de61717e8b05caca5a811499877f2005fd1f7524607ddee295214b7f00f7838d3cf5ded814312b2eb165088f
-
Filesize
5.4MB
MD558ecee64b1f93968505fa4430b669aa7
SHA1b2440a730385e53d0e05df38b8b9984b00b6256b
SHA256acc122568ece7b16f68a4f46db2c65b9ed5b48d467f53d6c4aa4ad1879d3f078
SHA512f9a08f3b6ed6531647b030755f60307e546cca7287d8ff7baeb3b7d3d17d6bd1c61710ee366a9c800e29ac627d53b9755f2ed4024441e9c0643984a62f40344d
-
Filesize
5.4MB
MD569ca902c66aefc886a23173119fb6219
SHA1a039e537588363592467b95ca7ab946b32aa80e8
SHA256b2bbd25aba23a0c9ce1400d23260189897b61f798031627182dbb7ee17f4e15e
SHA512985e35243832733453d7d7e942722a9fbfab2fd61990c2bba43eeb6ffb33d39ec21c519ece62c3c45ab9231c7470c25005bd92b68a3d9cd27b6692d0c4709103
-
Filesize
2.0MB
MD5ba0ea7434645b69bceb6781ecdfc018c
SHA131c12c6f070f092837a63c30ed7a9987ab28b9da
SHA256864975c585f3e14e4b1a4a0fd798359a30465d35094ec5625e22d5581b617e6d
SHA512feb15dd31180dc7067f0ea54a3198d78e88ab70a941cee9f6f72cc9533fe877ef89ec39a5b48a4f951bf12627c0c7469d9cc043fe2e07230ccfcdcb484a8271f
-
Filesize
2.2MB
MD54c05ad00e75337654adfa0abfa831a15
SHA1eae0a157a8dd6c7142a86a52072a594d22537c44
SHA256e5ccdfa4d16eae2539dc220253c0203d08c03a68cddbf66063e2916c55fc55ea
SHA5122f437ea7672dd228992cbdc0fdf3ef04740ea011a0a9b5fb9dd0c3d9b7287ac95b94588f4da029a51f18936675d0752c66d7bcd412f33cf75fdb93efb9bf8d84
-
Filesize
1.8MB
MD5fdcf6b3c0e4fcc087039d5d56249a615
SHA166b647d0761d5a1c5c804aba90ab1bb8bb1a4622
SHA2565d31b573e7867207a511133abf34ba44013dc20815f168faecc3d3b8906aa79f
SHA51236a6701beb4b1acd7302c8b12686a14cdcac9cf27ec667931d8f68550a88fc4396bce540eb7b4430251f13e2bd8cbec76a6ed0742bc355c4f74255db808dab4d
-
Filesize
1.7MB
MD5bed606f6062b8c7af841fcb6f9c28eb9
SHA127a0e365b44cdad11eb86f297477adaf2cc229b1
SHA2563154ae252fe5d3fc713fcaefbc2b28ceb0ce87a24736514c6cc8e5b246b02d76
SHA51246e78bf204a31672fc9b48a8b5307b777e2f5f0c00c35b70f01dcb4fba5399371107c177aea06129c7039c00fff86d0bc6d5cf4b262541d184f9eff77c1f4405
-
Filesize
581KB
MD5263b221ad3ca5e35fb26784bfdbce1e2
SHA147dc7795b162a18e3aabdf9fef366983f5a03e8b
SHA25650d8e120cecf0888997841273566b862b58031fbcc2b78545d66609602f65c3d
SHA512308e2afdf54550b60a86707b66cfacd5de25db66d7687e94ab1178c6fe4395f28f56a7d6adeeb668f8739fdb11663120040d66fdff89b36cf2316bded55cb5ed
-
Filesize
581KB
MD5f440f170a43c815b45887a56c33fd1ce
SHA1c2d5827a71f89957a3ad3b2c25e2385dcf3646c7
SHA256a232075c068643a5d1530ad5cce3626bd6e49e391b293b94279c7af577daae80
SHA51298e66e3edef8ad9bfb0a794019b31a9574321c4f985c3f11ba68c5eb3a0ecf0143f28974a1acd261becae3f1811a02be51cb4d71bfc601928008d546c51c059b
-
Filesize
581KB
MD5a9986aef9d1d277985149297c2657b9f
SHA1f77104537dc6c4d8b446ca576de50db5608c11a0
SHA256699073e8064c9a5dafd375dff41e2a777d3c1de46165036370022d9461896923
SHA512a12ddbc351e80caa5239906a94e7a3f3c876c1ec2ad1e05844b25269356d8bd3cbf5fd7fb1d39b8580197f7a481c6a2fadfeba6d672d7937dc86ad0e06ce3646
-
Filesize
601KB
MD56bf70b62a4c3ebcbf7bdd8b397ffcf03
SHA13686d7ba2b1132bd86fdf6e76f5e6042b684fa19
SHA256b9d2c0075cbafef32ceaa4fbd6e89af9b17b22057472410d3c5a0eb69dbe11cc
SHA512bde4c215b49b283abb0be6d396e9e6c0a067bad4ec8c0c3866ca9e0403bb98e611dacc852a025d278184f1abd7439dfcb8979cf170d9182d8667c64b1b5a3090
-
Filesize
581KB
MD5233552386a78258fa87b2ef488f2f3ab
SHA1b3832101fb445fe5f37a01a195fe96f03f6bf346
SHA256cfb025cec24d80357cf11623f4ecd902a3c0a941908791b041a10b57e84eb6bd
SHA512e251353584fd0385951aa2da40bd30740777b2e14da1fed8473191132f677a4c6b324e053f2a2726ba95ea89a4c76362cb4c6d18d15414dfae99cb0cf9e808e6
-
Filesize
581KB
MD592ad3d463991d51b6eb118019c6699cf
SHA19217e9688e76ca82f941c7fbbed485769572022a
SHA2567658d182986a5ee1cf61754e66a0f992cdc2e6fd6ef3b63c9f058f87698ac840
SHA5121e01cf982b8eae12230f0defa050536f83511ec49b3be3ebe55cba83b5835e73d61c2ff1b619be0a93efd8e6f7caa9922b54da50c6711f8271856743c0900694
-
Filesize
581KB
MD513e8947b029b503ba36c1ab7aea8bc3c
SHA185d4d0640ea89b155d92a50341b27f23dc988ad7
SHA2563d46e40364a2a171b77dd07ba5f0fa110bc1d80864b17b7dece4a31b324acf0e
SHA512452e69df178ef98f8bebcefd223b519f8a170a97781d8fbfe24b895c6e3686b117aa567fbfcb9b63fd55c797a47a5708ee45218d72ff622d839bf00d94279169
-
Filesize
841KB
MD5e250ffc062fdde57d97293eb4e98231d
SHA17ec95c4c7e59f37553009acd152693008c5420df
SHA2562a48fb48f8772f9434b1dee06ac76b0522c45b6150cd70823b11a0a0afab0c41
SHA512503e7cf72bdc798477710b0e560810f4b572bfcd14add1c1dc5dd6561035a38c41c057ac6dfeb169b90a443c4c9d4232a47780cb865fd04654168ee1ccf90b5d
-
Filesize
581KB
MD51c845da7b95d3fd67efc05bdaeda1ae4
SHA18e23e8b325e857b34cdd898a50f3a01870c64986
SHA256838813d432ae05d49bd148168b8b01bd06a210411574e26d029fe67e5bf809ba
SHA5126a27b2ff941841061c794c09749c83186bfad8faad86a8312a130409710469552cbceb3cece908fd4430b002546aabb5d355b51b85b7a4c692f74d0973fb7434
-
Filesize
581KB
MD523bf56a1889636467eb3f57454cea08e
SHA1ebb64ce4d36798cfba31295b548b17678f249bbe
SHA256d11e1710476218bf5f2b985553f62b819a5185cc2e58bd860da83931c75d83ca
SHA512433cf8abf4bc71fd1c2ddbb3ae8763876f778541c729e9284c455b1088d98fdceaded13c635fcb73cdc64803cad4de6ca842e6efdb39852aa7005fd8dd7e0d6f
-
Filesize
581KB
MD58901cf20277c20b1fb0ac9a7c61c61da
SHA1d35c1ad1b2b792d38fdf80541831ce04d23b96ad
SHA25625369fa5bc52d3d9369b80b312be257a5c18f7a5f6480c8c753824a034240394
SHA51232d39f66fc8f6d481be31fd822635993a1cfd8766114dba0bb5bcc772abe83c4f74da76cd2a20047815e1e1722a52584c2dd34890f85eda972b18178e14c60bb
-
Filesize
581KB
MD5c740afd82c0d3f5ad82e3c54a756a748
SHA1d863bca738022f20c08d0779fdfbf31edefac231
SHA256524fa7c3b4460db399499f38f22082202d1e3537ba8713f4f30f167f638eae74
SHA51292fdce69a3338eb980752b5da314ec768fd055aaaf6dac36f09d1b76faa0efdb1d986d90ccfb114917abeba3b2b8a53a2009f86aa74f28e110c620377ce4360d
-
Filesize
717KB
MD53ca10315b68951a3d61ff61a3b70e649
SHA185804a3fe37e4148fc8b5299b7f32e4c5361c5ec
SHA256a8c588ebebdc2958bbc2ca81e27594c6fddc52e3f3ddeee19d1a613d6a53c32b
SHA51277547042032c84762b8f3b4303421122c4e8de0966061eedf2b896669fd867fa139c054a810bbd8f23cf31e9c6fc7ba748c095cfab07016b2186319a62c806bb
-
Filesize
841KB
MD517fc2991c2c7549b0c3bdda9f6f0a216
SHA1c1ef0eb903ddf63b8173894843076536fbdab1d1
SHA2566dddb545e4afbaa0a47fdb97ffba2d673d43f0b40b2fe01850fe67d5e9f4a5e8
SHA512e4c86d862c6171015cedf215c3c1a80efeea1d42bf06da2c83cdb6853b0cda7915cf430d9c9089e4363641855d20b696da456fb9bd0ba4fbf1f670f8dd4bf357
-
Filesize
1020KB
MD5f171bdc47e723cc28fedd06aa67cd6be
SHA1ddee717ebc1041cc345343b2c82151df98a5e05e
SHA256be175df4403c2e70979b61cdd9a472e72b28956501b9f11fcdb801ac31e8f855
SHA5127c174a7f1de3b97b3b5fa9ddc11ed72b9122642a90f96b226267b99927f4b8ed6a5d8c075fa0ac1ff1df040fd57e62746a546277ebcd159c805f0f53bcd17f94
-
Filesize
581KB
MD59e1bc102c28a35b9a06af96bd772a15f
SHA18c024b1226641b40b93eba973bea295dfce1291b
SHA256aff70752e5e1e261efb4c62eb378e00b76e19b1c8664ed2fe47f90178977a69c
SHA51298467308c8276429010b746af40ca5f6ae47a1c12e5d4331585687833a2c13874d203c29a06ef60ffb7f8836521f8d37a314bfe08ad7eeb879ddea6af8eaa582
-
Filesize
581KB
MD512c754f3b0c9f4b768e36428a3c94ac4
SHA1e5da3000531e5e30f10ef225017fc60ea3a8ec9a
SHA256ec686aca565434ab746f70d756a0ff137d2555b7abb061bb902b2d839bf99bcc
SHA512727c2e21978f67037ee3734857450feb4ec7f60855b604ffc8890358aac99c8da4aeb3d467d7fc3b0ab8d62816a5f24696d4c6256a4fa503785056e8faeed874
-
Filesize
581KB
MD53e9cea0d8ae22710b24b8c573854d566
SHA1d497e3141c322f6ebf613e93b9d12cec359f2547
SHA256876963d7c12165c5f493fe90c9a4009d1c5c9a7895a52031aa0eb79e2e2d7b3e
SHA512d1f748b2dee1fad58511d035e9b83e9f8a975af9b991d18c7e6d05948009d4687dbcce06e9bef1374f185b62903e20d1c59925c07ce464b527a8d826aa366594
-
Filesize
581KB
MD53222dcaee4ef8016ebdd4118c50bbfd5
SHA11f171dc78f2253a9e5fce2f7d50100501b2007fb
SHA256cf0e89242a86ab5bddc6eba5e404e9659a4527892e6109f090b1bd9b691ff8f6
SHA51223e4b35b607930de5742e288764e63cdacfe27e70104d56826f4f94f5be62be6d857cdef4a570c49022bfe6f1de2cbd7f7edf94da3e104995ccb20faa00169d5
-
Filesize
581KB
MD560103d0f1324627e2296e13ccffb248f
SHA11034fce5040d48ef29770cbba010e8767b48d246
SHA256097d321381a494f0552b9e434d9f4aa28e843baae89956c50112cc8d4cab4fec
SHA51288eef9be098b32651ec52ac1fe953c62e4de49de1c6cf58efdc56e57c25ffe54f14a9f72a67a1113cca914f95ca1b5d7280d62309d67f9a90206a71703798680
-
Filesize
581KB
MD5f841dbecc4fde1828240f4f09fbd1ccb
SHA1524c40d45c03d4632ccbe7a4ea0c193a9a53523e
SHA256b93282a41246c486ba5a909f1900b089644677eba71ed5c8bb86845827676757
SHA512de8562f939b9236ef683de21c12f1ba51fc54144b79a0530e41a9f4e997194f9fb393d86abd9c1049d9b664c196243f48bd7fdbb6362979eb3aee7ba79aac1e8
-
Filesize
581KB
MD57b7fe6b35df18912dc076ba649070857
SHA18c3af672b50f17c7e57d3ec6582d2e708ec38a10
SHA25671944e7d108798b878d9782082cc4ff64bc4162174bb618c4ad5a0b758dd07fd
SHA512b2b6d4cabd1695c35e9529c9bd20856b864354df69a25095f352b878ddccd7c11eaf0baf9bfaed28dd0d808fb00b9143a16c818c8d973a8161f074a844223267
-
Filesize
581KB
MD5a3a8ee6b6a7ac0aa9c12a1bfac70363a
SHA1aa4c65bf52f3a56495a86cd2cfd60e7b193dca7e
SHA25635b46d4dea1affe3341df6b9e8eddcc63a26abd4345f2f67e0ab8ff7b2a41643
SHA5125140129a3bf338247ac943fd9fc9fd31c262dea0ea7c91512f9f97897fed4b5b1aa251f729c8572ff4ab4a322b461cf0b9118738b3b6482226fc35079faac9d8
-
Filesize
581KB
MD5e0e4fe854518386ecef91601de7f6eb9
SHA186cbc310e85abbca18ed760a8d3fb9aabc0588d1
SHA2564eb7998f15341db53609fffe5c4d0d07c7878190191b41ca51f55a825a69bb96
SHA512a9ef96d7e890724c51ef6677a359e632b3cd9f3957bccc7e582a4737d0066aa497c2fbdddae0fe2bf69722544d9bec61ba7b65661eb0b92bed0e4cb2484a0da5
-
Filesize
581KB
MD5d4b632f9cf45927690efba3639e41573
SHA1e867aedbbeafb84e74656ad4bfef0a27fad94493
SHA2563124c2cdb3e4bcdb69e34b8fb18755e0a8b459ffb668a3a2c1b7164ebf5c2f1b
SHA5121cc746678ebc741bddf041b0c4606697832bf2bf3c28e4b41a3de9d16a8c8013361dd51443a6128285e355fd65b1de7237169f63ee09f52428f14c9d2cdcecd8
-
Filesize
581KB
MD5fdae84191f21312b167692cb44db14e6
SHA17fcdbeac4bba30b3aab21d1ea8ccb1d575bb0c52
SHA256fc6a36606eb5e7b72b1e3444bc251bc1ec1cabeb18f8d35ed0a74bfaf99154cc
SHA512775ad32a1a4fcc76b1689cc930a64fa2e0843840922537a49e84799e249a0906169b026f8864b4dedcaa277f13295ee82a8fc7d6976c8aa6979e07b476d485cd
-
Filesize
581KB
MD5723d11c8a7fdf508acd3cdbf85abf4ac
SHA1927058ac45db48ca28cb9244b0114b5f28c55bc0
SHA2565494643de564260e22465305de88c590426400c1e891cda033b2a479b8ee0f40
SHA512c11fd50af43239387fce7efb077b64c8fd0308d1e9d0ce029999a5917a71d402a4d59a5fccfb8d6333441fba7a576229825927c8a84aa729ef6347021cd3a1e5
-
Filesize
581KB
MD5ba8164f04c559994bb9a72d8d7cfe9c3
SHA1bb51b5e0dc50f71afa3883570685585691c9feb5
SHA256f4687678d5c4af2461f99e6c18e700f51831abbec5528d9946916757ec6a3314
SHA512d978fe75162893a3ea970dce2188e4cb442d59e7055c6f00859b4ca4f568a56628972eed67aab6fc24ea2ffdc81356046ec1ac185ee31255bedf41a6ba9585be
-
Filesize
581KB
MD51695651a4f1dbbdb4847a482d6597cb0
SHA144024c6671740187c8850342481b9c9a2a6084b0
SHA256d32586e3a35f662db336ca7a1ca7037b6eed68789af04a72ce329cad453120b3
SHA5121b2e1024ee34af63584b4a2069b75246b41846011cdf4c73a03ac3523b3bc98c48ef6ef70634465aed058ea50ba0c8963dcdfa73fde0c42f518a2439c623ef03
-
Filesize
581KB
MD508760bba233d6e420ea279669012a1c5
SHA1fdfeff3594816a04c6afc0924e0b2bb945ac47cd
SHA256ab32c9396e4c65896267a806033b348c8d5cb51b9c32aacdee7d2eb80a32c1e9
SHA512568f6669e9f1349a0c05776746316c64fed4716109c15801398b073fdf301ef59f0b070095f35afee5f78c46d35c7479960d9ba95ad349e4c1d4c7bd6899ad41
-
Filesize
581KB
MD5e228734e4cc95cd322986658ba84592c
SHA1c645699adfe150191422c3ff46e6429121580861
SHA2568cb7d4094ac8213aa5ee2eb48f6fc1d27a5d27e5abd87109c87f50b2eac2eb87
SHA5123585ea83b8d79abc37b38b1c87dd047e221bf9bb334c4fafbbf2db1939382b76537840dee7558a9c4f740527d71c59b8414067fcc15c43265645217983246a08
-
Filesize
581KB
MD5d1690f2ee30e8b459bd54e4ad0d683cc
SHA1b02307a2837b4300a573657589e2219a600722cb
SHA256f22a385a2f6d4120800220341f72b2791626217366ebd2edafddcf1c9fceb429
SHA512f39aa98a4204432fe0379ef7b30ed80106aa3f16eb206d0249bc6ce95449b4003db4ed14226a39a27c402f49477113b9f688ffe3f6a94694ca212e217a0b3ec3
-
Filesize
581KB
MD573238b12d0bd59b9567678143f484439
SHA1cc702be74d4babffc9d8326e638c4c2671d48894
SHA2569e132276ae747c41d51a95c54e741c469cec92f64378b6d32e4666445f5f1e75
SHA512da759f09a934531419bd3472336e7ed679c6295d99f94372417def8546395909ef3ccedd3476a35c797859a7bcc8eb7e475dc597dd735e5f8365cb9b50bbd4ed
-
Filesize
581KB
MD52a77938a926b80449d44ce2aee9d2eb6
SHA1d5633e0248b00def8287cbed6ef6db4ecc2e6f2b
SHA256dee2de39fa61c81de33170d49e59014fb2fe78fad1be427a01d95607a52cddcc
SHA5123c5c4eab49a95ca12ccbc17c1016b1a4414b8fd1f8bed0c1ee26be6eca7204986caa03c76e724d22551ee7adcf9592710d0939251aff21a3c534aca882788db6
-
Filesize
581KB
MD56fc240dc18a0d38339622d13f1761ed6
SHA115d0323f7b3eeea62bd7be9e97f8c64b695c7e13
SHA2568df3ed642fb83063b2ebc4de4b8520d5a68a4b988b9a46005c9ee1d0e1e0e103
SHA5122d7a189123a2fd7de223ce3586990dd8faf34275624f811209f590400a1b624f7f75f72aa278791f8a47f66f8727984e3606760541c33154ff9990d35e8e14e6
-
Filesize
581KB
MD54cda63e65a4f35fbda0498fc6216b6ed
SHA1a0e94a6185ac44f6a2ff6da280798f8d05d669be
SHA2567ad5044d0b6871cf3dd643a2e1c4154573c2ee3dde713abfca4e27035db36161
SHA5127f9a632f88ad2dc8bbaa15d445789dd7cc49d191700dae391748392ace821db2cfbeb2769b98f41a2f9f252ac9519c7848e1b2f736391861e0581626dcdab8f3
-
Filesize
701KB
MD5039c70543f0b8a531deb7e06d2a02d2d
SHA19051eb6ed44ebee4198a2822b95f1f4d808b4b87
SHA256a0ee48a1b43233a2f7250acdc9db13c43f4c73c4cc2cfb148f178d93620cd87b
SHA51243bae6d7d9d620a9f244870b803a67a550a8189927efb28a03d628bd322d58cc3aef3e93ca6363036212bfc95ff54c68e71ea2b856e94fd4c50c8831fb1d7787
-
Filesize
659KB
MD5fdfaa35bdf81704f5f69de53ecb7f5fe
SHA12a297d2aed8553ed1e6190094541dd67dc4bcee9
SHA25661822271b02ff8ace06b387f01b70e0fb6664133d788308f30791534ff206b53
SHA5120169585a2594855e5e944f4739c02100db513015ea636e8941a5a647f262d89c551b4499221262465677489b1042291191f1a3d4d809e385dfccb256c7e1b3bf
-
Filesize
661KB
MD55384284d467d352429c14fd41520037f
SHA1115ed9226a5510effaf6862565efbd6ac530e33d
SHA256aad02c1e9384d4a6bb6a82315b70548f264986d5805b37df46e84688e19d75a5
SHA512649c694f24f2c08c803d2f3684610045fa21d840a8bf6e67f9b42e6a3c8cb27fd403950e78f80079b69568e3c68ac6caba26f227f84269425134b5bd5dc1e044
-
Filesize
1.3MB
MD5a18cff6297789f028af369e7c36e0435
SHA1ce3577ab6c2f86967e6a9462998ba6a33dd454ca
SHA2562d4a3404b5fe6524b51df14a759c11e5d2e0cf141b4f9726a5f95b3148dd1e63
SHA51223a6f9030a4a3e5557da4fb31d80e06cf859ba62f9d2080ce00de5522862781ff0b67e5a86d5a019e00613551d52410bc9e9745f27e054f3274d920ce02b7526
-
Filesize
1.2MB
MD50241e3607670db415da575cd286bcb30
SHA1d7116eeb6d18f6c3485dd6d77be0c39ae8dfd745
SHA256a8844aebc65e156fda57f17eda9276a050f2ad2c0485d79c9e6ff4e970599d5c
SHA51284725648005b4ab80f57fe34413b8f980e86f4c386161fec2ab52b0f30ad46e92036c3d9b528083521cf780461f85be27d7e55596dc2b40d7ffe6f3baf4a28ce