Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 11:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-03_c9c4467a85269f31c43fd66478b2ab8d_bkransomware_karagany.exe
Resource
win7-20240508-en
General
-
Target
2024-07-03_c9c4467a85269f31c43fd66478b2ab8d_bkransomware_karagany.exe
-
Size
677KB
-
MD5
c9c4467a85269f31c43fd66478b2ab8d
-
SHA1
800367d12014b67bf4ae6e8e565a040c0f8bab19
-
SHA256
2bdbd97f8d195e4e17ee6c1c394cdc9a81ee6537dff855d4a560f5dfe7618961
-
SHA512
d79fae22db0be2c1ca3d01e67ec68311b01abd5032f240546b91a97e66ab8707fe631e7671970aff995c86adb9c02cf9d62e3a9b1c6adcd2a3080b633daefaed
-
SSDEEP
12288:IvXk19nKGVlM41NTnXENcMduaD3aawgPwCnQ3MHv8CI4OJ1bbPHHcFb+KKqCGNpq:sk1BRVldlnXfH9gPwCn7vOb7HHcp/CGS
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 740 alg.exe 1100 DiagnosticsHub.StandardCollector.Service.exe 3404 elevation_service.exe 5016 fxssvc.exe 1500 elevation_service.exe 1484 maintenanceservice.exe 4936 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-07-03_c9c4467a85269f31c43fd66478b2ab8d_bkransomware_karagany.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-07-03_c9c4467a85269f31c43fd66478b2ab8d_bkransomware_karagany.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\3f1cf06b3b9834c.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-07-03_c9c4467a85269f31c43fd66478b2ab8d_bkransomware_karagany.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-07-03_c9c4467a85269f31c43fd66478b2ab8d_bkransomware_karagany.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-07-03_c9c4467a85269f31c43fd66478b2ab8d_bkransomware_karagany.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1100 DiagnosticsHub.StandardCollector.Service.exe 1100 DiagnosticsHub.StandardCollector.Service.exe 1100 DiagnosticsHub.StandardCollector.Service.exe 1100 DiagnosticsHub.StandardCollector.Service.exe 1100 DiagnosticsHub.StandardCollector.Service.exe 1100 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4172 2024-07-03_c9c4467a85269f31c43fd66478b2ab8d_bkransomware_karagany.exe Token: SeAuditPrivilege 5016 fxssvc.exe Token: SeDebugPrivilege 740 alg.exe Token: SeDebugPrivilege 740 alg.exe Token: SeDebugPrivilege 740 alg.exe Token: SeDebugPrivilege 1100 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_c9c4467a85269f31c43fd66478b2ab8d_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_c9c4467a85269f31c43fd66478b2ab8d_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4172
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:740
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2544
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3404
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1500
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1484
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD559ba1a58fb8f6a06d7da7c7963d365bd
SHA11483ac37fccb73b872210a1a35b587926cd0a052
SHA2568695f0a3320096a7e16b8750fb5cf35127e900c3b270784438dd72f0e31d6faa
SHA512cb827436d2d40566288b967dac6e9c2af23f6894d6fa08dbaa2599e9849907f5c74eacb897cec43eb4f705d4414c85c2eeee6fff679dda47a599e0f0442f6f9a
-
Filesize
797KB
MD5033aed703014f10b5820d46a59308d3c
SHA14377f8e5bd8436f47171d620a30a5ec880dbb361
SHA256c25cc30285b03d495d96ff11456242c23e6220c01d9041bc8fcc769923169f79
SHA51286bca07c1e0ace2742b01bf556d7acc7bba206d71e3fa8cbc384771520f7e5d599ae55513610cc9196ef528562593c73a03c0a03e7e027aa988991f1fcaceadb
-
Filesize
1.1MB
MD5b70c6ab1c088465e0c53ded91800cda5
SHA1d753bd95ba083ee4190be3f27c38faa62d6be5ad
SHA256dc197c6b8e0957e21ef184d91af89e4d807b9b3a791dd68795e7d0f1053fb524
SHA51221264597e0d6ddfccaec47b1145c7c5167d15e64e9c117f7064219bda2039077a29c94e09facd5bad78efc13a2ec20b2d40cf868a1f016c634361a51704e8445
-
Filesize
1.5MB
MD5161b41c8911a0d04dae925f7ea7c37a8
SHA1f42623e3b6a6fa32bf63f0f3e679ab10f2e57ecd
SHA256c8aa5cb880234c11b9863dc5cec0066084dbaa7eae608afe82ad7522ca0981c5
SHA5124e4e1d9aceb7e61579c11439d267eb72f586bbde77d6943ba21b167423596724a1f623b1665b491f16c4c6a1f01c01ebfbf7d2e8f7e85f79a0acbddee0d2c4d1
-
Filesize
1.2MB
MD58afbac54d1abe5c2a806e3027006bac6
SHA1d011b32f53684d1ba79cf4deb3be6f469d9f437c
SHA256508a69202ad45ebafafe6302fa682f540054c0a01e6bd31a8d4fa058a8f4663b
SHA512b4cc46f985a2da41765256d6869f2f7f08af973d2153ddcd86df904a8720d7e2c54f3fe8832565699bf9f853a4c23511f61c5eaaabd101d3a5d84c610f3ca880
-
Filesize
582KB
MD51b226fe8ba72399a271d893153c65c13
SHA15d48a77641552a693f9f4c3422c936714c980302
SHA2566b35db0330d0929de336e70ef8c9c2325c3b111441cbddb8e87d2cb3fb73d353
SHA512649b8ae9fab2f6c8c2ed5cb71e385ab712312f6cd0a6979c4a93d4e65dff872303d58d614d6c31296f2b1e198fc56defa78f93c3f7615486478f9668da04ca18
-
Filesize
840KB
MD534d6dd8bc69e2d2028c74c6b4bc78bf5
SHA164052cbf35f3b5a4979d21bb869b4ddcd156fdf7
SHA2565df3d120f3e07d29e8b872eb894aa674708629c2a336141510e4c6d058bbcc9f
SHA5122130b0b69931aa237bfa8fc8edfb2d5084ba63ec773b7739c9f40466767f867ff29b07e4c6e9967ec09a66485c221d72ee476d3530e677359ebde9ea0f0ff6cb
-
Filesize
4.6MB
MD57caa80e4feb11b23d6df24fc3e4e82c2
SHA1a5405aa245febefa0058c52f8c74de4ad2221edf
SHA25610215ec3e3edb29835f7693607d79c3d9fc0d24d7393b65a064b0634ddbac2cf
SHA512aa4ad5a7f648d6d4fb1edea74e5c0b5666eec7806064b217239ce2be9c4e90b4d2b39299b6693076e52b9e6fcf4749f9e6bc0461af6bebda25fa73f51c24a08d
-
Filesize
910KB
MD5c03bbb40b38fdf4bc89c9d5a2d9d186b
SHA14305537f269c139ab8dbddbd82f742a2ade4a722
SHA25633ad5c4092cbcf14259a36f1d13016675a38423b51ac0a3f1aa6967e2b147ac4
SHA512956beece7173fcb6e69176f14a1f640318175142d6dd08788687c31e3c0ac498296cef75b52501e8caaf087e2705db9ab9b1e003db0dc4a6eb97603bc959ce7c
-
Filesize
24.0MB
MD52975bba382ff0856831e6858abd0b7c3
SHA105dd1144566d98c43870dc0741e5fe9bb274089d
SHA256226bf89112ac54d940374445cafa3ecddc49016e6bb8d4da125aac381c5a4ff3
SHA51203992c248b83565f0c063a6353074a061d921ca524b84a6f5f666b357f00ed270b29415eb962cc9990a28a25bbc311ae35fb319761911f4364492858141755ca
-
Filesize
2.7MB
MD5bcbed3ba6fa99f96d9a4d3eaf474a5d1
SHA17cbc5f92f7785899e5fa9e7955b938c3b5db65c3
SHA256dee4ee1c655d56b48c137e97479ea2c6f0a8ff7b1e47ecdc77eb4f692d550210
SHA512540e89344c3ec78c3bdc1731c6a3bd0c82a0dc1a981e0a1790a64fd78480c59904396cd6b2fe7d7eedda3c96be55e863e4ad4759204ab92392611f8743386854
-
Filesize
1.1MB
MD5ef88d913176dcc1e9842d6e43f29726e
SHA1072e4081a0dae0982de4f3ce1422406fbba26ff7
SHA256a7226ec548012d10463d0b8d55d03008e7fe541ff87782e004ebd3aca6dcd1f3
SHA512edf337699b02350a5013d8f74faa2188e121bac95af671dbd2a0ce9ad4facd73c7c9c00ad57a001e0ef762fca0de0780f3300031014e3b683bae8a6e9398e95e
-
Filesize
805KB
MD52c5d96035939a01052a0853e3aa820f4
SHA1706fbbb78cad7ca5af930017d122ef3ecd389fcb
SHA256bfdb8e1af5391f1897094067671bbb27af49ef9563efa2841b43fd050e366820
SHA51208b6eb59a4fff1295304a0ed8f5902f1c942f95837469be0636cef38c25cda2af6ff5f7144036863cf9afbd2133044847ccae6d296833bbe7b2ab60d6a85fe9e
-
Filesize
656KB
MD5c66b258ca583ba1b5ca6a08adcd80569
SHA131244e98225120fffaea82456b575a9c034ac0a1
SHA25618a977f57c2012f196109af3b922a695d0d6a21da5d1e42a2edf48b911f7d64d
SHA5122a8fe5903e91bfc6b1154e4ace41bf860c638e62428bac7f6ae00da39976e76a6e54d6f4bce1ad538e86c464638ee93469eb6ee426c0e8131547d430b780ffda
-
Filesize
5.4MB
MD52594639031b3bf539cbcba5535b713e1
SHA1abe8ec4d499514c997c5792a3a532454b5ea24fe
SHA256423fae72834feec59fbb731f7797412047f0589b6bacb07f4eb4c65980f75739
SHA512be04c03159ed81211c514cfb98a5bbcb50f85406cfa42c355ee08da8406277dab1af7869efc2aa8b4d390a6aff276255cfb0b38f3d27024ee934753e6d5a9c35
-
Filesize
5.4MB
MD5d2238a603a2f547a8cf7823d09426726
SHA1f19ed56a6b80e475bf190f84fde91f7687401a47
SHA2561642a820c8ced2f8a147c55e637989990ae4de03ac541d2bb6c7e7977f1266f2
SHA512d6ac9e1d958f76cf2ffde32981e876c3a873d17cbfb71e2b9c5cfca72b0448912ff53ad199340b315da5f38265bfbded1c6f1b189b2a2a21d06bec4343759a4f
-
Filesize
2.0MB
MD50c70a61da8cc405c6d69eaa4d0dfd134
SHA1fc5ea8020e06335b151f65527703913c9345ad64
SHA2565107ba1fabefc5a03604ff05ad19dc7ba7c485ddc1c931f8f5b5bc69b5b1bca7
SHA5125290f9df547223b6e26047863bbd6e620efa0a16b527dc567d35b06c54aa55086de9b77088e38f93ce5d97b0102370ae37a11ae865f13d1b1990291e783a7e9f
-
Filesize
2.2MB
MD59403657bed1a955b2a8b8503637e4e6a
SHA1d78ff25edb64d1f52ef0635ab6754b25b11ec193
SHA256372d0b940407f304d9a8006ac25c5fbf3ddcbe553e586d7aad0761d02be25e2f
SHA5121d8f9d0884fc165fe364551bde86d2ba53fbd124a5f061699acf25eada3286fb7a6b483ba4f3356aa39d2b484f2065139aec4c0fbf70dcf1b551433c153d33e9
-
Filesize
1.8MB
MD57b45e21adeee1e49d387276b74ad7fc8
SHA18012b6b4cb319b1503cd111373d48f88ef37759a
SHA256b0e94fb8ad36c723d0ad7756c1c0e204a4448ced99f8e98f73cc797ac3475093
SHA51262b5d52018e26e0c06c689b72e24f9ba8a09caeebcae4a894ec40c3bc5d7940ba3478096f7d3fe4f7578658a4d32805d355660f20208948cfd2487da6b73fc0a
-
Filesize
1.7MB
MD59932cd9f57f5a86067221877673a46fe
SHA1eb30910d3cc6ff18fb2d57149c53f7e64ab21a93
SHA256c650d14fff9ac2778219f883d4c862ac3404380e54a22034f39d7a0bd27fe19e
SHA512cfeff9db631996a1e5316a2aa235ce8c59d6a998885b39ae4ecaf428dd399871c30373d1d451c2d361e2179a05daf74cf73f51d6d47a3a65c294f12e985cf666
-
Filesize
581KB
MD5e73cce5f20a4dcdb929a7469e946b028
SHA1ee3a0c7ae9535048aa8abbe1c039f5a2b55046d5
SHA25673d67b3cf5f0ffb2f7549fa96c6f81e261202c0430807c4c16a4cbb6cf44bf52
SHA512f0643abdd62963eba5b4db3a305e77db53f5dd935f525b0cd6301c24f1476d43e9f33daa6ce69c28fa19860b249b1741853c7002fc6c7d80ba0fbd35a11644c6
-
Filesize
581KB
MD50fc467796b49442cc3db7fbf3af3483e
SHA18ba06c2ce5bfa93fb21993bc4aefe4eb15eb7de4
SHA25609539dacd10e7019858c4fa7cdb13502ed7eaa83334fcd2858f46d78442a4feb
SHA5121f2b9317679841989ade7fd26b0797900506f92f8b7bc4340b31227803dec62110b54f6bc2c304faec25b8e371055e25a591864a490d89e97fc0ce974fc21b84
-
Filesize
581KB
MD56ee61e852f36762730db634ad5594aac
SHA12a4e92d1efe85b05d18fe6d4c75b70d6d63eed91
SHA256f98260e03005e7e1740e0f5b9f1f56867e4cdafb0b65d1d42cacb3b865d22105
SHA512aa11de0de576f5f15dc8265ccc53a19ac197e6db80c74fb5b8d34325c2fe1593409a565f556155e759a6b6e44b5ccbb7b8dbf9b16f33a6c5b023cc07de444edf
-
Filesize
601KB
MD572a509e34ee5e76944a9062ca8cfdce8
SHA1bd67f49b79ea0c913f2ba66bfd6fa840af85940d
SHA256145644151a3b31d38972efd3d8106f451b24c30c3650a4968966779befb1f31e
SHA5129b7342c6b0fee37688948e8958550a08c234805108a6c89e307e94db59cd0f4a637704094899a4311183f9b473eff69ecee2ac19797da9ed29e97954b9a4942a
-
Filesize
581KB
MD5930a41b37f739cc6ed1669376fe79e61
SHA14212a245e1c95e8364a5524bc7c87d52d92eacc4
SHA25692a7ace5efae9475a074c05f08f79c504c1a3eb7da5063548e4e3e39731a5bb1
SHA5126f7ffa58c9d5584f1d84262336cf0553e45a08cae1176cd3d01b6f049550d64fff2e9b911d9224c1c10a4a9221b0ad90309c071c92a77b7456674a9de2e7040c
-
Filesize
581KB
MD5561938d33df2bc3fc61b60ccae46bf2c
SHA1beb5420e91214fc37270746e02a6d3148a583682
SHA256c1bbf7dff68da3b420108927dc47a3eb113fbfc10727b8234118e646f52e97f5
SHA51284edc7ca76ee7ee74ba64a730441cb5622c59c52f775cc054b9bc96b7670b72c19068d742f81fb9c8b9f50ed37b498f92f4735cbf4beaa47dee73aa4c6a9914a
-
Filesize
581KB
MD5f99f030f7d73d3baf268c7c7cf9e44f3
SHA1bd78c5817ae3127217ff5a23a1241f334a0a6138
SHA2568732006436879b0716cb996a847b514005cbaed4d3690c92267115bb74fdce08
SHA51237c473f2fa4ce30155e13137c99c12b3c0c1c11d87ac10a951f61d29020284079e1f42c941be11a881c3bf432310bf65bbd5455438142d51c699d878a0f7c674
-
Filesize
841KB
MD560dcc08609a10f15cfeb489ac137f11d
SHA1314614d7771de929b67177fda7fab7789b63f448
SHA2566bf503bba52704709c663c36d26f6acbaed6af4237d962306fbefdc7813ca79a
SHA5126dc3ae260e65f92ea68bf9be4e067a1387373a9e8281a62ec6fdcf8af836333ec4152d01209c0c5fcd107371178b0458d45800494f32d22dd3b82ad2b7ae244e
-
Filesize
581KB
MD573f345c4d9c9760810de41d2b5a2af73
SHA1e4c96f8699c6cfcb38812945573d9739a48ac3a8
SHA256e30df17ea7ec296adc00e58df8257012ee14c1729c8facde7bfef330931155cf
SHA512fb47324adc6d81219a9fccc274edeb24d3391ae730c04c45bbaa947a063fb0079953461d3da5aa19354baaa62b43cee896149ea68d59483fb946d6de058163de
-
Filesize
581KB
MD5af6167f39e63a2a89b77ccffa5787874
SHA1a0435a926d1008da7b5dde5e9991e80c65138e09
SHA25600073b4e006a3c325c91937d29430bf2c165d8850c33221615e82e80a6250e2e
SHA512a2d90193a79af5636ab09341334c3494181ee84ea926c280bc6840929b0ddeac889ad79c4e3413be7e52ecf46ceed6643cab1c479445d8cd96c9db75af45e41b
-
Filesize
581KB
MD5aa2499e19d802f70000a8004784b5c2e
SHA11eac8fc794804b934af674eb00ee1160013c364e
SHA25679547848dc3864fa62a3c28570a4345d98aba0f52e9fb62d5492f8db10216f90
SHA512bd3a22b8fab84ab98051f1dfa0ac036db5c5135b27e582bc3577f809e49eec62e9e7fd96cc0af8dac08b17b632cfd2c8444fd696e15a6fa5256fdb142be5a5c3
-
Filesize
581KB
MD5d686b982c41d2708ea80ca9d1bb44d8d
SHA130ecc3666f8d3f86c37a042c5695eb3f6a352652
SHA2567726f4947922e06e5c32808314e8ade48905919b3346511e7f2bfc3ff7af33fe
SHA512da30edf90eb9f97682f931ce5412c0ae9315548da85be1007189826cede69bcfdbface25374a81516a43e5d792ff3762e2af7f34aa8b656db9b61dae16fb3fd7
-
Filesize
717KB
MD505e37a608ccd0a48aa743acbdf5781ae
SHA154361ec05d07355ef729ba01a8c138a15c67ef6a
SHA2561de9df1fa941b26eed7c098cf758f40b9bc2e1d36569bbdd4be1e4a65cec3e23
SHA512861f064cc47e9c13ceb9c6856258600931218fbca1f980dab04b3c2c5891f968e1064517add39b1b9c1cfd23986237748c22af014bddad0caec0c028e75c05ef
-
Filesize
841KB
MD54a52634418fa0d897621d93be4ff52e0
SHA1220cd1c7b621667971f7c2482515bc5215178384
SHA25696139300fb0ca5bb34eb362f9cb439daee433d1bedd4ff90e1256267db593275
SHA5127b7780aef37bb9a3c40dc8dbd529385c2f04157ebd62aa4bb85d29b0a06339823c458e9b8a91bbd0d8471188a5be5df43b93d1b8f6c1668e21837d559a1587d8
-
Filesize
1020KB
MD5da3f156ef2de7f8d0ca0725ddc16919b
SHA1391f3d8d338992f6d53d1810304d6ac660d0b6a8
SHA2563f204308d80969c590f533794a27c8d6ac65c7641ea11b29cc8baf63c4e29655
SHA51252aae9b2238dfff02d595716d9876c5643bc91092db3f09a031f970d78daa3a3e48bc0df9c08a2270b863906594a53bd86d6cfe5d04d698da290db6eb1a0ca89
-
Filesize
581KB
MD540a7d0812a5e5005b74952ffd5c89a85
SHA1e55afb8f9041a789e56c515769ee485f0f71400f
SHA256ee853861301716a84de156f2ad3da32148dff90e4b554781cc1deae9ad2378bc
SHA512abae2cefb37443725bf95ced3dcb8bcdb876186b412ea58afcabf3c77f9e9067aca425e61b55a40b3e4fdd64ec3807d219069152ced1014c816ff2432bcf13d1
-
Filesize
581KB
MD5aec8462c98c6e1cd91be9c1e811c0783
SHA192a04ece54acbfc4f8981a2f04f451b29dce24cd
SHA25619bbd318af5b2fdc28110fad2141a59791594632c69ba14ba7b6d47df8453e17
SHA512f53e45ccff54d50f43a1422023195e4de27173002beda1fbb9e02cd9de55d04cdb9f3950373c93cacbb0a2df1d095c036728b17db4f1d3a416f3414c8abd5f66
-
Filesize
581KB
MD5f3a13bc3af0e372e2e24ffccdfbe74c5
SHA12c7d7d412c1ceaa227fc532d491b2dd1fbf1ebee
SHA2568c5044129b1f7c77ff1b0e32d564e9326ad83b6979f4c75e41943d8e34ddc5c5
SHA512d01f41dacca83940ba81084925b4cd4ef84bb12074bd0bd36b4a47420d8f841be513289d6307add3ec33112b1c69e29659e438e308e1413a05730672223139e7
-
Filesize
581KB
MD5043b00959aa9ca8e493c2a42d6df1145
SHA1ce8f25305f917890f3088478c587aee1373371f2
SHA2564a32965b4d7633a0a86bdda39903dd193540d9b55ae4bf2be1844cf312208b30
SHA5125390bca52c34020693030d7db0f27723b5080429395a4182876504e2727ac2e96432f5c07ddc0f330dfdd0f90dcdc54c0ac5cbabacb6863d2ad326df3ade993f
-
Filesize
581KB
MD57790dc136584cfe4fc8cb688226b13dd
SHA1352b1c3b711847a4f9942b6ec0761ab70658a36c
SHA256f253f011b2007f6c56ff30305a9b6fbe8567e8f9b2015617e9032de3a09ac8b0
SHA512220450e630a6e6e0aa2bd593cf2395e36a43a33091dbcea55f3229ac639b25702d9f7dc8cfd7516f27cfc35b28228fe3f190fbbbfb56264babc05affd6b0e304
-
Filesize
581KB
MD5077518e37c73df17d53415af425f8a6f
SHA182c7588f9822818a44c29bdb556defba96aa1bde
SHA2562a153494e1a7c467815ddd6d6d579b679d41a9bfd3f2d879e61307fe326fe144
SHA51254e94b237f3b6c4ce8f06f2fd58a7c1398d8b88c45c56002030925a9e3266d49eed3a94b77269de19137e6a98df485fc30a7aae5a5586eeafe44f3d08b1065a1
-
Filesize
581KB
MD586ae03011f308e250ce296df7cd0029c
SHA14edccaaa6403bfc9f47075b472d28314e5f66311
SHA2564897455552027d63ef311d9f70d9bce31145ee23207b841fed952671bbe55a4a
SHA5124d8647e49474e74eb2d7a78ee0d90ac4452c68210864e074d4fd74072a4eecd69ad5fa934e06a9d07bae560c0521f57f3184d5cbbf95327b2dcdf1ad29589aa5
-
Filesize
581KB
MD519d7c346400c293a412248dde2de40d7
SHA13e19c5be249b57e157d079d6226563da27e1e952
SHA25637f7ad70231f822614ae3194286df4f7e5a005bf4a4e49b5cce31418becc4dd5
SHA5125d1ef8dff9790b92a0291deb6abf0e1f3d84fd7697f1f3805a9db5a868c946f023f396edc28d4b4f5b7bbc7d3466e352bc3897973831052b8ee78734e4ed96f1
-
Filesize
581KB
MD5bdb83a2569faa99f9139e883be49429b
SHA12ad4fd9309b89b0b4657937f29ef8a53bde04475
SHA2564e56bedef2900509a05004d4d95c13b0c09db8711547846507d3919293c010b4
SHA5123789691428b5392acc7683d3fd5b378dd94ce04ac623dad43afcccf234d4cfa334430969c2fff1a0b20fe9586c91467f4e235552e3f4907e991b5c67553dfb9d
-
Filesize
581KB
MD5ee7f1cf1abfa4af18b927d8421645752
SHA14ab9d0c00909f131f7e89d619b5d0f82857dadbd
SHA25633f152b77daf274da08c5cb59adad10aaf1771e6d9e8765abfa64b5dc7d197cb
SHA512b9f6e8be53884a77b9aea3cea28d1da72b7533ed70ddf0e35647e2c4d24faf4988326446b677ad5fa1ac07b959d966537232c53cb69831c195ea09442fe440a8
-
Filesize
581KB
MD5fe07e0b6903eb9521b5dc89a11faf2d0
SHA1f42d1c204f0089f297c13bea3f63b17c6fece8bf
SHA256f0ce9b2832da703801ce72ea12fbd0704c37518f84ede98191bd22f7709266dd
SHA512fc7b434dfde98abd61d471b2ff22b1d576ad71a46bfdf8b9e305489fd0b5d775f686d44b0f98f14429c5b31395a3f29879a1c30174ea82ff08749f8d9512d9c9
-
Filesize
581KB
MD5aa023c3f336ffe42c70007859506e338
SHA119a088957d48647e1b69507fbc9d79606d44ed09
SHA256f459fc07bb4fbc689830feca77a36411f7532483c19c7268b24eb12ee5c90b5e
SHA512977d4d31b152721d6339fc2c77362d785154777ee78a2f9443adaaad2da5ba36b06e8fac55b9159311bf500f044f25c564395d3adaa9888ff656b0e6f8d75570
-
Filesize
581KB
MD5f8353c4b8fcb04c6ae7336f504c48d2b
SHA1482c8fa76658b33bde8295d0e68898642e07a5f0
SHA2565fb26d7e26c3459f5290dd19267eb9b7f23777d8705b313f8ac70cc02b4c1f79
SHA512e5170e936704955e010b7715cd329b8dbf4392619b3ca32c088f766b7cb1ba6319611b61569921c82f6c56255730972e6f58dbc29e4d5aef6119a1f6a9a1a80a
-
Filesize
581KB
MD5ff5c18f62d7bf0fd3b87f31911fa1af3
SHA1cf84414e73bba3705615dd996120f57058aac5e6
SHA25696cd75064e756929a2396a37d2b79a8da1bc7978f792bea5cbd204328696eb67
SHA512f50bc414b8c9d590cac6ab866fce588524ab91edb1f38bd0d690008015bf8f38d7c8454d4bc8660801fa00b8e8041cae245cbed64af9afe3971ed499fe804ee9
-
Filesize
581KB
MD5a0dc1e152c764b736da7c027fa3775fe
SHA1124c04b2b3cd53790c47a0618495c1a96cb24864
SHA256e56885fd7c570127694aeebb8be2b9edde1ac879d80c43a1f2cfb53fcd38417f
SHA512a0483abc0940c4d480d0ce45d80b334c5f0b764304e891493fa1693158b7a91b3087f49e1d360ad8c441ff712e51c6adbffa5b04b9efda67d35127880a980286
-
Filesize
581KB
MD564d85b35aaf24ff345885625bc8b19a0
SHA15ce0953107f548a2d776932ed11cb0174ff16da0
SHA25606b60dac90e3448219f977b6ed64bea9bbc4c16ddd654ad76eca42ee712e507e
SHA512eada2c7665619040360f399e18e4e13b275c05acc5c23a592744a136705c2293e2d360bafab20b2d0d613d6fda882894504645da3a79601d36351758a8b173d1
-
Filesize
581KB
MD5a934ac964e251041d7ca054953ad8069
SHA11e9e1353f5ac636e4b75c62117cd50d62ce2b791
SHA25635fd88bae8a09c699961c2df7d49f9c62b7e91813de489cbbdf0020eeaa16eba
SHA512065785f47b37d03d9686f308b6ed6f8b3a5a153272a38e3e2dd6cecf1f4c23559618f394a945142c70c22006d2feb0b858e2f89e33f3847032e32c7d7ad3474d
-
Filesize
581KB
MD599c3b763d33606bf7262ec49f5d4086f
SHA14aefcc574813819c746fd6ee6c8132cd0da244d3
SHA256a010a188e08f7d6f4f3e4b71b0bff16c7c3279e7550318a7a2d6d8c8ebd97bef
SHA512b881ad6fa181e0039ec56e2a9fcf6187c669b762aba2afe5aa53edf246f7bad6a4bac17904525fcd1a603805c59f97d709b624091cc3d79225f8d8b54cf3cebf
-
Filesize
581KB
MD58dcdf4ae2b6b0c59bb56fc9cf80b29f3
SHA10f7c8a3c81fa20a2a508dd72f825ea2a309d3cc3
SHA256e8018f686b3d63ca58d8bdedfeec41b977bab8d495405975384643cf77503fc9
SHA512e3464aaf69c7431c59e66dd4f6ca0cbbe86a822a7e5bd6a412b125dfda40fc9af6b38cb0da7e6dd517c5b63743cbb93077f273b8ca7ef281273490ecf9634c1a
-
Filesize
581KB
MD5a98fde80d022c43939bc4a6418f512c8
SHA19401e6811ecb532535d822076a33996475259fab
SHA25666977ab8a2d8d06f17127fda4ea52fa59e39e281de189b19f622baf8da16bec5
SHA51291c408a74f0da806526f21812ce93436ec77590baefec5288f4e5c678ad771b758e9cb634edb654fc9368af4577cb701aa4a971072006b488cbc915b77139ee1
-
Filesize
581KB
MD55245bd32eafd3b8134a1ed0d2e60462e
SHA1588b883b31ab43657e3213f0062848017855a85e
SHA256023a7efabfff6d401f1194446d0eb773f75805bd0e53107bedc60c4db56d3d63
SHA5120edf91edc0ac7db782652c88f714de380ef3c77efac67adad6fb6eb45fa65803156ed0d1656ea8b204914563444e9d0a8d3af7a250ef690119adc59cbe994f29
-
Filesize
701KB
MD5608184b47e9ace365c194b49e19010e3
SHA1eb7106d094ee2a34abb8b955ca7689047bef7e86
SHA256c23cad25f86ae1cd070085e7ee3eefd26ec688b3051be203cd470a0cdbdf8bda
SHA51245b6d3f91a3970cd8abe4d58040cd2edc2fcddd62553dc4795d2419c4a292f7193d2060e411916bd2ac78fc77627f9118194c0c0e6f59a2ba9dc21e6d24e3cf2
-
Filesize
659KB
MD572f0ce037c2705f2c3c16acb5bf47c82
SHA1192da8fb815067ffc9a0f70890d38f7945f89fca
SHA256f93d7aa610c0cfe2ea1237cd66995945047ed4bf580710e61c8f0299bd0ebd4d
SHA51284714244c10b69dc292d094f825660ee13d6fbe45c18192984a8852cdf50beb28849e2273fb61daed05b4f682ac9a6a3b94777a2a6374348065f9377b0d7930c
-
Filesize
661KB
MD566524880fcd46ec1c7f0634032aa449b
SHA1454f515baca13cd613e649e1d0cda546891250f3
SHA256d2b5375ca04b83f9493ce1a4292468c6f90562a6cce7da096efc261fa9685b4c
SHA5125b6938c5d83a0fbf3bcca397063c58489cef7a6b5827be9e8995825d6df21383a6eb7667cad63a4e695c33945c370dad7f59146d278a77c8caa362a55c10a284
-
Filesize
1.3MB
MD543c659149c1d6511a2cea6d4d1d83b8d
SHA175f756415f151d4cb861754d99c5c905f30aca7f
SHA256dec2e39817959fb83cd94f0d9e186625ddea7dbb206eea90bf9d4eb4117416b7
SHA5124b986e7822a5af10447464fa81c28daf7772de0cb595b3015c2663f49f13d2d66a46e988e12f5c0898d41d52a135bd8d36809cacf2427fbb381cd6d2f7803cb1
-
Filesize
1.2MB
MD5fe446024954b64386f102541213410a1
SHA1eaae19eb7d6a2afa27cb249bed26ca1998c2e83e
SHA256d664800d2e2c0aeda4c25dc036afce287a859ea4504833228adcc7e2f71fec6d
SHA51244bd465e06bf1fe921955c455cb80fc99d60b53801467955f704c5cd450b8cce6f4179e794a30a34e9423def48a94fdbbe9c5d9b83d9d347b44e0e35a1140033