Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 18:21
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-03_b629ca381427edf2d00bc5d4d31b2a26_bkransomware_karagany.exe
Resource
win7-20240508-en
General
-
Target
2024-07-03_b629ca381427edf2d00bc5d4d31b2a26_bkransomware_karagany.exe
-
Size
677KB
-
MD5
b629ca381427edf2d00bc5d4d31b2a26
-
SHA1
dd848b3ad76af425054eb8719af3282392832663
-
SHA256
bbff6434d7d833e8b5f6e1c378fb9ea71e196b78bd89fd77fb150f981b606a0e
-
SHA512
5d9a548393e9639937f4a54c9a8d5284c7ca74d7f9b0bd6444ac13fbd9a0af6d2d6ee84c65d92455b99da834d579767cc0945cddd9052a73719fa39ea9cfe24a
-
SSDEEP
12288:LvXk1yGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:rk1Vt/sBlDqgZQd6XKtiMJYiPU
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1856 alg.exe 3080 DiagnosticsHub.StandardCollector.Service.exe 4908 fxssvc.exe 3944 elevation_service.exe 660 elevation_service.exe 4140 maintenanceservice.exe 1560 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2024-07-03_b629ca381427edf2d00bc5d4d31b2a26_bkransomware_karagany.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\61a5bb97293b476c.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-07-03_b629ca381427edf2d00bc5d4d31b2a26_bkransomware_karagany.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-07-03_b629ca381427edf2d00bc5d4d31b2a26_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-07-03_b629ca381427edf2d00bc5d4d31b2a26_bkransomware_karagany.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-07-03_b629ca381427edf2d00bc5d4d31b2a26_bkransomware_karagany.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{878BCDD2-1ABC-4948-8DA1-C8645DF0F833}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102250\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3080 DiagnosticsHub.StandardCollector.Service.exe 3080 DiagnosticsHub.StandardCollector.Service.exe 3080 DiagnosticsHub.StandardCollector.Service.exe 3080 DiagnosticsHub.StandardCollector.Service.exe 3080 DiagnosticsHub.StandardCollector.Service.exe 3080 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4248 2024-07-03_b629ca381427edf2d00bc5d4d31b2a26_bkransomware_karagany.exe Token: SeAuditPrivilege 4908 fxssvc.exe Token: SeDebugPrivilege 1856 alg.exe Token: SeDebugPrivilege 1856 alg.exe Token: SeDebugPrivilege 1856 alg.exe Token: SeDebugPrivilege 3080 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_b629ca381427edf2d00bc5d4d31b2a26_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_b629ca381427edf2d00bc5d4d31b2a26_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4248
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3080
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3608
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3944
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:660
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4140
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1560
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5421e08751b9c878dc9009bceb0806ce6
SHA15f4af5993f65b1fb92bdb62a29db0c2cee4b1624
SHA2566a32ff4c5b4f3c91efb04ac2aa777fea6764705a226fb8ef4a21365443be1648
SHA512bda7e0d1812fcccdb7f4ebeee7195377537d8ffb27d669b9ddf602cd3ac8e7a954556b3db6fa7f9c03758bc326530ca5598d6bc1b9128e2d19b14a80ec62f3b1
-
Filesize
797KB
MD5a8c930b75b42c266e52cd9b0c493e528
SHA1b83ac67ccab543bc6f92c56eb4abc6f3f9a076ef
SHA2560849b678e2d803c2660e525012c2fb46a5ef383ec2303f15daf6e2d721353ec2
SHA512a0b32234b847ea0f7586fafac205ff073c51784a1bb60d0e21febdf4459c311f9d150d24a574aa6a591c3ce36d7f00703b1297b2f0c23891d6504a2d3ddd1262
-
Filesize
1.1MB
MD57ecf7fd282771fbfde11e89559d5e3cb
SHA16e5cc8e29ce7d7873c080ecc0f1265b33b3a56c8
SHA256d22cc8b294507e3e4868f1eace3cde537ba3adcf8f29434f3878e4fa6e892269
SHA512a1fdba4c1fe16f43756ec8c00158714d1bc19a08d83304240c897f1a2192ca296215d0819dd4d1f5e95185653a221d4cbd2a099ec95cd9c3e17bcc081763c245
-
Filesize
1.5MB
MD51a08b489c372d11899bee807fb6cfc6d
SHA1935ea05840723664fd15a68e32fb9c0b88ff2152
SHA25641cc5cca913743310834036fcea483a59f8d71c58a13ab242eafec3be21e2701
SHA51252185fe228a02969dcb7ed21425a711acd43d8edf640e744adfe36ed913fc48cf3c5998f7609c938c4f1ec397fff6d19e197596849430cbd962e87d35aa13289
-
Filesize
1.2MB
MD5ee33a6cdf944a177aad77c76316762e1
SHA1c78629c1b496e96d67e692d8d2786e1602eef2f8
SHA256be572707f59c033626a7f886175552fdc23cb7d1fd7e40390419fba0e8952445
SHA512621aa5adc75f93ca395accab8d66193a0a3707d6b2583b231b8492a107dfd7c4ad7328238034d74a0d30b000e0f73232f75f5d68f0084d0604557dd95d7aba81
-
Filesize
582KB
MD519f06b8780d02814c1ed6dd93eca60d8
SHA15327faf73c3af96ad63e75513174081926adc5f8
SHA256c09dcaf66b3233bd1ef248d88b4013eb796591e73b396029008c2bc0b896b9e2
SHA512a055d78cb59ac73939791da246e477e508efaf694d415acf64bb26c2ca101217f6e33903962abac905c5a8ec8bbc1cb66435468c0af7bdfa0ef0df31ddde9b90
-
Filesize
840KB
MD5a110c8ae433483f077c31e5cf4b69364
SHA177629fe783c1960f303988148878a015cf28d8b0
SHA256ab492d6c14950e8d7e5d0f8aeefb4cd1f0ee79f7d804932a304cfe1b1dd7a46b
SHA512664f815a1364dbd940eb83d31d89cceb6452fd25761f734ea20ce88e63c8fe4f620fd2ffd85541d8c88879a7013f4a67bc557ce4b9ee0a0c786ee9d23fd5d17b
-
Filesize
4.6MB
MD57eb61c6249978fb98e37cce0a136f9b2
SHA1cdd314035e22481060bd0c149517775e62094243
SHA25604a7223dfa85e998939f577c32cee5fb8936eaf5c9c0f309dcc26e542c7d8dff
SHA5128518b72a5ca623d2cfec03f0c587505361be87684feaad57ce513e69ef1df32e5e8d5c067e32e889d0936fa26a2d543eef30f2e6b8445dd613f70489d575485c
-
Filesize
910KB
MD5515de66d67d9123bd41b8e44445cbf23
SHA1a265b2a6f7ce37aa910d880b22341a1570a73c5b
SHA256e765bb9bfc27bc453b2757fce20fa0d6fa834ed4edc326620a2e8a2d0ce405af
SHA512e24159e33c22b2e8ff1c3ba00d9cb5bb63fb29903992fba95fbee399afe111268b5071515a9c902397d9b93ad9c52320a6292f71140682685120c4623677622e
-
Filesize
24.0MB
MD5012478840f2e0232171f8403e78048c3
SHA1cd54bd3e9c8cf096daacecaf643d731aebbfef0f
SHA256d7844013d57ec8bbc79a01c26e7e614dc49832a946587be835cbe9dd51eecdcf
SHA512370aafa4d6041f4116a4258ae3736c08439ba797b70156b2eb06658822db3c99f31e7ac2a5cf347c613f3373e3f764acfc9460c164502f7dee26e4c08f0e0a0a
-
Filesize
2.7MB
MD566a849d19ed6bf59342e68ad4cf79111
SHA1b37844b1e72876908f11f67ba57ddaf6c21232b8
SHA256121d9241def6d5231e23b73672a84bfe219d5a9cf2a16abcfeecceb57290d3b1
SHA512b852fc8bcfd34b38103c126b65b815af1f9446fbcbdaf2d6cc8af40f684d0d09bbde98ad0adb1a64849d2772aaa60bbe07808451d40b17a32e13a63804ec7f84
-
Filesize
1.1MB
MD5c3506ee35010d233f7c5569890ce9781
SHA1c06c03aa54528df87721e3521952dd9e6ed90350
SHA256625aa4a6f1110ae220c42aa8e867ab792a597c01d771155fdcf37c7cfcdca585
SHA512c02a015ba38fee57cdf02ec02ca3c93fd4d7f0aa629c4a91617691e0707454f17990d98610b496d5bd1f8d3a17ad42dacab4d8d25eeb05ad44b54a0df8238ba2
-
Filesize
805KB
MD578890d84f599548b8be57279f80284a5
SHA1db713604f9ccb6f0d25105fa312b1b9a4454a759
SHA256a7569f89e0c5dd98ff277e354411d256bcaf1e63d7fd63cd8ecde15b16f2d23c
SHA5120c6d7b1ed8c53bc5392f1e4c84b1d7413b16cf3be0503bcb2a7b68f0477a76f09003372c11cb252f8ef02cd2ef6a72d4939fd1dd3eecfa5389cd6f797c050fc5
-
Filesize
656KB
MD55b0dc24e6909c2b5441860b20464fe47
SHA15cf46173363d1f4e74d747dae58dee83200bc33c
SHA25664099eaeccc01990bb06636801be6b0b83a4113cda465edfa8327d77c9804b8c
SHA5129093e3f3ce5ba6c6319638b12223d117e619ba31763626ec76eb0705c0e936dd8a26dc2c2a7cbd717b8b5f3746188f2b591be9c4f0c0749349be6abe3ff2cf4f
-
Filesize
5.4MB
MD51a55412a0b19269a7a2d9e1114d32885
SHA16149613399f2b76cd777369bc7dd0281b7278fed
SHA256474cfe530cfd312d9941ac6f747aeeb88a77ffc53bd9e677141d949b9d2d7f8d
SHA5123afedc5f9103abe1da2e623880c575153340b6ea1f8a248ae583304a1653c3af7f1ec73fec9185919356b7be270bd2badc88def2a935085783adb7f91549a4dd
-
Filesize
5.4MB
MD5dde382202af9ef9cf607a88f191adae1
SHA1a4c70f95f54fb6b9a5703144414f531a78a61401
SHA256eb2c4e49c569e92989196f4dd07127c581e40bf530bb556840c2f6a683359d7e
SHA512c70ea64e6fd9ebb3a265bb3dd64ba0ce6d49f619e489b7e953c04efd195d9eaa18062252166b6a342d7c6a2d2a6b92884a4f08f82639b576c2375f80450fad24
-
Filesize
2.0MB
MD524e07a688140ab40347ec189819d6d10
SHA15b8bf36f003ef4e142d091cc2a45b6ce5a8dc010
SHA25610405636e13a8be162954d8e89d9a84db67699456706942d8e419158b8fc72ef
SHA5123495f0addb464d8e6c5ecc7b0666add72ea578a19fa56352099d26c42e9c61ae9eeba9d0a03bb8f3e5df4d1e2351720deff6edde81496e463d3148b1330da590
-
Filesize
2.2MB
MD552b9bd97039722110f7d58dcb950c472
SHA1427ac29340ae95214515a8ae75a845c5e767fa7a
SHA256873f03835d68a2d3852dc425026bea13915baa7aadc139e23e4f7bb279030a43
SHA5122f070a51156ec891cc4550b904f523579229189cb2bf597ad427e15195745be6d4f4a88ef791e3017f9c04d5df31e3a2e356b32db78f6b374bf313a3d57919f8
-
Filesize
1.8MB
MD5dc0450f2e206a212b28f26bb6830d3a8
SHA1539e4cba01471ee7d6e253420df6ad59e5d0841e
SHA25650db0067dccfad7d49b0d0e0b4baf53f26b1e5266b00c1654b2ba5804511326a
SHA5124380e2e1b408f658719952da6c83eb69fa013b1fb2b009f68a66b9aa81b6764874db480798c0be075fd044e0db6aa1913a844fa2252ae8c7fea065d839f06de1
-
Filesize
1.7MB
MD581d274296125b44b85147503b92c9597
SHA19638149866c4fa88c007e13ea69cddb8f472a763
SHA2561e9732ce1cc858d19baede7178f7bc32e3f3e8af077609d74d55abddfbc80088
SHA512a7abb10e882899d63ddb846bc2abf662e7d9e7c58d4c73e47bc69ca58a51cc423536fa48a509de3b21261c8ec62016a9855543b9459f780d59fc195e79aa43b7
-
Filesize
581KB
MD5296cf089f58fbf2f85ae188eb7b18f2f
SHA1c19192f1db5124072c241e6bd059434cfeeda75f
SHA2562e5ed1cb7abd54ac7e45e0a96d3823bd5409e3970355237653ad56e9ec428708
SHA5123c8f1e0c323f682348f63c0d8036e07b4b439109377c14b4aadff1763d3535db01641b45529c00281fc0d48de1b41acddfa3e9b08404e3ebe2ea4a23476c30e4
-
Filesize
581KB
MD563d853bb5d14223bba34634b72a16e85
SHA1fa3c1d67146c42a1efd992cfc6e2b8c1514e9e1b
SHA256b01cbbbb58efb605316227007b1cb377b9da022d97dff2ca98a1d09557541875
SHA5125730d49f1ca45db6e07e09c14520bd8f209f28c9428265c17f0a7bad3d288aa8af3574a5456b4ca9d63511eeb33d6f7878fc78d72ea5d51106247c507be2ebcb
-
Filesize
581KB
MD5312c27ea728a8c153607f7c6c9b97275
SHA1b22ab99680006c34c948a6bc1adb0666dbacf9ad
SHA256e128fc975f48d3ea6152a3339795ad535950f511dffe72fe8e9d5547447c4dbb
SHA5126dabff58c3d127106997e35ef7a92409e42bf7289fdd18c5febfd891c348df0a0e6e37a13a580e59c2dad8eaad2e5dc3d9d3eef674729e13a15e9507d951094b
-
Filesize
601KB
MD58ad65f5aa53463fa68fbccf34daee9f0
SHA1eea64d6acadf748f5cc4291c6fa78b62843cc3d6
SHA2565ee3ec6b3e7bd670f6d1028f0564711218822be1c3c8819c5b848a83ebd9cfcf
SHA512f09ad3e4accb00935527989f0fe123adfe9070b224d0a20ef4fe286f023a3b10d27cc7c7edf9bc90bd63fd4eac303798e4d997b41a03645dee6d4528ee9eef96
-
Filesize
581KB
MD52dfd4f217d1773191bf737fbfdeb1879
SHA1c204bdf2585de06ccd8f63c955ab706c506d0ee2
SHA25628132e53c2890078ee498e809309f933cbb8fdb7eac2b8e5aaa670da664b84a9
SHA512589debab64e8fa372d79cac080814c52d6a8f6bb27ee281ec148a7573678acb7706073e59aae3b7534c8caf151c5ffadb85bd9caeaf4d6ed34eb61746453fd0f
-
Filesize
581KB
MD5b69761c30d7bd2eb587d82407e66f797
SHA11e66390aeb901857ec4fc87e2e70f1cb28ea3b84
SHA2569f4d51120839e013038c542a16b45385870c72601c64ee7c9924d18330a08d8e
SHA5129f97a11501895756e636ecd066914cd1ae92745908c5122bd2300a46e806b3cb0c5ac81cac3fedd12f4c569eadb7ae84666146d92390d4aba07321a8f250533f
-
Filesize
581KB
MD5ec849d1e5fe171cae9d71c43820ae985
SHA19e1c2591d49434e7ca161f149e7e81c7b71b5d1a
SHA256b7cee4bdfbff5642355e81fc51c2b065f3adf3c44d6e80ae1315a0a674e436f8
SHA512ab5dabeb889d654351b02653384b7e1fd8bc6b6dd531a46b53171f779766f03a2d55d14f1cefbfb9497992a95bd4377266441a160a4ff9f1bd989bbc5ef2dcd9
-
Filesize
841KB
MD5545160b07ef8ca121128ce1268cb5519
SHA15190822a26855e2232106161ddf7dbd2516396c8
SHA256c986fe2bbb6447f9467e27560beb650b923cd94745c58b62d5cf06f4ca5d0e9a
SHA512edb6ee742e0e4aba3eb760573cc122a26d77251735a5032a66c8582511845cb5f86ab98cddca797c49e1a98c7d847590dcc4052369477738e566b917a25232f5
-
Filesize
581KB
MD51b7a98eba68eca20a59899c227fb4f3d
SHA19dd1634922901327691e571252830964e5dcddc0
SHA25648bb66d412314de81434151500cd024a5ff8c9831b0a11cc7edfd60ea3f5dcb2
SHA512724bad61aa5ea81f3b32f1e205abbdff31896498731d4bd1f0a84660ab9a4d8973c6aa7eb87acb5eba9432b0992fb6297201b43dba1aeb5b3800932c591b79ff
-
Filesize
581KB
MD5b734bcd2a71cfdce81d1ab0749c57087
SHA1519ad91f4ed229d46f13207e57c3deef3aaa8af3
SHA2560786ab05fdd193f3288f13a982d8a62210904cc90eb57c3a037f4d8ed4790789
SHA51278dd094835441e547674a0fc356bd26f6a6ddc8170f31089407608f1f442475336e90c1085f39314724b1e2340522f5bbdc5632ccf39ce28b6a6ca085a18ab49
-
Filesize
717KB
MD5e9d3c7ed5085315fdbb9320667f2cec6
SHA1b490bcf7ddccfa40c92f02dee131f431ae489a0f
SHA256f1dba53b09515ebb93db8b307e218f4304869da44c9fc9236a54fe1931db4917
SHA512f588f6fdd5b053d79c37f2dcf74e2e3d39e119d24471fa4fef9c475177b7fdb7256b841e342daae872bde1c534d0916e9acd5f8c83e354ac26239d545b31cc46
-
Filesize
581KB
MD5eeb6b95fc6296b5fca6772b98761e72f
SHA117cd39efe76a645ef9f9611d7fc5be93f531c10c
SHA256168a4a031c009596f635fd802e215b99338ff1c7064f6b9fbc59c0348d806bfe
SHA512e52aa02e5335b42fad713e5c38da862613c2b0ddeea0b679bdd62618afd4100076295564d30919dc8e6b3e9b0058344e067898c2669d6753fa95efadbbd7b72d
-
Filesize
581KB
MD5ff0f14c1550f590c517840d6abd509b0
SHA1fa03b90501e38de3ca088f7b6de7fc36a05cbdab
SHA2565f2c9cd6835bf6554f0503837b7474c93947fe8462d6e74d872fb2dfc40bc762
SHA5120f63340d88ffe59958b78d041918351ad2da7a9637e13581865fa7ac7b380242106b2df4edfd90adf86095fd748bc9c80612c4d46b55c8ce1ce2b43d6f12b499
-
Filesize
717KB
MD53772b7d2f8b971d95d0283de6b6856d8
SHA1449bfe5034347a951a6e37080a64e514c006305f
SHA256c54b718b3e916c7bfd0367fc536357a748c4951a50385964031988c37f593e65
SHA51255ebbfc8fa72fa2f8ee97ca621544b19a1b75eec9dbd77e2d3f344bd022c0981363542fb3902963acbdc8a797e666df04a0b5eef09a8af9ba119a38ec2ad84d4
-
Filesize
841KB
MD5e46118ae55980558d735623b2304bd59
SHA1e361219d11985976bfc2a2a8cd6031b28d2c12d5
SHA256fc6dedb9dc3ca10f33a6d8d9f38031ab7899fcd7abf1ad221841ee96ff6f4366
SHA512676a6c7b3b2ccc3a63a7b5af6ef14e431451a7b3831ec9d933e4e7001961b7b53f18b5f0a00c4d97713c7715e659834b674e1bc1799ec247308db8a97f21c69a
-
Filesize
1020KB
MD5c71c6f963dd968cee53a40c3839d5b63
SHA188e30fb5d0f9694d4793fd7a5707bc2ae75b6199
SHA256ee1a586cc3af772931aa0ea03315f1882fb50203f636ad2e919be8a374078850
SHA51217099e423b07f8d119d30aefd98b7f8eb36433fdd7e513bb2ed7416de6693a1e0481cd80872604c238526703eef08d8f23c90d6a8a0f8578ad802f477a568bcf
-
Filesize
581KB
MD51c866ca2c1d1e8c1feb2148ee2fcd9cb
SHA17a28c38cb40d2a373c0428e62994d71575ea3e6e
SHA256c39fe86ad8b1884ebc21482a4b144d9b7f912f1eed6a53bc4c315dbde0316d33
SHA512a12bdc8a4501160fc3b90716f5f3bccb80c242faec97824992c3563772a76cb8ab424838f344b324ff131d32943c6af96f70c6eb9d5a489f744fa4378205a4c2
-
Filesize
581KB
MD57726785dc75cadaca92490fb19adaf2d
SHA1666486c5d75cfcf4f33fdbfac3dbcd0d6cb4c0c6
SHA256caea27b25dccf4024c30c93765a817976e6009683cd59a95f8c516d5c109f448
SHA51296547f9be9dae6d6fd2199a3fb72d1d151723404ade46754bfb4551fdd4668d4759a053cc1363cee9e5e9de17a59cdaab546001a80b70947ec4cefa7383955a4
-
Filesize
581KB
MD5e88f035c6071eac8ff7a27fcc2e02c8d
SHA1cff4dd530ca4805db94bfac9dde63408326fe9e9
SHA256685e6e9f82ea099edee601f9def45051be076a31969dbbd0938bea58608d08b0
SHA51229ad2137b34c980e4feaa62680c7a604fd1beff2f9890e6bfa62338b7a503205f8ae1a2b905b5b24b4b91ef2229e7fc0a4c04ff29abe29a1c92d3511ae5f3c31
-
Filesize
581KB
MD5a9f3620576344f3da864afc5142479c8
SHA1e40bb6b9003fa03a6490f2b0b62186dfce24ce8e
SHA256e74fe03949a70c252e230ae5b23edfa36fd00bc2952ded939e2aa76a849f35f7
SHA51238601a2185861aafb8c19266bfd4f0c2450ee8c5dccf093cab80b28ce271e9ef7d87d8280e20ca09a7d992bd4e0eac14acc0da00e1c019aa54ef920e117cf234
-
Filesize
581KB
MD59835d55c80116d2c3252e6f4c926ca5c
SHA1ab19044e96b1f54cb5eaace194079a295d729457
SHA256d4a389374f88592a4df8705464f8ea35e19f15f9459889d465177cacb9497a6a
SHA51232d4041685a2c4b98c9bb5d68807e4b37ebca52883fe814c63a412e13e318a9d80890326fd3d1da8f398a27e2ac373ccd9ad1d8181de83d3863d07192fc383b6
-
Filesize
581KB
MD562e8db9e666d5a1528493592f6138232
SHA1b1be23c06abb29844a43d6c9aae1a629ee1d223a
SHA2563ffc8635f8cc069b585698bac82aaea01605f4d9b1cacc45b9adcc5dc7806990
SHA51291aa4c30f78e021dfc25fedb5449327c9ba2f0e1cddcaefad2ead64db0930118800f0c91535df752ea89ee940b20350fee672ed4ab4e4b20d0fe89c128c655f8
-
Filesize
581KB
MD514aaf550ae25c8ed7d76082a087a22ce
SHA134d017f6541323b0a3dca3fd5d3304d98225c1ce
SHA2569286d62cc2a760dc69cab66d25bfdbbffdef494471efd934a87e47f517129e17
SHA51243a2a7a5b200ced76d7847ecedc62ab54ab7703d7ee098156853bb25f1d9b9b5ddf999f45f0890e5511548822336fddf62c12fb162ff0697607028a2d9bdf09b
-
Filesize
581KB
MD503c7fac266c097079f9d567ec9549189
SHA12e1de0fa8c44726644a2d4b5ae25e810a5df40af
SHA256b1a98b9642b295a428ebfbcd67d1b4dfc806cddcf1104af046ee4692445f37a1
SHA512863e8ddc1301f9bf225d50970522dae4ec8a61059d2edb1f4779473da8e785c23934cc310ebd39d34b47e390a328d4bfd832406123fcbfa9181df80e6748c780
-
Filesize
581KB
MD511ded01019b9d4945bd95fa88e8f36b9
SHA10327458b3e9ae6d2c9c72590b9608b62d0f6e07f
SHA256c883e02dd5906a58f5d8b32b666c368a53ac6f6d25bda946bbcfbc175edd563c
SHA512405dfa8107cd696653c1fad4daef3e0bc78aed3982778391c258fe1251feb25587519711bd23cfa97e8f57aa8fcf593c8d40f5f8d3faf1fe92a0b1c4ae68599b
-
Filesize
581KB
MD5453bb1c34727664580466395df204a5c
SHA1fd5d766a22cd2581c193ab55dec4117059bf5e24
SHA256c5548056ca515b6d91e727687daf1e373de503c30768f4b13ec8190176aac396
SHA5124356ad50d1813d55b0bd4b2640163153153fd0216135ff53c8ca69e9eb5ae88869f707bd6ca2f19eee5f9db59d01f626206f8c2dfd4dbd2d7bd46a4be9769f6b
-
Filesize
581KB
MD58620f02961daa751a70d75abf5cef486
SHA1d607e16d4748f4be2a32e3fae81baa86b2b9be2c
SHA2565b569b10b973f78957ebc3f0c4d914cc45bd86554f9add7073587cef58cac53a
SHA5128d2a4b286da98b0febf769e84a9a81d93bb9393c84507cc3a1ab2e3fcbbda18154d9da3e7d9e503239787839e3e5420edb394fada3b14da39576318544ea70de
-
Filesize
581KB
MD5d281cadaa24a1f3b49c36237432b3b58
SHA13367a3819d1aec6b19b5a4e608ec9c78671e006c
SHA256c786f1fe70eaedf2d94db1a5416857444ed8c5d00034a95e10fb376ccc92d6c5
SHA512de8b6f5152991b02b6c38569e3ccb2f3e3708708d133aa19cab3f1d5730b266a879161769c265fa6bf30c8e4070f950e199aa02032e69b87f054254fa0f11e88
-
Filesize
581KB
MD5d727dd25e77e378eb375e6bf8ecaa693
SHA1762b85b208779ec2dc6564e99e85ff1678aa8d3a
SHA256eae565af008d39579bad73c97e380355d348e59dde4945985c48b450bc180540
SHA512ca874f95458d53c9e83cbf8fecd0f13055c8692fc2f1e751b86e0f7a2823e59f2e7cf4118fe5e6127786a75e70599a7a422e26027edd4510c38c1affa3c52f17
-
Filesize
581KB
MD542868b5bf3321bfbb29b83e924889416
SHA1ff72f640cba41b0f12c93f5f27b725f80548703a
SHA256ea6fd9eb3cdc2067191b44869edb4406a90894e5c707e15d5d3f394a3c41c3e6
SHA5128288ffdb37cfe97a71013b2f33f8f183994aa091a55a75ffb4bd92bab661673b1be9f170892664878af64cc96fc49f218d30d73a8e4300b35e6786e1fcd1279d
-
Filesize
581KB
MD532ce40c340d9e1216e33236da8d2aea2
SHA13c79aeba64f699122c6a1f07764653ea13b7d411
SHA256c2cb3b9cd68d665b576628d72e9f7b280008da0bf0d4cc0d66d2ed0da11f8afb
SHA512bd6954aadd091fcdc71b7566d67a5c5adfc8a5791a6595e8567efa797ceda762ff4cb059427bac3cc792181e0f250474d8030107ca3c9131b9c830dd5bbdd44d
-
Filesize
581KB
MD5cae25399f772f6442eebfd88910525c1
SHA1ccc2916f3ae0c404a20140a7f50d74842b35b38d
SHA2569158ef749474c946a81ebddf3b494ff8a1af6fc292187d5a72331a7c4b4664d5
SHA512a253adb5bb11dd1df6361c52659505622ed5e07fda62995cccb58d85acef53ce0aeffbd229b7e56daad93218ebc5923d950ad7338fc7a23ca43070698fac6032
-
Filesize
581KB
MD5d015dc84d8810e54b655720e54c0af3c
SHA1f822703055528440a41e0f5d467f4bea36a3113e
SHA256f545fdf5bee9663f004a4e68f13cc298d4fa235722995e35296bd15d85336264
SHA512bcd3ac3deec3f58e0d61f2b72a2655acfb92ebb73fa3bf613655044f217fd7ef4fd37ebe10422c971d0c32b758e4dd77533019eac588e2823979b6088b35fe96
-
Filesize
581KB
MD5dbbf8a2af140452bacc3390807110806
SHA1b34c495d20a6c74b5da2661d07ee30fc25af2cfe
SHA2567d3ff5585bc42bad13e7f324f754cbbde8ac37995d08b2e93eefa824bd31f895
SHA51252a20374b12aae8cb48902759ce67114329a8db85a13411e7bda079443ad44f2bb434f7f96c0c3f505e97a582c53d3f2f340c9513c0263b7f0b7b3ade2af6204
-
Filesize
581KB
MD5c66503a28db66a982effc2fcd563d4e4
SHA193c885d80ab4623604e2b9c0c06f30af2dae66fc
SHA256af015081c004a40fad8b134f41996235941632909ced3efaffa8b117e9c83ffa
SHA512a39a6996007c4706ca309d8c665e6a982045c1adecc59d04534c154c3b1158250a657660f8eeae73231cc54abaeeea7108668f132679cdb34fa4a290fd40468d
-
Filesize
581KB
MD5c0a7231142be4df6d739b78d91c897fb
SHA167eadfb1c3834281aa07b89b3df91976ad1142c5
SHA256455b882d1bc655bc9a7d172953d5535f7a7c4a214e87c8f289e092e3dd760532
SHA512f14db7f8d1ab071fbd20188da8e43bea9e1549c6df55be224a32d5b2dc1df382daf71df9286b0e1089d8cf5f6efc3a82abe0fd0446a634cdc9f7a32cd43daedc
-
Filesize
581KB
MD57b0d1a72c8937abe3e352134a5a0fe10
SHA11124c99b03a3a25e982ae40e0ebf72b22666090c
SHA256b44be9dee2ae6f8a592700bfedc330d0d6c9bb685ec74d9868ead9c85de5674d
SHA5129b83f9e5f62675652612c7b949f5c5d27f0bf64cd9e87cb3de043c61cec22263d96d6bc1d1d7f8e970bf1ebfd6c9e3359c279dbe22cb54828f5dcac0ea96daea
-
Filesize
701KB
MD5fa1f2e003cbe92e6193041bdda2e724d
SHA13466117b43958795f99761fab93683d59a061886
SHA25696dbc621f2dbac4165e9bf4c9c6cac2ebdab6630019fbeec0c1a314f6dd9d406
SHA5127b61c48530a595e836e221e1ced5cac1b33764f62813c8852ff4287093882cf0ff1fac73d26471d3b6f52c9ceca572ff9fdb392160cf7f97a510082574f4dd63
-
Filesize
659KB
MD5842a79bed326ca7d3e898950a30a5b26
SHA1db11162a08d08c4f904969badb44953d4054d2b6
SHA256d026f101194af147965ead31703c401b7167cbee5bd9a5cb778264462d31a9b1
SHA512e294732665bc9ed30bb02c07a348fa5aef101b26a2dac7b9127438df4ee945290d633a7aa7570f346133d5f2c442d43fa038a8fde652627ccb1ec1dd64d7b47a
-
Filesize
1.2MB
MD5e51faf4b1092c625b9835dc3be0dbc85
SHA18ff53fdf0c60fb15adaedfaa1e4192609cb909ac
SHA25650db7cb3d5dc2a03390e2d6812bd5bb48d37e88b9b7a7d9f1ee349823efee796
SHA5126a947ce7a6be7e1c6bf4eaf9f66e8dcc1bc2052b6bf9ac39f19a79052b2840ef4415f5491ddf969eab00a491950161c9de78502a7a5a420e83726dc97f271bce
-
Filesize
661KB
MD5243011ce1bba48461ffe829d8915b887
SHA1a81151add25c5cc5dda42e2a2dc19c950e1e5823
SHA256d04ea3b7c634da72a32b7991361aa4bf2e1f4921106de2f69da53d3dedafecf6
SHA512515b3349c9a8f461cffcedaa9587b9fcf8a0f4a3a14b5b81b07953390a3b1c350ab9cebb8e6a2508b9645a147ea56453f9e6c2b0d8f23d1666fd9b0ab2808b0c
-
Filesize
1.3MB
MD5aa09aeb91147eda94e917ab17185856b
SHA1fc48668286b8e29c2c33f463a4afe39f8a0e247e
SHA2567fbcfc88bc697d03be04a9feda8d991c13b4b57939f5c31da168b9dda0356b99
SHA512bd92c9b48336efd5fae4594da4cfc13b0d4f7347aec799ded2cc7794ffc0df969b43df215bde9ef8cf99644a27bdd03e8ddef918f007f81eda77b035c0d32b09