Analysis
-
max time kernel
147s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 09:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-24_2ba333375dec4f912ad181cedf3c50df_bkransomware_karagany.exe
Resource
win7-20240419-en
General
-
Target
2024-06-24_2ba333375dec4f912ad181cedf3c50df_bkransomware_karagany.exe
-
Size
1.3MB
-
MD5
2ba333375dec4f912ad181cedf3c50df
-
SHA1
972259b44808dcb780cd40c32bae4a8fdd9e2532
-
SHA256
ee5038e0cb98b507c4a3fe4ef990e66e9145a48e9523d25708ef700bfa8939c1
-
SHA512
97dc6689070bb6556d1b9e65296e9fa65b9b7fcd15bf04de1cc6e95af7bdad774837f1b02e009e0c1bc7a43fd6b8de9302eb092d037c09460ad343c1bb5fbafc
-
SSDEEP
12288:+vXk1wMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:Ck1ZSkQ/7Gb8NLEbeZ
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3324 alg.exe 4220 DiagnosticsHub.StandardCollector.Service.exe 3516 elevation_service.exe 2764 fxssvc.exe 5052 elevation_service.exe 3460 maintenanceservice.exe 4536 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-06-24_2ba333375dec4f912ad181cedf3c50df_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-24_2ba333375dec4f912ad181cedf3c50df_bkransomware_karagany.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-24_2ba333375dec4f912ad181cedf3c50df_bkransomware_karagany.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\93b61cc61ed82f9f.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-24_2ba333375dec4f912ad181cedf3c50df_bkransomware_karagany.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-24_2ba333375dec4f912ad181cedf3c50df_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4220 DiagnosticsHub.StandardCollector.Service.exe 4220 DiagnosticsHub.StandardCollector.Service.exe 4220 DiagnosticsHub.StandardCollector.Service.exe 4220 DiagnosticsHub.StandardCollector.Service.exe 4220 DiagnosticsHub.StandardCollector.Service.exe 4220 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2980 2024-06-24_2ba333375dec4f912ad181cedf3c50df_bkransomware_karagany.exe Token: SeAuditPrivilege 2764 fxssvc.exe Token: SeDebugPrivilege 3324 alg.exe Token: SeDebugPrivilege 3324 alg.exe Token: SeDebugPrivilege 3324 alg.exe Token: SeDebugPrivilege 4220 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_2ba333375dec4f912ad181cedf3c50df_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-24_2ba333375dec4f912ad181cedf3c50df_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3324
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4708
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3516
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2764
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5052
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3460
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5a8d4485f871d426d4d1839449d7261f2
SHA1f2f5f4bee4d70070dbebe1f696e86b028121ab77
SHA2565ceedc3ef1244aafd95c8b102bc579795dec3ca40dc5d944c8ff42340a5814fa
SHA512cc13d6fd03d5af566c37e0d57b763000f090ba32f06ac87cd0c93b493b4276bce0253e7f6c5e64269cd965dfde04d020be7ee59b2770502ed861fb08fa57b086
-
Filesize
1.4MB
MD561987f53732fcad7bdf03c121f9929f6
SHA1d02c425fad6a1a6395d54e66ff210ada34ecf061
SHA256716140d20d480c19ecbce58277f30a7b377472ec15118e79ab04f2c2cc1c6e7d
SHA512a953c4353b070a55472242feab339dea396e30f05c7735a8422138124d49bcdcbd7844e25a21d89a1dbeb0d8cf96e30d86ccf05b233c5499ed7ce99e45388192
-
Filesize
1.7MB
MD5eb0af0c83cea67c166862c1e4d74ca9f
SHA1e17f8c0c038b8035ca023957c2d5d4d2ec3f57ff
SHA2563fca8e1c42a106e1d97eb00ebaf6927ee53cfc4c674f85d6c3d2a45b9c5efbe2
SHA5127bdb199c9f8a4f8fb222fbbaa826437fbd6930ee3eb0dd2e132371969eaf1e0d9caa23fc4f1b0b17c8aa8e97d25909b1f55707eb17910f7729ccb6e49be43112
-
Filesize
1.5MB
MD58f2cfbc7f0e0a72db96976099f491868
SHA1bc035002926c28acb2793966692499e12f5e7259
SHA256a14fabcec9076f9362967a280e63c919182d69c7ef640537d104adc5e60a9cf7
SHA5121e83f2717fb09b5e65d7e0990d9d8d43d16eb01db551c536f7493d17b34eea4152e16ade63810d8721746e0c91a06e51a65f837962c52636170c9e0dd7404f11
-
Filesize
1.2MB
MD52385136253ba9fedc0bea15f2b6bd2b5
SHA11185dd4abdd4c77437af774948565a5bff567653
SHA256e1efa14f667ba3ad36d7e8eae35935c0ef6de208dcec1ac436b5db24d5982083
SHA512ed4f5ab1f17f18f6290274e367b2162ae6a0de68750c2bf03470061f094bac80705e48bbcce14cb8b02cf16f37f7100ed5b72deb1bcd0128f798a8f41b72f112
-
Filesize
1.2MB
MD5dc72ecae8dbd7be3b39740dc72f58f77
SHA175d1deca4c26e2c733fdd08f9690810e9fc33661
SHA256a8967ea74ecf00eb9bab225a67cbecc47a66696137e121af56713142c521ad31
SHA51290b1b58cc445b8882573b97d0825e19702b2bba281d362ee07b7c9a24e4edf6bd94756b61421be35fd58d26025c809554c452341ca347cd6ea65a2966d31d949
-
Filesize
1.4MB
MD510157af0eb2018ec53bb5c0c05d410cc
SHA185e8af56a03168ff4ef0d67cc3ed82e9dac492a4
SHA25621f880f786864c2055a8a5081316ef19c1bc08c5b5fa0db21fdcd68127e51e3f
SHA5127f5f6bd4ed4a5f588cfee3a483e796ce4a7c0619ca5ff6306223ae021a382e6e4e0ded7a7f46e19959babb651b182ed07cd0cec67675b93f77922220b74c1eb8
-
Filesize
4.6MB
MD55b8fffe4f11ddee57bf184f65a814327
SHA1afc4210c3e25747b7f16b5c913fe604c1d621284
SHA2569a08c874e8f076f196fdf092fd05ff7521a3cb03df517b11d571353183c7261c
SHA5125e4498e4c973f67166cff197149f2069fa9c0043bb37058ed0084998eb58e4468a44d473176db5bb7a6cadf1511a735d80b9747201e8cbb420da64761242803a
-
Filesize
1.5MB
MD5f53d7d7b13a2edd69968ac8062a510dd
SHA1377aff439600a7a5d4d3c5ee78a85a7b6ef796b1
SHA2566caab9a1e6cdde31f326d4b75e52f6ce6247851c1d0152ff7bc7672eeabcc110
SHA5123f84adb5019b41d78f0f7d02c1a56b7e7f7f7eec5d04ed861c555e8a6e65415d64631211877c54e706bd05ba5ff65fbc85a080cd451680d9ae2b662b07df2fae
-
Filesize
24.0MB
MD5fe72e0e65299c0f193a0cdb0be5be7c5
SHA19941556faed0a1c9c2255354b6ee4515ee9e7b89
SHA2569cefba9e6d0f3cbe4be550e74994417813bb248a85ebb7765b9815ed0184774d
SHA5127e311849fdb8df57239bc1cee470ed1ac9e86ed774336794b04969c86937be060b7a254b197204bd4de7056b20ad1c8210d74280e129412031565e60c4de2d42
-
Filesize
2.7MB
MD52de252b06cb9864f7c38c6ed00e249e3
SHA1a76c93660a27f209280ab1df2705de868e845bf7
SHA25685e8a5a7ab194272fd0b4a295a5ea806b714b79041194efbeda4996ec0141540
SHA5121582e22237131107fd0cb828d9f36c4a1fd5e13fa80f8ec671acb6e3db867fc3358dfc3b06b85a37d2fcc4cd7bd252650ae0e136261c938f84f77b2aba5f499e
-
Filesize
1.1MB
MD598c55f799fe636869dc9e4e0eac622b1
SHA1fbc5bbe970f42db4c11fd70d65668d7613b269c8
SHA256c540271c3a4721bb2559454faa906d7b469adcf7d56ee34cfaf68c2f9b9236f7
SHA5121279a0fb33bf60c80ecb4da0f847b9d930cf529c38c863d6179a64fde8815b3a85cfb76b162df798207d4aca3984126c0f4d4037b8f2850e429f9ba9010b8042
-
Filesize
1.4MB
MD53fe9834d6e07e29232fd211ef117d728
SHA1732505da878330522f4415c5a5c1057f7e81dd14
SHA256f7db6804a21942002c4c3ecb862d8ee75ea5f7d3a3febe2ab7ecc46e8aa76bfd
SHA5125fa726d2d64cd388e95fd2ec320fb6c77cd4671e569a7b93209c970b042588c8226c7eade7926b16adb7eb0d955f7876a02ee4189133b7a071aadd2887e2489a
-
Filesize
1.2MB
MD58ddee55fd324d99a8f4ce2805d235c7e
SHA1e585f181379aa7f0edc6d7941d2aad9c7eaa1d8f
SHA2563501ba4a198d93573eb6633b73144b841e6adf86a0b49857a2c43c395593dd5b
SHA5120a1b4eef08835f0f929d5fcc5020dc849580b41925384e61b6d37319fd7e3a8949c8cb70f367284e7be26a3f003736bc6d5154cd12d750d2cff19affa7c220c0
-
Filesize
5.4MB
MD57d1460bfb1bdcb33b75d1323696e170d
SHA1e28286bd635a40ffc66cf868d07f32e8805a579d
SHA2565cff63dab5f48b0c0ed51a13d173c7aef1590741a5e5382ccb15439898d14136
SHA512563bc2f1185803d7e3ad42f81d8168b0a771408956b8fddb941909c1946a3912d1344924462ceaa099f0f90134ff98cf1049f7d12075dbf4600fd512ec642a3f
-
Filesize
5.4MB
MD5f23d9110cb34371538505604174b2bcf
SHA11c1d2275c29cb17f99dc2d6ba8b2ff460a395fde
SHA256070109924aa51bd7623cd43428f1f9d7d0ae03b2fc5c31e900bf8d045b5a1590
SHA512cdbb0da98b332271bf3533a5637d5e64421c4adf7a15594998e29fff20f685a1397448824a9082a98ec0f4c21e0dc9fa95c49e206187eb9083ce930b4e116872
-
Filesize
2.0MB
MD5e699b83e449a530bb4b807cdda3b3187
SHA1c1a4a5204e8572e31f56b26b6e296702ce0ce13f
SHA256a25f4d25518c870f38d0cd1a7d47c12f35bebc6dc4dfd1534713339a0ba79ac9
SHA5129e7ff2fab766a39a16ca2d54c2f90d2e2c90c8238541feb3e3f392240fb111bfde4bbc18287456d1dd02cfa04dfc01541595f50fb9a6b3eb84b016160ef2a2d9
-
Filesize
2.2MB
MD55d3a4d443adce7b62f3c24fcbed433a3
SHA15f54d1fd82b14dcb9f84bfd22567973f08492098
SHA2564a7c9dfb890bb809a5a6abd07fbb0227b6978fd2431fef3345b282a1e10d730d
SHA512af682805a208550b1f1a6a1ea26333b4df47c078ae8e153d8deb0ee4a0c9705e551f3abb86d1327181d7a374b8d30f89585c9b5c24f4a092afaed46036555b1e
-
Filesize
1.8MB
MD5060e8d5683fa260e05d257e67483f7f2
SHA1c913a2cd59db4c48ea1434dbeebb178232f98806
SHA256f2012907d1ebca355076b04c67fb59203a09b128ae529c33c8f4cf5d0f5e8cc3
SHA5123a35d406c80804e79625598b3507f2bed103cf3fa8911486e6ff45d3ad39d50dcd09757b1c00b64a4e59b21790a0f4282957fd1ab93bd817949a07ef6d2dccd1
-
Filesize
1.7MB
MD54a37ab7cf5d0253862874fd5b9325653
SHA16d5eb64a9376d857bbb0d7599faf7593da54605c
SHA256c24e42754a0a7c24d4233a65b2fe3ecd907e7ea9cc7c13f92517281f9383849b
SHA5121add6e3971b63e670fded531128a1b219d0c5b6e961f41f0ce86996f241dffc77a9a808d03205bd887fd66e37ed76d202e46de5b1a81b2032f07757fb9deb0ab
-
Filesize
1.2MB
MD5dde611a1cf1fba77add3ef29a25eaee8
SHA1d4d49aef2b49a5aba710f7f1061adfafd8e6d2d9
SHA2562eb0926b302765ee072cd137f92213429b00cf502dbe28cd950815fa2c7cfef2
SHA51200b911f700a684a782c89c7a697d7b2e116dfe2ea31abf6761c522d305fa405546a2239efa3f8dfc5c986f6de339be2bce982a832b65561c754c916da9aa8c64
-
Filesize
1.2MB
MD5ff6a2b2a03bc9e06230dbf37fec4b413
SHA1e6c5458bd3d412372d4084dfce8ed89d64d77d84
SHA2564786b13ab5fa518977e975c62c88f3837bc6703b071530e4aa08d57fedfa27bc
SHA512c02dfcb43c767c636ec3e0a26949c21f6a389a78bdc23761356ba96096271a95d05b2e45127856968d8ccb299f8a9e0319a7e0792d1d1cc4fe6a641342d6debd
-
Filesize
1.2MB
MD512898e7101dc4245f686ff0f1e81c1ec
SHA10c238e9637efd8ff859214f245b5600c191f121c
SHA256c0c83272b7b75249af9e6f3020535751809d2413746f6234f45e632505383082
SHA51241c008bc4300f5ed030df295cbd05672bf32ce8f8bf214bde4c53433ad40b4feb526750e2e8f326b762b6f355dd2c562aa5f74e1e3352fe2e4da7525dbebbc31
-
Filesize
1.2MB
MD535347c14333c47d673ba5c482166834e
SHA1c4cf6bd64438c3ce8cf2cd84d4bf0f653536d1fc
SHA2565802205d143bf5648d21b00df2d4cff3ee14072296e252039668ef2b3b2cddb4
SHA512250c8d56f6e1c04c0c091d69b74d354b78485412d4ed9ac1de23cb3c00f162a787b00f67a6b1a7decf3fb882ec03ff376860223111ba5b5a88b71ae431fa3ca0
-
Filesize
1.2MB
MD56887a094e390039720dfb4d9d33ef1da
SHA10a694807fb8d1b5162cd07d4943d52f1bb3a89de
SHA25680067eecba973a02510939d6ef00b911e17bf844d79509b6efe5e4d21664e910
SHA51259d16a5fc2401de3250ccbf07d6080736391740d71f61f408b4aa0126b7a56df2a701e8c3968f9b2cd0b444bbbcb7c47f1c486bd054de94bc56561181dd2145f
-
Filesize
1.2MB
MD5c8bfaae5ea94a5e3af705ff8da0cabf5
SHA1dd84ca64e15eb5174c33d4c7e7c3df82d0e0f1de
SHA256a5f1aa6e53b9be17a607b94b2ff4078c6b41316e5d76e2426cd4016c4831c87f
SHA512e894de804a4082147f236d0907139c0a5c8f87b718c77a9c46d8bcc34594cc4f171bc419538e27e98cd5838ed7b0cc55231344a5939f36c867c1ddc0577f79d2
-
Filesize
1.2MB
MD5db443fc1ff7f803eceedcde6b84b157c
SHA1ee73579a2678c59fb5cb2220aa125fb7e7e8d0bf
SHA25699c3f416e4b6a9d8fe977d03549c0f7bf3b8bf2e02c4289d1f392526945c7b91
SHA512ea3537962ff0532c52748790901144d70853cb2da96ce1357c3f93e8de8348275f5e9611fc32ef2bed28ef5e9e555a711bdefab0f177a01651d058ba73871549
-
Filesize
1.4MB
MD5edebcf545e5b814b684d0378cf8e36b5
SHA1fcf10d9fdc2f55ab3a12360d9a9a501194488655
SHA25648a922dcd963c52c5945ae22dcd28fddea1f0690902c09d1556bdff73289817e
SHA512fdcb52b4d2abd99b2ef5bfe461f6e5068e7cecf9f4bd160ff2045707338c89db74728a42a4ef6d66ed9ad72569445d79b426b1abc8b7fa38542f3d3a7d12e145
-
Filesize
1.2MB
MD5391379977a4e310e2b527afd61ae8d1b
SHA193735adaaa5ed9569020ebbb29accd56d8679768
SHA2568544dd5e07ae1e58e478deb76baf6d6c9785269893dcbd1d691f54317b56873b
SHA5127a2432ac7a59805b52c1a1df4864eb5b5a81666fc0f1358a9386dde8cb2d6dd550a01d3ff45ec459d0b0b319e0d6c67d3912e73e2a3c725fbc3125062ad8bb8b
-
Filesize
1.2MB
MD5438a14fe904fa68eacabba960fbce3d9
SHA1760741264292d5f035cc60a42ba323bf6965e910
SHA256ba181d977dbea66168cb7f321c69ae01d7e474ae8116807caca464951e0e17dd
SHA512c4f9c5d4fe87849a2be6574c334a9d61ce046f22503dc9a39127fc768e21a657aa74f51e8680726241b28abb135131d597a7b9d4cd045c5317604fc15bbdc652
-
Filesize
1.3MB
MD5c7ca96a6a4707ef90f4c987868723b01
SHA105bb30015e69719ce9cd4655a9280eed1b8d662e
SHA256308481508e31aae6890fb9fa36e75046b947f5b308846dc1f3bbebc8624e5e2f
SHA51221705eede1c20e217bcc78769d0b7d3a323ddfc8d6d394da9f6d0470f716c240c7e5c2b88d90b1206f83aaf23eeeecd72601241a367648f96606cf5489d4d94e
-
Filesize
1.2MB
MD5b58f23174d15961aea066eea58b714a2
SHA18876c0d59f2bee0035ee916a74de0118697654c2
SHA2561e0aa5687650fe9d5dae355afa60b1c67b4dbe9f300f2fcabc50aef95f8e082b
SHA51224178582b84e482c23bb8b28c24a30ffcc4f1d351aa01e672f5540109ffdfd12f41513c09bcce176465dfd3aa2b4f65bca7ecf38acd225f025e3526471d34910
-
Filesize
1.2MB
MD5911ce78592d55e62a09d4d49f2fd89b6
SHA1bbb304e9be592a702e50948180ba1381ae9ac0ab
SHA2569769f6a95b42567e662aafae945fccdd40a89f7ec3114b5c5856997128bf6b21
SHA512abccf93016c7272d1056c77a639fb4f8bc950e1ad9a93f6fd94f84d2a17ec0fc2c9dce7080a2af783b459cf3b55a0f21ac1ade9659144c06fa27ab9be9f78736
-
Filesize
1.3MB
MD59f34eff705e113d7b2af9f781e111d26
SHA124dda3ff83569857bfb96c73856069d9d72463af
SHA256802a4653b1c2915e113269326c9a6d95021e35ad9ed185c92bfb390eb4946dfe
SHA512203178492a2cdb96114a67572154546ce55665c5cc54e365a1ad6eabeb780964c2f51505ef604667fd4bc1dbb99b16e48253b3fe75f96ae674c5668dfb4ce4e8
-
Filesize
1.4MB
MD5c6437ab96e1a125da2d2df78deca162c
SHA14e0786f4e49d99794cee6c21365d2cf31c37cc25
SHA2560e94864ad307d03ab27ab8455181abf0c6357dede340252fd26408e2df318a52
SHA512367bf14b5175a881af1bf0b145d1f612526c556137b97cecbe61c4805ddce9487fa4ccae3e1e0f5162163648b69a54a861510e08e1b42b33e5f5cfd8f63412c2
-
Filesize
1.6MB
MD5dc789303d099862b9bc1867af7fa7ddf
SHA1ecd8c044671b802bed5f541784459656c20319c0
SHA2561b578e9581171602de84bf1b3f1b81a8b6684b5b1f818e5293e4b94bde26606b
SHA5129fcba5d028e34d9445bebfa0aabd0eb5364c9d35decb7e02441b64e7423370ee2edabd5bb68e284a3a95f46c8bf3a9bde8bcf02fece0750b1a3cc9da5ea25f5d
-
Filesize
1.2MB
MD51532b51735fffa7184a795ab89758d7a
SHA1e0f5b8271feab0f67c46250a13d4349c86e16591
SHA25601230d0e6f3bfce5e32ab76b4ef210de1bdcd7e0551113df57f5b0371f5394cb
SHA512f4394c416b35816421f152825bdadf8ba48dfa8fdd2d5684a541160d4ff75bff47d7c6adbebf9659176e0298b6dfe6525550da86cacc2a805c351c95d42aff40
-
Filesize
1.2MB
MD5ff918b97754c796603a2f7252fdaf230
SHA17597ff4788e30a7274ddf6ec77191efbfcc22cb7
SHA2564248c6e0cfbf33b1a7430db37301df005afc7aadb58b3dd2a3c5ad369c1dad49
SHA5124b68e15df2107f1023ba26258d9df8d1343f0f2a9238ee7b704c5656bfe8e07da7cd6ff9524029b2b3ecec212edc2d86e244cee977e741a4febd3bff3caf068e
-
Filesize
1.2MB
MD5281374446428e92d8c6c7695f4840123
SHA156acca47d1247ffefed2e840f9973032c21578d2
SHA256e575c51acb6934d358781ee4eb3832470ebdf392d89277fb2d0e29ae8802b485
SHA512638cc4026bd90d0dbc1259c34ebe648d96a01e8fd2103b6514471fa4fafdfdda685e8be70adc2fcc8a18ad1009532ad94d68e1ab3828e57b2b484fcb8648e71d
-
Filesize
1.2MB
MD5faeda41c1f5929f6a0c8d526aa2b0be3
SHA189626135aa7753a140d6654c8aecfc3c5989ff65
SHA25674cf92b34e9783f0ec564d3d7bc4e80411237d21adef33a19048df8f5d997805
SHA51234fd88f91cacacea5fa8ff02a971cbd83257ac87f679e0c0d5e89daddf7d034bce74b6201a59038a53cf7e8c5596b5bc6a63ebc5a3ab75e3ae502a25fb543618
-
Filesize
1.2MB
MD571fbd76626660bf1186522281edacbce
SHA116d13582ece7ff30a224f3cb9d1639c08a475604
SHA25680efd4532685634d23914fefb3e958d12e19671e5162ea0de1ac883c621418a5
SHA512276b8534e733bbc5455a1a4b79cd7bf5e030f15e8338070a1490703c8d3b6932ccc014826ed0de0675cee18dc1196d3a660f01ac0596b2d4ba0fe0109745ab51
-
Filesize
1.2MB
MD5bffbf1723595e66ae3299182a67c51a3
SHA12697e0846456cab58b2a96d7a951846ac139ddbe
SHA256429b84f666c0185fc82d15a3d0694748f771bda9d08d3157c00b00b85808d77a
SHA5121099ee33751b801a7d3d039dafdfe18919b620a5810ea22c7b746fe72cbb0b7080a650451c9c38e12dd21803809991ede97ead09c7c7c8acbb0b66654a12a32b
-
Filesize
1.2MB
MD5432ef9c388ffeb72fe823177fd26b145
SHA1ceeef6f265e9d0c4a23c402c4699cc0c1d563c4b
SHA2561f0788544b94005046e296c74db068509db199b7e8e1c84af774dab90d2f8ace
SHA512d01cdb8fda869a3bf1dd9be30eaa82331985e63250a831e57b8483e1e646e16f5c0f417b9f9d20009c77ea155ef24b5ce4d0731349688ca16b664616c9d27134
-
Filesize
1.2MB
MD5766132ede142e9987cd0b4fbf8bff974
SHA115bb02775fc813b7384f562c71dfe4f7a6052514
SHA2569918209b226565e8bfd4be1711346f2390d2fc259a540b90df9362d491544b07
SHA51235af766e5a1f83d3c444d0a5485b8b637d909edad05f15e69fe90b6879eaeaa3695db9b66bf3db9f676d72572d36754a7bf020d1899247063690beb534ea292f
-
Filesize
1.2MB
MD59fbcb1c6c44b82462a84744f036f8f7e
SHA15b8b8cb6cdc255728c68a5eb7d57d346219c85f3
SHA256565d29b09583c9f91966c32964f095cccf190ea8eff7e7bbd2479dc0ade1b23c
SHA5127ec0066710c3ccb13ae0f6979b32e597df9a186419ef2dc0f65bce73d1988a1f38fccddcae76bc0087b63305e73e2075a7e7ba634095b6bffc33fedf4c6eaaca
-
Filesize
1.2MB
MD5bb52cb08c8625619072cebbb64ff9dcf
SHA15dfad5f254a63b7e8f8a619f090fe182b4ffbc1f
SHA2560c7ec60fc5180735a1c5370f1fb69dc2fa82e3b792ddb6bf33d4c0b05f9755ce
SHA51297f57df75e381128e81520346899d122800ba19d767207fda1265b6e983fcd71bdf10e7a6d30369b87f32b309c157abb08cc3233da31fd8198f681d9f01df2eb
-
Filesize
1.2MB
MD514bc827173ea812e54505602dc724458
SHA1bba59e993dea800850376c678e0a0d76e4ff9ee6
SHA2568e4dd9294be42b416b48546ec28bdb32d02c87fb259b583f6282b6a5b59f3887
SHA512dd82e6b7c1a19d5cbfcc26f8d2c71952c4203888fe26dd1cc780fb35956778b6adb10cfeb910b72b13efeee5ab67197fa711d8c10cc73e93606ca4417d414a6e
-
Filesize
1.2MB
MD5f2640cceb595c6c943198e302532c84d
SHA18e642678d5090ce1b5b2a60879114c5ef5e998aa
SHA256b0c8130f5dd927d2339474e29cf92184cf835bacda0df16a3ae252cbe79a9203
SHA512b6125d8652d22157896192a8b39f97eebdf5489fe2eab15f4848b1d2b2ec8ac2fd09b07829a3d67689a760a42b126ee7ec71f7b55bc15bc27939ec26d61b8f24
-
Filesize
1.2MB
MD5f4830ce4ca274139f8af490deb55961f
SHA1862deaa1e0fcce2393240ced0a6721e2f55fca70
SHA256b413b708e99105415febb93e4de8a4d7004f8d636dba801764a30f4a5e177956
SHA512c1aa9f1cdd2ec66de139453dbd6670478ef2903e887be4c756c95cb1ae34595324fbc62da0c925130e8afc65333e178ca6d0d9f987c221b6b5c3a4fc04019a79
-
Filesize
1.2MB
MD54177e33d66e78c9b83c4bb66f9e19b5e
SHA15a6d47f6dac0fcb494e2674e7d1671aaeba485bd
SHA25642c51eeb7b3ceff23d83306ebb0a90185090d0c0dcab2d2db937d588dc32e9b0
SHA512153321db94a0619e6a1d0ac1d29e1652245fd04cab37b82b5c19605a3302ececfc43a788792e991b6f57627f525c88f1d3a8069302b10d942c72be377a11884c
-
Filesize
1.2MB
MD59e06e74bc9a4ddff8c895fa0edc53e53
SHA1058aea17d8daa14d5fd79d5bc83f7d0e0fb2ef51
SHA256f0821a56c70f0142da1f52b53938a36b9226ddef5f5dcadfbfa1be4790b4d1c5
SHA5126122a9b8a9a38f354bcb90ac0ce5606768cf3c06cd5f948fb335d7f2d2f0a5462ac725ddf351657719bc5c7de8990c96f714144e2744c152ea5e1c2cd15f83cd
-
Filesize
1.2MB
MD5354629bf03841f8cec338470f4ebad61
SHA1d4bad2a76e1e99e4273d5c1af34dc59b197dc17a
SHA256ed446cf510096968b223e6b258912548aa679b9f46ba1ceacc0d734e8cdb3dd9
SHA51236faa91952f544059208dc923011b9e29eb5b503c5a1d3005130c1b383af8f04059b71dd4efde642bc3484c53a3094faf4c57cedb767324a220a9647319fad60
-
Filesize
1.2MB
MD543b41cb18b09460ef9607c27b92092f0
SHA1ac8e928aae42a53ff6ec09a3a3ace5b930eb1c0f
SHA256c8a1170b3e495d9e4937b08d5c708e8800beef1862e72d5c88352cee8cdc452b
SHA5128baaf12926d418f3abc72d5d00a997bfe1f4c650ae6f25abd506463f302c306bc3be4c21774f70d21ec1542d46707660c5c929cd5cfcfc0d19d2a007b0494091
-
Filesize
1.2MB
MD562012a2e105963c2512d69d47546ab13
SHA147729010ea313aa73ede253d0f02e7723bab6630
SHA2568b73b90ebcf08bb3f8f77573abcef35cbc3d1da9b8370d0277ab80073795aa27
SHA51274703ea3b7d9b338234cd9ecc8e6c54a20b99cb4530f0c820eeb088db81f14f7c164ebbe6f5404ae6c78bd87f713906af774958d0e0b2101e104ac3f99ab4e5d
-
Filesize
1.2MB
MD59b15e92af4cc913323d3d9f98f0db12e
SHA1607d9bfaa6fb92a5b589e810eefcd228be58d4fa
SHA256dc587436da7999b62bee9562843ec00aaa1afdd6e6d1979303c34b61deb47434
SHA512bd8267ef289f8520dd146f6d21b1c4af1f9a379a036628de0f39bad376bbf19aaa48b04551c1d0658117194c0c663d5577ee91129d22ff4db58b8d20c645cecd
-
Filesize
1.2MB
MD552babfa2476a55c155278783630b9983
SHA1f81e601b449b360e3c47ae33a6ff48a83f09f623
SHA2566a17850882aff65239b35e5130df5e5a6592c84995bebd13da2e86856738a72c
SHA512f80161c9e585991a23db764ecf4983f441ac75862f714c06716d03d3a53625730dd6899a23c813c7c5a48e536f0899ea1c6c03a8eb9d9f22737559656de3e233
-
Filesize
1.2MB
MD556096a406a21ed527edbcb1fddddbb30
SHA1756453476dcd06500de304ce8713236feeb116fd
SHA25687e10e6fb65bd636e96c03e38a2687c837ee456c4799c68d031592069287e660
SHA51283c3b66af4590e4df34eed6542e491c0d089d3452d87735873bd6861a527e4a0a4b4147ecdd49e5cb1c06a5161d2fde894d17643a55793d2ef910e10173573e2
-
Filesize
1.3MB
MD556ba4a3c63835cbfdbfec254a0d7ff90
SHA1f8e12b109a95e3504fe7212db48eac8a5e921644
SHA2566bb233324c4c5a3b8728143b5140f1f258705c9da25c276366a2efdc43f4f724
SHA512c298b8ff341e6e5a6c74dd37e73565e2080a1f754b6825ab4f039814d697d2034cbf046871905f22f6a8fb6e4ca3869e361ca2a0de2ac7f16818bb5dee57ae9a
-
Filesize
1.2MB
MD5937478c86dc1da706e22e7e6b29ad0f0
SHA1f95577898228713d796659daf9d7a869f6b6651d
SHA256c4b3931187a5e51f850774ab6f5fc045fa6f2185d780374a6e66be3a0ddbf020
SHA51269c37add83830b4e6ac64e753e67529195fed89830da7b92eb692133d5af3a33cb773959beca9b205835ccdd63493d1889ea9ab44f6bfb4443a16fef4492846a
-
Filesize
1.2MB
MD51d4dd5a91cde263f12225e9fba56e537
SHA13fca937a7ba397d1020756514bd31fab5e732dfd
SHA2565ad8876c9f418b4d771f853a9584a69e58df0212cba879dc9316ce580bdb0fe3
SHA512dd6f779bbd59173b0cf86996a7c08930ce66b59638ddd2cb9838cd20507ee0b333eaac83d7a7fb0e82bce303c1fff7f6f55c8152a96eb842fd1fe4cf6ee2822a
-
Filesize
1.3MB
MD59c2044dcb221f12176b7dc8b3efb6113
SHA1459418429ecf1c28d0c2349c6fb41f743ae176fb
SHA256f26b15ccf86b0093b832430221135d76e26fbcfa5ead98211d99290778eec6f5
SHA512502f74f64b916c3f840ce02dd6db3a1b6d75ab6a17e378aea735224024db2fa3e29d7772f85ca66a34fa8d9d02fa4d093b635da942903840e54924212b26ad0a
-
Filesize
1.2MB
MD5af84b73d7ca6d02a8b0fd7c7960628ba
SHA1d0f4e88effd19622b6a67a1ce309efeed4c98acb
SHA25693b0fb749c72b26078180994459e2979c7db5fb565cfc1a63dff50669adab2f4
SHA512d53d69acdb2a053bc9e88608a114e861b7a33fe58e9d99ef7792180377ef45f4b995a4940cfca60c1d73c75d29f2de063634f0df207e1b9743b8239bb3548eec