Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/06/2024, 15:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-15_3c01e7128d293c0097ca0c61bf6e4ea1_bkransomware_karagany.exe
Resource
win7-20240508-en
General
-
Target
2024-06-15_3c01e7128d293c0097ca0c61bf6e4ea1_bkransomware_karagany.exe
-
Size
677KB
-
MD5
3c01e7128d293c0097ca0c61bf6e4ea1
-
SHA1
870cc9966ff8706932ddd23aed8bdeab643990db
-
SHA256
dbd7f8a6ceded62aa44fa95de02427b9d9ce19fa8282306906cf301d9f344488
-
SHA512
89f7afc61405b7c82958bdcdd56888bc57713069acfb824baf7aad9fb4f836b93eea9ab1151e96038862b0ff44a5abce222949e3b563d4547411ee56c9777ace
-
SSDEEP
12288:7vXk1HGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:7k1mt/sBlDqgZQd6XKtiMJYiPU
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3156 alg.exe 4160 DiagnosticsHub.StandardCollector.Service.exe 2820 fxssvc.exe 5048 elevation_service.exe 2228 elevation_service.exe 1776 maintenanceservice.exe 4576 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-15_3c01e7128d293c0097ca0c61bf6e4ea1_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-15_3c01e7128d293c0097ca0c61bf6e4ea1_bkransomware_karagany.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\2c06049ac3136770.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-15_3c01e7128d293c0097ca0c61bf6e4ea1_bkransomware_karagany.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-15_3c01e7128d293c0097ca0c61bf6e4ea1_bkransomware_karagany.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-15_3c01e7128d293c0097ca0c61bf6e4ea1_bkransomware_karagany.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4160 DiagnosticsHub.StandardCollector.Service.exe 4160 DiagnosticsHub.StandardCollector.Service.exe 4160 DiagnosticsHub.StandardCollector.Service.exe 4160 DiagnosticsHub.StandardCollector.Service.exe 4160 DiagnosticsHub.StandardCollector.Service.exe 4160 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1692 2024-06-15_3c01e7128d293c0097ca0c61bf6e4ea1_bkransomware_karagany.exe Token: SeAuditPrivilege 2820 fxssvc.exe Token: SeDebugPrivilege 3156 alg.exe Token: SeDebugPrivilege 3156 alg.exe Token: SeDebugPrivilege 3156 alg.exe Token: SeDebugPrivilege 4160 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-15_3c01e7128d293c0097ca0c61bf6e4ea1_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-15_3c01e7128d293c0097ca0c61bf6e4ea1_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4160
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4044
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5048
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2228
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1776
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5bd162ea69a7f7b5a733965b05af0d0b5
SHA18532444bbc6dbc7ca91a73a46677dc2e59e79702
SHA2565c9ececaf00e1fedcc501ae457859b36b09234745b4daad8c70c6ac51240b6e4
SHA5125eb82570685d922f165ce2f278226baa8cbcb58a71ea0c94c136421b81b56cb196a37dedf0b8b53d49daa39c9f216a76550b2d8996dfb1323e48d7a2a4e07939
-
Filesize
797KB
MD5e19383424640b94ab662eed8f69e32fa
SHA1fb5fb4a3aee6c0935cbf70de0a92f5c5d54cd789
SHA25621a11ce07a8fcd4dbd4b0b729eb04838cdbf085c9b2d331961a5dc6ed9a71308
SHA512e3cb53403c37dcebb99cf84b305c5ad8ffd5c216a0ab261b83cb946c860e6da3de82955e5032b854ef5aa86726fb1e3044f2eee45beee888b3e493cb1ad2c45d
-
Filesize
1.1MB
MD5074627343784095ffdfebd7ba2e4a684
SHA11630486b1a922de7e5838d8474633f1fe5897c14
SHA256508eafcea588b9a950252ba575dad17195255f6ad68816c1abb77d6d02d6e5dd
SHA512ff8985cd0c9f82ad7182c0bf63916651f9d24b60e18d3b40c46ca23f1a33fc76c4d9d2b2efa49f4e72d60445ec3fa7ca32e8fd4b3a687c89f6b90d93c409ef8d
-
Filesize
1.5MB
MD55eb1abb8efdc29b189ba92f699b2b9a6
SHA13827b42340c5207ad3a5c37ae5366d22f5d57b0e
SHA256d7b32eac85c3b8f5a4b650f14c3c46d431e66a7f8675587c76f814e06da633fb
SHA51296e4c688d7e7a2f1dc1d7d44f46f03eb68bfe71fe87f158959880d7b8902546d0450a4ceed473c387e4516f2c17137222560979c3dbf77bad7b9e644e3519c5d
-
Filesize
1.2MB
MD5e94f232aeace6fd800ffce8006b9d0b7
SHA13ffa91d14ed19efcffad1c8d7dae93263faba8dd
SHA256d4904a9dd00b73515f1e5d62eb05ac2621d078353f701c8c34075f267fff07e6
SHA5129ab2355873d5562cfbdb05b5e57181acfc270f46c5b2004a5514e2f2a747647df4a4f15a2e7e0305249b9e2da7f9bf945429e30aed1eda1f3784ef897e51a72d
-
Filesize
582KB
MD5354834b49443a3f8b63aa1a83fb77703
SHA1571ea809fd93f64efc656539988b60e67cbfcd38
SHA256d3f6b4f8f7771e46d80910833d9a21674da9504c825f4c9bc135667debf8784a
SHA51248a661f02951de8f4be6f0d34f5e49c3d49c27e56dafb76a495fe226bc5a51c93c9e5f67e41c13cf41c235598c0aba1999ba10f61b87118e7664c78d9fc9f5af
-
Filesize
840KB
MD5f2e214e045506d10acf943256d2d08be
SHA1e109ef15135225bf15651b17517b72fe124c98da
SHA256ff9a38034581e8c33f6012acc47d110f05825cff4fde31b534d633d22dbc7cee
SHA51275bd37af0c9011368aa1eb0f1c235bf2f8a72beb476336ed1b6bd364e5638b3828781c84b1daa4bb4e21562aad749aea29bd34d45484a56c4ab507d75b17bfa0
-
Filesize
4.6MB
MD5ebffb789d05a05e65895398bb1ce5904
SHA169696539966bbe52ef7f08b5386fead2a202229a
SHA256fe426f6d2f7625eb218e42c36690b10f7af410301026d99dbb8b34a0fc21f300
SHA512f6a99e168ffde3454059c3d6a6e227a25b028a962c79d8df389b52432646f4555649d8106e65885ef98212e2b41c986b9378725b1dd6612457e91db6f5541f1c
-
Filesize
910KB
MD541ca2ae67deebe55ca1e087041260a52
SHA185f529edf3e0086b127672335772beeb4b38b7d1
SHA256128c3666bc11b49ea1b1dcb1d981637e7098d5a75e03f564660ad55c83ffc25b
SHA5122afe60f614e80a968a3c5b8dc4b73ce336b6508eab2bf88a187a673c121134bdbd581a915dded6660217beec466cedd654ab40c18679ea9bd502ef2789a56e85
-
Filesize
24.0MB
MD57a9c842ab139f39b178533131ec1b80e
SHA1e1f26a7899bdc7be0c9a542459c6874d395f3e81
SHA25605d5f471f52533fe7f18d7db947018e605a2cab42433ab9c686fd23206bce402
SHA512b743836cf5b1da2cbb22945b0c9232f1ac28beaae12eedaa839b930fa63c6261295c429c1cb949d85abd80377a050d2934147b831b11db5d7c7e335d566e22f1
-
Filesize
2.7MB
MD5028f15f0410e751b3b9dac42d7b9cc31
SHA1ee2f8a71483806ac78498ca141a8186796567cff
SHA256978d89fcc37431cd23716d514cdd41f03d1fd4177e9f176adb2d9c10bd509c35
SHA5124de2133bc018fc3cbe1126fd45374025f56564a79d4e00dbc434e009c1489a36ad5c8f5602c3b885061aefea46f0920bf56d61c623b153e20bf38a1f1a79ce5a
-
Filesize
1.1MB
MD57025708a748399c1658ed0ebcdc167ed
SHA116550bebccb3332d4e4d871176b5cd9a121ba723
SHA256ce6a321bdf44d420ef84f50d3ab36a561e8ad59743d0c7235c184da9dd543be0
SHA512ac9107efb91c99a6bf5a2b2d320171efd3ef451a0da7e2a4e5bc539ee43721442167767a5c30c90796956234f3d6cfe354884c46b8b589e5e2eb4e244599f281
-
Filesize
805KB
MD518e52fb8bbede23e518a4f6480e8b683
SHA185e6cfec871cad99000a9c18e0be84fc5ba0c6d3
SHA256d90bdb6baf5b9cc2ce0575b90600e080b19c1a9bdd4da8207f641e43629523d0
SHA51272bc6bd2bef4f6bfc7d874ca93a705b895975816dd14d42cce7c3e167fc0c008f3777ddb63d3400b072cbf81c922bb36d186d09bfb94922f75aba8ec20310f4e
-
Filesize
656KB
MD552f24ce414321899739ccf19a9617909
SHA101f6ec42224c883eb98ac1fd2a2e57521d886f65
SHA2566842c642204b1e9981b4241b356496e0484b818e09bfa64e5518a1672d216b94
SHA5122bc748d504dde84bfd0db4152f2870644115d892192ec7237712cac726b0b2efa63a9a710f3b3b8f2f821a630bfa7c3ac82ea86a0f74fa9bd25734f761c8dc40
-
Filesize
5.4MB
MD51b80e05e61f3119d8f27346ccc545763
SHA1b20adf4d5def70cf92f36e776dcae65a509b642a
SHA256bcd367f8d05aba5129920ce81e43aaebf377cfee86d0ba80b5973b826d2aee84
SHA512de1ff20fd1b5ad1552946fbaea08cf9065468beb69cae66ab80d07b45be1285ac69aa060d8d16b5532a70f78fecdceed014f71c03197706899ebf63cd5b59be9
-
Filesize
5.4MB
MD5ea053e37021ffed113fd2ce01460ec2f
SHA1ac72187019c3b6aef9ef2288a51df773472d3e42
SHA25623bdc9a047f163b6329a5f9c9d4a382d105ee33c4d8b33cefec6b17ccbefdfac
SHA512b68092f0d90c6157087f75c73565e69bd86f0390eb514e814936b7891467fef08559500b73ed5c9bed8e34d8b3714d546c7e9a8a242a2b516513af2f20516030
-
Filesize
2.0MB
MD50c1c6862768af8940a8743642d5f3468
SHA1fd42a5fed50dfe66adbe993e6a2e9755655e348d
SHA256594ffbb7fd8efa07c4f33ea7ee68c4b57abb24fba59a1a63537f1059b20affd9
SHA512582b483c713665398d6ea4c96af1e9f0cac0c0e6cb0556245e6986fe192f955d2d686682f05da85d153513b8f051b7f361dd55e53bd1dfdd2f4860fd8206028e
-
Filesize
2.2MB
MD5cbda66140245f8394255a14f5c5ed016
SHA157b5c4a774bb9533fe5e79754e15d0e07ce9c0d3
SHA256845000cceed3fc01b27586f8d0d088fcaef53fe5eab436f48c3188b3504793b7
SHA5128bce192765c59c7cb695c280ae0c28644fb9c8cfb4bb8115a5af3d91f896380097e6de618596f09b5494e4da4411efaaa995d1be83b5fcf63730930af75c1616
-
Filesize
1.8MB
MD52c45fac8c9a30cbdb90d225d030415e8
SHA184186367cd4f967bd5f6c286ddc53cb87d125fa5
SHA256b19d1f0214b854aaecb847c43bd3d176bd87d6db3e27e1cf63d40388f4a5f601
SHA5122f7137a4740df448900ce04c69c41a8b7aeff5289879173a22177d9f380043b49aec40eca48ff385d6a6ed74c07e9811b6452429b854f6159c4c5a0c8840dd96
-
Filesize
1.7MB
MD59fe3c763c5ef255b16261babc0ecd269
SHA1c2847dd42905295b74fd32a6ab3e9a02578e5abc
SHA256d680b86cf83b0cea42713cda5b697f54149ced809ff01bcd033b4eb1c5d6bdee
SHA51222222eb785f4c324447451fbde05c0aab5e4155fb3326bd0a97b8392ee37efd92babaa6c2cf4630fe98abeb430e056e7071808f231ab67dd07b9e520908fd8b7
-
Filesize
581KB
MD555ebba758e8e6c5a00003ed487af046c
SHA1f02ac491b746d0debd7630d0eb9c8a0d1c2300bf
SHA256571bb9d667e2f9234d758d5481d714f3e73f6aa89f2a186f35e327931323a986
SHA5128fbc7dabd001cb8c85b38c71dfe5fb14633afa7eef92d4922516fe5108249f7be5fbdd322c0f2a23fad8247efea679af6d0852ec6c2c56260bc98a24f8da2bcd
-
Filesize
581KB
MD55709dd874cfc50bb42fb796a93856eb5
SHA1cb63ad723ad6bd214884db8dbf0489ca4eba51d5
SHA2562d14008715d4c7bd2d0620fd5584b14ad93876d9c326efd73583bb7eb8d075a3
SHA512332b935f2553774488bc501a29fa604e3a4af511c2f93ca8bd94469a1704ae6ac51dd5b87c30bc36bd3d084f359ee806ed46962b59048d6c391facf69ac50113
-
Filesize
581KB
MD56d1db96615d78ff05e00369945701fec
SHA1c3c3e77d2158325252daf2f2c3c287ed84879495
SHA256abff9219a27f1444c140095deeec51c049d670771af4575c54062d6fa16e5e71
SHA5121636bb1453bc0fec08ec700b6d004ad274b7beae95c52bb40ec2456e53fc86d7aeda195ca601ef7aedc22e38eb2a31c42d028665a7913d5c20ac9ff26871bc4b
-
Filesize
601KB
MD526ea568e72141a3c9c934f3f4dbf52c7
SHA1eef7f7c046b5768e00b6fb0270944aa136a32444
SHA256ed2d551567710865cd3badfb9232027d1142dd089e6f5fe9e7bf8c571bd6abd1
SHA5127129f9f3792c8825747732184db99382900558ebcaa8b07c5d21ea5380232cab4f4d346439048310e6b24488f61bdfe949fad3bc1a1a01482f03738a1ed65178
-
Filesize
581KB
MD5bf60a9b43d51cecde374d8b83be65d83
SHA16b3376878af33237c2f46b58403f3e4fb46bc184
SHA2561995ac4d7b265eada048f91796f35e67f9f1a8d457c7a77ca3c640d0ab3a034f
SHA5120d7f4f29a7647cf3520a51fd8f5419e31d3deea6c93c928a0977c65f78457cca1c9ce2a3240f14d8078522ed3caa28cb7839afe02ff12b623832b0753957cfda
-
Filesize
581KB
MD53205e6420e2545864a82a80a6cd9adc9
SHA13d84e3cbdc01d33a2fa20fcc71aa40b780e06c3d
SHA256ef690d3a24837b6940c71c3b699d9e042953442c5cd9452a4ea20e4f94d68a66
SHA5124bcd55bb5483c653472a0baae45b47e199f011e248c69fd346a7136cdffac7a32324afbec5359e89b73c53a945c09647b981beac26a4f8f9c74932a4ba46c260
-
Filesize
581KB
MD585f8381df3eb151bbba97ada4dbae766
SHA145a80e922dfede8d049ae713f5b59614c82f9f9a
SHA256aced8990fbfffb00c61544d0ab5838ba76e0fe5db551846746c863daff4f5ef6
SHA5127cbf294169ebab4457a55ff1eca1e220bd8cf8a14bac3be10b31f7ca18bee0f8e20eba8676904b6f878ae3bda7ac16dcfbd8644f2212de3fd759a7ddff23cb89
-
Filesize
841KB
MD52c69614bff52fa850ecb2be007ec76fa
SHA130528175ae7b0e4e455a7860e21bbf3bc65881a9
SHA256d8d2c921d683ead1bb351c616edd4aa986e13c4084b4eb1638cc72fb1bacd9d6
SHA512ca6c0a1d0893fb27b4eb98364662485cec257021dc2dc4fec2a8d5e193fe173a99ac5045e2c39a5410132aa1eb5228288fcba88c571a9cab48cb363669daac2d
-
Filesize
581KB
MD523e69533c78a6374136e02af3a168995
SHA1840efd6b7df96d62879fcb467a1dded043fab631
SHA2567d2d9df440e81cf6833d1bf6179aaeacc6cdbe0453c88fa1bc335ff1b0b56751
SHA512f0460951abb354279378123c328bd5240be5353a0afa9e43d154f3b2384084905a324149c3bce934af427721a134f0e6d55204ff8dd9c18f2accdff97232c240
-
Filesize
581KB
MD5c4ff763a956b5a56cacce8208bde86bb
SHA10ddbb1ba389368b51a7ce68e866345aae32ce646
SHA2565ddbcd54c7dce6e5c361a7099552b786396d741a984a6ad1b865616c66ba227d
SHA51206d930807e0166fefb042c5e4650203dbfb549d1fa47bb05225227b3dadbb2f74efb87579e71caaae74f88bf8fa8d9d6012f968410c883c1134a388c58fae2cb
-
Filesize
581KB
MD578bc0f90f8bc0a5332e52ddc80155dad
SHA12c44937267f2d23c976710bbf08c0cc43f87ec50
SHA25697edf69fcec6ec3adf74aeff5832dc9fa23e5d02c0d0ac6ff6a1aca79f22e369
SHA512d0a5d59dd8dd7ea667d33187eeae8f02395b0d27344fb3c9f7f06c94fb24788a7240a1acc6effa23951ab81d8dcabb7f032e96fe20f089fe89bd4b5cbd4d3a84
-
Filesize
581KB
MD5572cba4659a2548b312171145669e99d
SHA10adc8049b98b1f6d171ac0b8d28bacf7ffab6e14
SHA256061e06e26147da89441367a9850131201a89b8f31396c21dac9d425ee00a7066
SHA512afb96954d324eafae8bf4ec50b55338cc57116a6543f03a2b11330c3209894b069cdf2f26bd2dd297d3b1326e4daad302d82db848576001530c4685d662e192c
-
Filesize
717KB
MD51f9137a0cff0ae6212aab4f6c5517aeb
SHA1d14dc5f3a4632cf4015b063aad1381aedf4d0b6d
SHA25634cb161528fcc506290bef3f20e298db5a511c65572773b371dd7062528af580
SHA5126e4b0bee6e013896eb1e16b2b3cf343ece055213d6cc8e1b71a60045f77da43e80f9d179bc7b2a65020227c4f868eb32c90344c4f6a4a3cc56470a755757d07d
-
Filesize
841KB
MD574de75c320d023052015546b7869ea92
SHA1ef1d51f13a71fabaf6babec795650143272d5e6c
SHA2565ae4d847943d78e1c1437d959d1c8e67fe8d1c992936df9730ce5ee968de3cdf
SHA5121f2f1c1f7115533a488efcff65878138a6267aac59ccaca82a4265287546a332592a4a8e0459518c3edf3fd2fd59deca02d2bbb1a1ef8dfc50301164cb306dab
-
Filesize
1020KB
MD59cb7f14608e99d0d7c9db965fa8add41
SHA152aabb4b5cd7c17bbecb8d1283afebb8845d8c8a
SHA256a4bf3dbb4278b16febda87f71f6ca1a815af9d99d7516afb91a94553e74723c9
SHA51226d082c84869c067ccfb91fe93d59712132485c86be18b24b4ca4588c25a287f0d32a1a8b20f3cd2eb6d3dc8bd3e79cabb4d5d53d42d492cdfa31cec40e6c81a
-
Filesize
581KB
MD5b65ecebcc480123d575443bf4452828a
SHA12c7f9c40b6a2b5d3ba8de6f778992255927101c4
SHA256fef36ce609727d4afe04b3b88445e3134fdbc38f0bfed33892f8d12570cf76c0
SHA512c324b7fa65c76d94b7b092a36df228f2295a0764763fc0cbac9eed1f4753650715dba1be6fb72431f3ce20756871d53a6316e878cf213491dbcbc0fa776b69fd
-
Filesize
581KB
MD541fb592e936cdac89de9cbd0068ea549
SHA1c19d72f5f428ea3136d2fd5e10b3b92c5a97728f
SHA2567acb9fcc20b7457f9c1149bb65a1a4029d862af252c1d67e268e8617470daf79
SHA5128e9709de3e87f45b2b476338554ce1d29aef9cf23158825165cbcfadc65f45922b3f322debe46687064b2653371d6d202fb267b4ea6400117ac8460961dcd53a
-
Filesize
581KB
MD5f29ca6d7a2666824e2690d9ac6ebd16c
SHA1ca04b43a8f726df8e336059910592b7796afa34f
SHA25656581a93d43dffb9e1609f216f4110b05fe1e6266bcf03a78b52160c24638ba6
SHA512b1fbcf2ef349af4b92c51478de186e865c2b481787928392550505d77c179421cda99bd23a6fa3425d51bc896ad3a60cbffce3d2bd7dd9cdbedc85835267ab35
-
Filesize
581KB
MD58a9974b490c66afaf9e6c985c9f8f429
SHA16bd4256fe406ae80c211b5ceb909b5c0e5a8aa20
SHA256c31eb9a6d53ba6828097f579608d8c0fb889d44be4db5c4f3971cbed1ff284da
SHA5129b7914e709e281e4f9b36ded24610b247c861f3e2d173268c359e83489de449b0a6257dbe649022dd841f6c9e3f398f74e67c4ee1540dfdf582a595178ea8ed5
-
Filesize
581KB
MD5bd91c899e01129b506478f3768ab0a67
SHA17f90c1a5b420b22a7ed245e5d1edb3e715f87cdc
SHA25619d054dfe5d9c70f7302203834374da0bbd5d78c95e9167278e401a414add483
SHA5120061e542790bfb41eb3ffc5eb4949aa160fe209b94c1b9b6489fdede45ad1d5c8a4e9ce1aa079b95bdd3565332d87da1bde6f89c75649f18f5b468e13ec5afcd
-
Filesize
581KB
MD5e6f54679ce7c491ab782466fc74938d7
SHA1ba844fa1070b4ff50229f576f220e9e1b874b431
SHA256db6f753428df0c71f9bee7f16e27fdf835800662f59c2083fff1d4299eec4853
SHA5122ff858bb501a6a021b14d59802b6d2c27e60341984cbc990da094eda477473da13f73d5d6705460fb6e5cff6d447840ee586ab52e0190d30a9f192866f661e43
-
Filesize
581KB
MD520cf0be219e54a531fd093b4b7ee43d2
SHA1351dffec20022af79a8d872efe42d669625cc331
SHA256e433dbf73bda2dcd89055fc195ca4587c5e720b2cdb8b05cc9b6594ba4cd84dc
SHA512fc9c4a73c8d15ba5ca1476ea0729f37fc9b69b5cc16c9ad856c200ce2f9bfce86449f48aca6ab05c2d64859c55e2104679fb3fe2a26ecbba08800448061dae0c
-
Filesize
581KB
MD5d3ef664fdc0b8eb21a4fcf8bbce747e7
SHA118841a36bd77e6659a725b4f92f82c59c65f525d
SHA2561de44c3f25a674fb3aa26c422530e3b53a018c8115e50eb9875f0b0566220555
SHA512caeeaa1352811292f90e94fcf5ab711a43690363344a611d2652c2f35be2789ca16adaca9185cbae7d1662c9e5cd00f3e41e51e90b6f4d35927e23bd7f3327ab
-
Filesize
581KB
MD5e2748ec67a26f809503927489bb57ef4
SHA1f8c0cda60ca3742decc1cb7c4713209a0b956472
SHA2563d52e7cc1c8054b6c53caed857b98152fbcc568a3a3380b765e0d2aaa007c64c
SHA512fd2b45c0e6855ed6d93fe3d8b6035d80fb5a2e552f8b09d5e266beba22461b4d021f206373454cc1e048857a6e85f2623073d883715de64a6a65c58a391aec01
-
Filesize
581KB
MD57ad668d5a8d3d09aec8565852a527257
SHA1c1b148f98b3313fd630daa79523fa54665b4a1c5
SHA256bbefd5dc099895626d09c6329568a892b8b115fb0c37aab55af1074c95decd90
SHA5124467a4f23934d6eff7321c6b3ec29313ab226690562bd7db9cd9943a49ce74f027963da7954facb7dcf2b6ed2bcce894fc5f1deffe4ee325fd7f21988bf0d079
-
Filesize
581KB
MD51e1fc235c9e992b7337d04f2e02cf99d
SHA14276516f14a2cd7fc9f4968c75871b36cfa55aa4
SHA25676ba6225c53080503f8b568112eb676995fb6fad00827ba639ad85bb0684092d
SHA51263322240e46826af73fd1ad8a73b75da4cb36de114d745545b806e9c5ab692f20af4515eda2a26765316ddff8f7ef8cc7b8291e0ee50107a3c975a2759b45616
-
Filesize
581KB
MD535e9f73a55188cbeaa74c79e20314edb
SHA1db1ab408bdedc1a5736c95ab410b1b64848aa22f
SHA25669954c122e67105dfb05374522d7adc9e6ce9d10c745b08a648b3e6c66be8749
SHA51229be5abdddaedeaed299bedb6bcfe62f0f5e6f5a0c790a0cc495c33b9689f49d07e9585be98a99a855d38f31f38e5851c4fc06769c401df0a05338599dfacd3c
-
Filesize
581KB
MD52ab6a572dc9dd41e31699babc5d3f483
SHA128614246cd044f4512fb7b2f70a47190a95abeba
SHA256905733b01b5cd7922454176c838dfc55c0e9f5ffc59d56429d3126030ed667fd
SHA512007d52b3102d9fcaf5d238539e176e4d418512615252bdb87fa5974cd08f3b2f95fc2d7abe0360cbe19531b00e8fb53003f6807cdc172b2d3da12c7b6cf2c291
-
Filesize
581KB
MD57a2c57ae20d9d4ec5fbd9a5d1a33103a
SHA182a0cc7868bbd9c7d6e607e64044cf7485df7b13
SHA25618a3f06ac1040feffff2b5b440ea66f9b85429eaa938cfff38abe934e862b5f9
SHA512281ce753debb72deb8abeb1a8f23bf2c737fab736ec74222319cda774593df357044c0c999a5f70f3bdbbe89279dce6a252628cdff3163d36408073abb553017
-
Filesize
581KB
MD5a83bff74dacb790f12e940431dad32aa
SHA15accc6b5ded1a6578f51e16f3a529b5360586417
SHA256e98b1264e8c0baaf9174cb09510f8125452cbe65049d4dd5d43f6464bbde43ad
SHA512f3c8029b2b756dff939796bc996e0b3fca98bac50562596fbb83e369359292b90118095a6bcaba8fb9caebea3cc9993197e9145ed815a5a02713305aa470c789
-
Filesize
581KB
MD5976d1b2faf82dc391f68e2c9d58ba0e8
SHA126c85e78dc3767b53ba755843eed942335c34efb
SHA256083a5c85d48bc98b7e13880d3f77094d516b010553a3e125223669696bfc8794
SHA512f167d332ad13d891ec9fa13cc6e50213812caf021e770ad56821f8511da2f519cd94e8d2ec70c0d440419c784091afc5b08d0ab10f97d183edc3ec044531f8f3
-
Filesize
581KB
MD5e2ca8bc15af61257a7098c087e5187ab
SHA1f09a7902eb5927fc317333028c4789c39577abe2
SHA256ac763fdb2fae1ed183919072b485db4d98043cb6eba45f28e0951b10dd93ea93
SHA512209875a3bab34b67c4a203ecb954d7bc1eae797629dd051ed9de88da8636f10621bdba4c0b3f2e30269152d4a8718b613c2b3eb96edc539a75517e11be4a2481
-
Filesize
581KB
MD5287a52cdfb5d6f8835f6bc4795740ec5
SHA11ccafada4ce384c6ee104dcb1ba9477b491b35da
SHA2564b7a0436cf0648a1c7a91b4a3a3f6dd021459d991853692fa8a2110c31c940d8
SHA512b0ce6e87e568edc4349bb2675061f5912977f47044e74846f35e8f65f1bf2c20291c5c2bf39e69c6831c63dc83cee03a570835050029c0f274fa9c10bf63cfae
-
Filesize
581KB
MD5549b16d453311a46599bcb09ccc1e663
SHA1d14b5f92f41809a83db7d7c91ee33ff5c79101b1
SHA2567586a0d90cd7d6f9678d8c63665194acff0212ecae1e64fb3ada8150329d399c
SHA5123bcda2bcfb1802090791e538d0819a8ef2683a00caffabc642a08e24406d6288f7b0df76a302ba7e7114d93673b2afe975049d95280f7c80845bb68a819050ed
-
Filesize
581KB
MD59de01c33c968a5e65cde98815a222186
SHA135cb1e1b6896007afc42d5d9c1eb5e2f785c4553
SHA25653e8da1903544286cb52f77781cfbec67a27d8e0237ff80f2efca0ad4b982e45
SHA5128c52537e1bc4a53dee98edaa08b7b8cc3ee5279947eb2e622e519921b5c6559430da5466ae966ae8e5a92509cd38836a6d5879f3ee49ad9d52c7469a0e108c03
-
Filesize
581KB
MD5ebaffbfb072c91377d0b8c89c67a5cd7
SHA15e98c818c8dd6cd17a8a6290d70d438c45378f52
SHA2561f8e8fc55a8c0068e0a82740e80e65c8d3c1375076138c879255fb1b652007b8
SHA5121dc978a126401ad29ab85ff9b95500be53acf0ac573d4471209cd52b6c82bc86fbfc14f9002164244f3b1d0d77b9a6ad4a17f298f392cfd86b9bce0854ae9884
-
Filesize
701KB
MD5a5738c026e0bbef2a95feb9f8d3999b7
SHA10b26ac1feebf01daf5e1809c5902d21628627c38
SHA256138ed860610ed40db884f6af480406f0a0db142c137ec67a6911dee7091089b3
SHA512fd89e3811c5615b4dc9f033ceb63038c99572d35d5d25805980a24849339be3e8c2d8c3338b08fd0c9a3ad6c8fb2f239226e596e00aec262ff67f43a6f560f9e
-
Filesize
659KB
MD5f99a7cfe8d190d44c46ace91c7f6db53
SHA13ea5d08ce9efeb3eca00bc7f0927e49618897c91
SHA2562380519b1e106172f015ef5bf1610efae08054688c9793813bc4c8bd7881af11
SHA512da657e7937c9e2b46923ae9d2b7cbd8afffac0f1ef0fffcf9d8533eddf33c4cb7e4a2672945297653db8130dd6dcc0df87a02e17d8f6985b7540aa4f16b45334
-
Filesize
1.2MB
MD5d1e0487e7e573b6fe278d3a3e6b15f17
SHA19c6b5fafd8a29e384b616866118ec7cd5cc717c5
SHA256bd80f5d1cb67aba1c43fa1003be31b49620307ea6eceea8fcd535d634795f939
SHA512affe0dbfd405bf099b0c178ad86b3ec51e8cd98b3dcfda1a356e4507a0bd12b23c914e9671019abf5618f242dbb2577a6495eeffefb77936f9de505a9810c568
-
Filesize
661KB
MD51325ed036671e47b65dcf15f455f6a04
SHA1abd44bdd9a00f8a8df99d92ee262aa1e03dd3146
SHA25693f4be5a941491635b3a2de2e24894c7d9b0d4d8e606c57c980436841cc12fe0
SHA512e2710584dd5bf15c35c7814120079b78c0472a0b241e17638b9993632034f35ceb3b6b6ba17ac6b8e2aed986eb294404c7da828cf866a0e06a45138372da2db9
-
Filesize
1.3MB
MD5966c49000ab1c11242d09273f034b0e0
SHA1dbfcb7cd7cda83e792a5e4e3a0ab1e206964c8d7
SHA256765fd1bfc42e85cca2ea05afa27da01c2471c708409c88b07fe407e82f7cb1e5
SHA512b8c67aaaf83522855a5bb913b0ec24f674bb8c2206ed5a7ad1e19704ba49a0ea153e9bc061f6991a066f80f9ffa805dde53d9d4161e1ae86b8c91af2bce7059b