Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 01:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-04_63dbc497e9dd91328e8a33bf90e7faaf_bkransomware_karagany.exe
Resource
win7-20240221-en
General
-
Target
2024-07-04_63dbc497e9dd91328e8a33bf90e7faaf_bkransomware_karagany.exe
-
Size
677KB
-
MD5
63dbc497e9dd91328e8a33bf90e7faaf
-
SHA1
0d1a4929b9f38742cd9da96fe683a5f7745de69a
-
SHA256
e9611a9405138db1225c0cdfbf704e32b45577b11795e0456aeb55bb8aed30e7
-
SHA512
4b061324861e9ce38ff4df40e341192f8a5f228d8c81f928ea6fe14983c31ad421c303fe066639395b8ddeed850511ebb52aa15edfb697dd4a0ccc710fa41afc
-
SSDEEP
12288:zvXk10UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:jk10atr0zAiX90z/F0jsFB3SQkC
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 1284 alg.exe 2052 DiagnosticsHub.StandardCollector.Service.exe 5004 fxssvc.exe 404 elevation_service.exe 1168 maintenanceservice.exe 2980 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-07-04_63dbc497e9dd91328e8a33bf90e7faaf_bkransomware_karagany.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\c24eef797dd2f4b9.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-07-04_63dbc497e9dd91328e8a33bf90e7faaf_bkransomware_karagany.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-07-04_63dbc497e9dd91328e8a33bf90e7faaf_bkransomware_karagany.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-07-04_63dbc497e9dd91328e8a33bf90e7faaf_bkransomware_karagany.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-07-04_63dbc497e9dd91328e8a33bf90e7faaf_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99406\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe alg.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-07-04_63dbc497e9dd91328e8a33bf90e7faaf_bkransomware_karagany.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2052 DiagnosticsHub.StandardCollector.Service.exe 2052 DiagnosticsHub.StandardCollector.Service.exe 2052 DiagnosticsHub.StandardCollector.Service.exe 2052 DiagnosticsHub.StandardCollector.Service.exe 2052 DiagnosticsHub.StandardCollector.Service.exe 2052 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 712 2024-07-04_63dbc497e9dd91328e8a33bf90e7faaf_bkransomware_karagany.exe Token: SeAuditPrivilege 5004 fxssvc.exe Token: SeDebugPrivilege 1284 alg.exe Token: SeDebugPrivilege 1284 alg.exe Token: SeDebugPrivilege 1284 alg.exe Token: SeDebugPrivilege 2052 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-04_63dbc497e9dd91328e8a33bf90e7faaf_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-04_63dbc497e9dd91328e8a33bf90e7faaf_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:712
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1284
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2052
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4808
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5004
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:404
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1168
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD58d8c08c78872b8f2dfa027ab966865e9
SHA1a42bb1dde7c1e4120ec8a245286499bd400a0aeb
SHA256623c47c9f9d010628f90492a0c9547659dd1f479fa996787d16201af6920f608
SHA51211ad0ec4503b3f9a701dd147ee590c18f57ce71d7f50dc22b0dafc30ad39c2a6e71e333dba3b9cf17231ed97f681fcaace89296e9cd405879fab70f7d2bae5d3
-
Filesize
797KB
MD5bf0b8cc0c5f88c0f3d7659addd876359
SHA1fbc9bf30725b99b8025cfea45549376d3d1000f3
SHA256b1c7485bc5fc289905367f6c13877a8ed4d78b12fd1fa302c64f09a8b195c53b
SHA512565340f5a3cb6a1c6b712f66e20bbdf4cef495ea8ba403aea7b96bfafcb51f77ee9804eb5833a3fa8b3d6b20bbbb99bef9c1f64e5eb599a08f9762ccae84f0a0
-
Filesize
1.1MB
MD5ce62ebe608e6bc2804a0b3d22c5907d6
SHA161e3f5b57d89d02787fea5dd393ce8dd1c1863da
SHA25649f24db23648a5dd9dffa562906010acd347f3d14f4e4d8f7be2eb9922414557
SHA512bb179af3079d31e74f00914ac8ebdda031a8082ce928d679f9fe4de40c32afe9ff9dcbae85d5365c1a68dba07e6157c7415ec0b79f9e39e65b82cccbcaafa1d1
-
Filesize
1.5MB
MD506370965aae95a6b9f8b12330e304ff8
SHA1dcf1585ce9303d93156f6b64fe35dbbe258768b8
SHA2563e0f22dec61e395ce7cdc314343d0c2b1dae68553088ef5e54a0a6ca68db6545
SHA512b739532b273d2affd3cce916fe5d651511160687ad76b28c7aace6c1bfab6466b0d65bbcb6e62b0be21cfcf9fed0010679c3b2714eb7c2d09663f12931b09d4c
-
Filesize
1.2MB
MD5cae9b634143d668b6bfcf59d2e7dad88
SHA139fff6e183f31d276df23d79250bd65ba5e75924
SHA256f15fe0164d4b466c56e1ac67e19c0426ac1e528670f5461b252c46ef2b274af0
SHA512116c24720de315c47fecaa9b2a4bc553a3c49b5d70840c2cad8faa35d22e52b3a118676bfdb123b9ae35529c67c3205fb7971cf80bf1dd84127d5427d5501e1d
-
Filesize
582KB
MD5df990b9d9fe64cabe45e90fd1e920133
SHA148627bf940241008c20637b57d7430d6a1274bcd
SHA256fd2bfc01110bb537d20a43dc00ea19a4b81f6021427113ddd5caee6881cf581c
SHA512a88cad97986a1384a44a03c9f49a92e338ea93a2f113a91fd80dfec1fb3413710d674fd6edde9c1fb672e52b09ae695a6d59a5e8d598b82ef8fe79cc443e5e52
-
Filesize
840KB
MD553b92809ec90ff08f118ae8c59ba59cf
SHA1daaaa1925640e7ee7835c28eae13e831b396c65e
SHA25663d82c5084053e6750a960cb848d3df72de4d44f68a84f0b484a2971f33892b8
SHA512459b8c0d3496b8c956f3e753ff2aa03b9ddd8dfb7f4380b22a2491e36bf043aadd2e6fc658f6710cf834348c02838c60ff30ca3eb41071caf62d15f3044779d2
-
Filesize
4.6MB
MD575a64bd2f19e5ed620fd83f3b4a2cbdd
SHA13e4a684c8a5b397a6d9dd5450063b419d2d80e36
SHA256af0fb7890099d6a3832f5e1815b30a57fb88563cd8c8eeaffcaa0b3c12d01006
SHA512ffefa156677b41aa162a448b54c801745366bb42161af7ed73642e0e81af9bf8c98ed0a3b63af993fdb0f423c5226eea7965c476a3ccec905470203e27857cf1
-
Filesize
910KB
MD54510469e52ca6fb6ac9f3a28875f1703
SHA16e5ff16deb3d14c9e4bb0e1571fca7c0d6e7a941
SHA256bef8ad9429cb5b70cd5be5a1697eded7a2673f3afd7f1e44a2e1a06dc318381b
SHA51222778d4476b944883ffa011acaab0c39696ccb5e1eee2ccbf4e9067bc219b1ef970c2795f323741f21dea55a74642dac09b15ab1a3a17470ec2321bedaffc2a2
-
Filesize
24.0MB
MD5309cda7669918f017b74c235ed3172a6
SHA12372d10a0796698791a213e7778682e710a73776
SHA256f858737bfa2d31645af6a436c50bf9058961fc164e78c2c1a09e9f462f39b504
SHA512e403dcd9412cc717cef84f4baa861a66223fa8a3e391e5bcf9ce13fcbf54457db50684e92b8a1d059f5342e44baadc0f22f550fea0d75978e61103aab9e4740b
-
Filesize
2.7MB
MD514dfda1e3aeb7331cd300bf2e3da71ba
SHA12fb0bf7102381de9f6362cc3a85881e3a7de67d2
SHA25602014941043f2d114566ee403441013bfd509b8c897785f7bda59275e4c43384
SHA512688f1dc16cabad3ecb35bf512e8ae073b0254867ff6b50dc71619eac9c598f3539d2f17d8dc61b659573f2f642e864387c4ab59ebedc645eb0223333d07ce797
-
Filesize
1.1MB
MD5644b7b5ae20f51b08b84e7da6d0efc80
SHA183e2c9acb88fccb4bee33c1abeadb6685aca5b08
SHA25681bb555bd98d39b2d625d2121fd66a00ebd368ffdf4c94dc44d8771725107e46
SHA512f2c21a6f99538b8af90ae61601b8a51601d9dc53f8fbe237d7d41a47d2f8d6d753fa60b31d2519471633bfa692d472d2ae33cf96d1922c16d1661bff0612f0c8
-
Filesize
805KB
MD5968d2428ae5289055a3efd9803391595
SHA1e4cf09dd2ee451a5ac4e120b3bdab997c129ee93
SHA256d320a65190b472ee8d630f9f920ce825c767a49f3f994d96af3c774e854b5974
SHA5129fcbc8a95102b1d28a5cfd4264bd8d35b16b691566090e55ba8fb648f7ad85e377f87afcd3671798a95abbb047719b1b606331366404aeee9e812bc9b7ed70bf
-
Filesize
656KB
MD565e64fbd011ed1a409a3104ced8a67a5
SHA10169487d176b0d7a109f42b1984d5e4834b91c24
SHA2564981b5c8ee3ed740fdcd6a4fcecc3340421ea1e174fe65171a1f97624e2c82fd
SHA51294d53458b312edbea4f2b7d7de316f7eb1d3d53636cea08b4af5cf6d5a6e5363d45563a177f8f997eaad84446bd60a1f85f8eb7c6b5b1cffb11e0fffe1b4022b
-
Filesize
5.4MB
MD53d0826fec48c5ba9f3be07b565c69641
SHA1690c7bdb68f621073555d2518736b6ee5088a838
SHA2568fed62d5540f6a5ce1e4b8ba04c72a9d33f5e410d46fc59380880496badc8801
SHA51291758c0fc10b942f57d2a5ce164e06d9084c7693bf164fd0116c79ca0f84a70dbd6394d640068f4f5f8ca4527221e76201af84b3b2cfbd9c4c009bfd00d59f10
-
Filesize
5.4MB
MD548ea01ae9d4dfd6fcecde335f4960c83
SHA1e091e4f8d762aa73d192b518c64005d45e5a5f17
SHA25695f3789770cfc0c75ed816fc2f27e66e6272458ed073cf89a0d3e18cc712b722
SHA51274c665f890c0f884930885c684eac6f7baa27c07ecd566560425dcf7649f371f63e44ac6579a30721c5fa460bcd1304cb323460ea36ab0818aaec0527c017990
-
Filesize
2.0MB
MD52f6adadb30d0b17e92764b37e99e0111
SHA1e750c6478b39ee1d03e899e2f0c568cff691d8f7
SHA256d782474bc91ed4dc274450f7aab23cfe753ace3280477022b4d4be23c8bc1a48
SHA512714471c9b7a4bac0cd519f0c1d9b5726892d27a36ab6a584d78fca607c5bcd8b99d29667c45e272230c66d64943c327eae48487abe3a3d198d7f25182a6006e4
-
Filesize
2.8MB
MD5dde7df3baed02d59a2bd3d50161c5094
SHA1624dfbb574f329fd50e0e2b2772b7d74459d17fc
SHA2563aba0df6cb7149d084c963c8e92cee8e71f03909f5e6c37e85b845b16e49aa4e
SHA512b300b6fefe7b15ac949d413020df567bc68af17529aec8f7527b71a9f75b8afc29325ca864dd9e7592ccdfe35856698d23802b3ed7ff4425287fefadb6e68fb8
-
Filesize
2.2MB
MD5621ecc0bffd37eb089549633b38c1da3
SHA1a40d3b9395ee60c230e81defaf4c2bf74a33e47d
SHA256b9b5de2c0deea73575eab61ab80cbc9b33f81b719698f99bf8659db2369621c6
SHA512ecb491427f8b23a37bdd29b0d113861ecc6ec32a5a04845b56617c9fe4021305490f29fbf8c9ea8515f52e5eb6c6fcf689277ea917562ddd7b44cd5f8faafc57
-
Filesize
1.8MB
MD538dfdec614d09be0b93233825e798628
SHA1b1f710650393bf7fcabad8a6fb32129561b76a84
SHA256a353fb453757647e0ca62b90c1bc1b6d5e18e07cfbb43965c0deee12f71ea7d7
SHA5120a512c87aa49ea565b9f61f6aac0572bc9941caa05c23b9797e90516b99ee6e0272bf2e64d59403907b3c8d3a25c64f68c5964e5ab93bb1704726d13cb31e3df
-
Filesize
1.7MB
MD5d69c088ec5ceef322cb51cdabd17de7a
SHA1df04f874e21fb02537eebb6466ecb7182f7af888
SHA256acca74bc5084ba326698a35be8f52cef797b03c9cb789459d7daedb769309a3a
SHA5124777ff257a61a96610434b5f568ced9e5da97512c2c34c0d2541a9586946e1c375819a087112b27cdb4134767b6eb9787cd666562049d8f3a36b583fd11d02de
-
Filesize
581KB
MD58b4d59dcae9a0ade9727d5e70a65b09d
SHA13870341fff33b1e814dd783aca505886addc2220
SHA2562e8e748225062912d6db344202ceec24a285b559c86366b179112e7df64eb8b4
SHA51271715826e4314f13d38aad60a1fe9911d1b5b762186d87eba487698d53cbad5a6eaab84ef9c8c2597b14fa78ceb9fded2d26d03a44c31fb7969375c337dec6a6
-
Filesize
581KB
MD5c8eb1d0d642399821f6f6f158ad78cfd
SHA1cfca58601f297f4d9a59dc4f54e437e13cad3c89
SHA25655cd10368a0e3e18ef33090b44c2fae446c9da5367014407f1c76860e753f88b
SHA5122fe7e250fda6b94639dc9e4cdef59a681984fa12fa15518f413a6dd2a1cfc77ff6147879b938fadf4aea9a6a84890b616470081213e4b8b4e0473e96fa6429d4
-
Filesize
581KB
MD57fc742f3debac933be2bc78aa062a9af
SHA159034fbfeaa6a8d0b7fcdf605679745f4497b396
SHA2567470782ca3f24ef9f930e52411d41856a75466d935c2f634979d679183885ae5
SHA512adc5df9a42e6ff29405573ab5f8e64c6cfdaafa7e789832b11d87734da395e79e33628e83b4863904314cb6734fb87331d9ea1d4109fdeb51411be151b19bc3d
-
Filesize
601KB
MD54be41f4c9d32a522828b27b951be83c1
SHA1b73e94301aab89ba9693ae41970591d953b1afc7
SHA256b3e2be4027ea15a5f6b83b28910ad9e623f3509695c98f66214ebdb84a7302a1
SHA5122a282429d22c7785a4a572685c9945b03897b87ad27ef0e37c33428bd1c37dd34bf7ad3c3776745f1e3c1502663120c763d121cf9b99442403923d20abb86855
-
Filesize
581KB
MD54a8dd35a9aea541b46ba92358afd2c68
SHA1059521a98744a57474071a3b28d37d723aa15eeb
SHA256b374cc5ec5964231412829c0d5a10d085ce97fb70341271a64e3b08b022a5943
SHA5126880085daeadee21ccfa530990e575f287179a71d458b32708dd77b9903b9cb8d16730cc1cbe377e0267f9b9b5dd0d6753d07321ce05827942287edd7c036fba
-
Filesize
581KB
MD5c9fdff08f6a8a5211d203e5632cce1d5
SHA1becd360fb4c9381c82a9db5a617c7415ab24d286
SHA256d3bd2b66bdd9842148456b3a2b9b12a98f9e0a268468453ce58f30d9e06467e2
SHA512f2eeeaaa607d3f10503bb4cc33cfc9b82b335c42025a6cab54f8fef0b3f7dd851bf23ed35910042f0a8de56f8a8de1d2b8dc28cea719d45b5c7c2b01a2cd812c
-
Filesize
581KB
MD58f6c54435f7dd22d55c7c3a414479c0a
SHA113f16644480453361ebe718eb71b28a9e3ec17ff
SHA256a2cabbb6f5769844aef3ea1c45017a3e4b46169a2ac03b25fb13ebec28b1f4a3
SHA512210ed45e2555bf07caeec7254b91d3c83a6da58ce1d3ba8a40afc79b845beeb42e220e8d25b99ee6eb9da94e1b3b48475e60c5e639ec78cad94739221dfc50c4
-
Filesize
841KB
MD54a949192914ba130ada08c3aa39ca1d6
SHA1d196d1d9746eeef4644d7dc01fcfcf442c03a209
SHA256433828803f3efe026288e0ec18eb894f781ae21f06d59848f9c63369825dd0b8
SHA512edd5b21a30bbe5f95171e4f42e639f262710efbfe97be6a0e1d21f8b5203b95c2e0b7919c2a6aca1a58cd477cd472c8858fb6a24c6c281703ed6bbbc39334dbf
-
Filesize
581KB
MD5c13cac308ed7781bbe59a02a2dbcf27d
SHA1de6546b51346bfb8f59c11e73c5b99f3e2437564
SHA2567f271b95d6612a9311d7a86aeda88c72e62bee45460b96158ce467195a56178a
SHA5129c901d5352390dee21b223eb0e7b815b4f5214d2a4710cec05b4c3a5841580860aea92dd8072afe7df1594f6f7346d4e03408c807fe309d551e2c7e8ff834dce
-
Filesize
581KB
MD5cae4e0fa6023a02783f5ff2baeebf4b9
SHA1a0208f3d5697ce4368ffc41e9dca8b62532593bb
SHA2564f7af46f94ef481a95e0465869b6d4e7face8e4b7108b2cf5107d9fb8516558e
SHA512906bddbe4d607dda36bbb71f424b1d1c325e9631cbd6667bdeeabc4fbe54968b956eb1a79c7af8bca774823625a44692c3df09c9ec7eda1f9088c08cfd63bd4c
-
Filesize
717KB
MD56d6128fd0c5840cdc8e08364136a7c8c
SHA162c2b9aff287275ce639c85a9abd7932f9d66dc8
SHA25637f10ed0cf06129277bb2934f4f213827ca3c2312fe587b86825cb1c34e23071
SHA512bac17761d93edd17121c285b6fafe89d7d73018e1ad360d611fd656a4440fdae53abb1f9df6a5d82d30cd5fb1ab91cc210f922cfe936be44508dcf12f2427716
-
Filesize
581KB
MD5472147ba58a528d31ad837e885f83786
SHA1937d83a224b43452a73d80a387e21a2108d6d9a4
SHA2563f50dd2571352b3d213552fb1d5ae8367393b100976a39f181c9be2449c4315b
SHA512087fa0d3545be2c7760cb701f7ef7da4a1e3863e6b761d208205d662397d71629194a8b77fb7b74df5ec24d1a28209ee4daf5ffb26860a4c8b16ab36dd3e57a2
-
Filesize
581KB
MD5266291ee84edc0f4fd2420d62b739697
SHA198dadce3165fcb329526176ecdad266d25c70779
SHA256c53c4da2056dac6422035d6b440bc15b66f746f3eeb1736b9fb5952181149531
SHA512f0dddf7539a9b166865001d57ee33e6dcc27f98ed7eda074cfdbb84f44cf47d19c15d0243599e9aecc6a425e30a17a8fa4d7d167a1c7047daabfb09c0ad68560
-
Filesize
717KB
MD5d6b0bbb819133896307e162b5d69512b
SHA1da064e91c914f76a559050afb5898dae87437fbc
SHA2561a52d6b036b2c0f7a8eca98172fd17f52a3a66de5a49c44da02d595163d8c893
SHA5127924bdfb797ff2c35669a20b50117f121e1eaa280776de6b0569f82e3a1fcbd2d42eb1baaed56196e20b77a6827b4b6bf855ca7a59a1c15a386b7721f25fdec6
-
Filesize
841KB
MD52f295aee5c49e130ee58879927a48f79
SHA1aa1dca95da4d8adb67d95f14927923a29d742eb2
SHA25615f95b9280e394e311236ea236a46e2715ab6f58ed526791661d993aabc65972
SHA512cf8b6c2d83eac4c72d7461fd1ba85c1e3c24a5fd8f61305895ed5e6af07f3e0284aa3daca59e113548b5c0c8a35f9909ddca673e3e7d78d30dc92072ca9bce06
-
Filesize
1020KB
MD546193f741ab4375cebab4337c01f7772
SHA1e50b3dfff26338cce5c360886a86d27dca77985d
SHA256263f453abe1a6741464d571c8dd23e5a9ffeb084b59af75ed12144a4d6859504
SHA51285cf7f1853c239ae42e42aac6bde766e4d4867f9a9bb2cc76677217262e2c0a65ad77d59415623310d45fc3fc61b61e5f74a2335a6a352c8f838074dabbd9847
-
Filesize
581KB
MD59bdaea9ab584f252068ef96546e95148
SHA1cfba0438e5347960061e41bff1dcc3b24544e6f4
SHA2562e8eda1547064a4d1e1550e45e0d25adc2c716e369be0ce5c19b89f098991d05
SHA5128776ead829333b876de0ff6876cb5f848a932330a63dfe1fa34f498774bc1efdbc3357335fdfad1386e008e0f0d708b5fd9e18593f53da6e4a1102e97ce9cae5
-
Filesize
581KB
MD5cad25951fc9cd78df4b20f2d82b5a776
SHA12f41731bad79637adf80d2f8bdf850f27088553f
SHA256d1df17983809f841661bfbe89d8b2d470cb7a973df2fa2e994578938b6ef9382
SHA5124c72a04f73b068c547a7972c10744aa696c18bbf5ed8d60af3041719120a342cc042cfcc00f85722f6c3a5897e0a5cd0e729c9b3199b0a4af12eba0636527070
-
Filesize
581KB
MD59ec58e518b63da4e6a7c85a5afd6686e
SHA1d40db09f8875cf3cd503301afe943836717b05ca
SHA25668f796fc833317b332fca762c025e380ec25280e7d070ff508251e3b764d89bb
SHA512cb9c85c91e62fbea0d185456bdc93df08a8116ea887b7c8850ad0c9623012c931bfcc98ffe39fef45c81c1e362f668beedfa717c4cfb0513730916675e2d370f
-
Filesize
581KB
MD59c0f09dbb982a71faffd3cdca25a8a23
SHA10b959224a73fba7da318fc4b71757aaacf2de2cd
SHA256e91d1e7ea59a56991d173f2389efe22156414c8616a914203e704a0f40731bf8
SHA512b69d3587f79aad04f12da56ba7950cab5a93649dd1f78860c5122d8f0b037b61bbb462333df6a89f254d0bcc4150018be278c84f2a0171fd5245220c9ca508d5
-
Filesize
581KB
MD5d8275ddf91786ba45fc7990b442ec03c
SHA18868ce2c2f5926e0453a3a6fa4244340b77700da
SHA256d17ca8beb4bc2f67dde8c7ac61f00166a3ec190b81c39b6a7aa3a6e84be5ffae
SHA512d01958cb6ae7625902ec07e6bd026c1b5cd601eef8efb25935ac534171d6d92737ce145c341b8ce061f996041908b42dee00324ed2268588c5541a803368a2ae
-
Filesize
581KB
MD5c99f176bed41dab4ce8c216469b8c044
SHA147ed81ae86aa1934530ea50e6f5c4357b167b9ab
SHA2560620d4f2124cff4a5e0beb62cf19a2e35e90dd0991871be88f77d57f201865b2
SHA512a2ce91d6709e4a138375e0da3e5f520e92a7fe4b103fcfb7e6b5e8944260967aed299f445f1ae2562f8db859fa3d86fe475c284e52881e3e3b92d3a1d3474b3c
-
Filesize
581KB
MD5a674224becbed4943871a17b1823c42c
SHA13e3b584162ea62701823fd8716056ad8365a7789
SHA2568832f5ff636a28e2f256fee5269bec65345637023cf34f60a002fa8cf1f35258
SHA512b2eb1dadfd167e62a5548c630e70318c1868f18ad0c053b4e6645309d6ce636d63751515de90d846f73472f2d74ec408f07dbc8e99330346144d584e89ed0f0c
-
Filesize
581KB
MD5ceaceda33b7fbdc2b08fccc6716e6507
SHA1d7ac38d1468dc1f480669cb98fc0a75686a1a8af
SHA256e1f266fc91bdd7aaf77089175a81fb55d0d0cba6e7d40c362fa0599ded1d4af4
SHA512425c0d2bf5caba60d8dfc1997f35309f9736b0a3d988b2da79ce89d4857f0431072ab644761bbe8b98448c93669cb4795599589e2ff7c48479d2a24fd81c8941
-
Filesize
581KB
MD5b1085b0bce0c8b0e8d83f72599efaa88
SHA1f2ce8635c99bf96867bcc60b37051088cc93c1ae
SHA2568bcec7d7d16b9cedf65d8c21cbce25e70e7507fd2e6d373d2a3a09d6d6f95359
SHA5126fe184f0eb56f4ca9437b25df107a71d2aac71f44bd37dc3cc9f5b81314892dca5270e1a4eae08a39273becf2ede68236e6cc921f2368feab529db2c4cf2d2bc
-
Filesize
581KB
MD57f115e3437dc785de2bbcc5c55e60e8e
SHA1e66b3318684390496652ea28a2ec241043960305
SHA256c8f7e9fc62847d2bc67ce6fe26bb91f3ae8b6cb660e9ad95583aa8ad1bd57f13
SHA512da37ea80ea175164f045819900784c2848244ef5317cdd8b83356b767de6c069587f13bd757beede3b057bf2c2fb499696ce8021196c2017908fcf92ed9efcbf
-
Filesize
581KB
MD55da63fce572d3bd96e0b68880acff8b3
SHA12b6eaa7dc7c71df8e84127a8b27c6e37bab9487b
SHA2567d6f7a73cd091481760b30807ec8760503bf8c12c386e9910bf08eae9e2de02f
SHA512c86d9c4aa6ad700c536340e010daba2c7d74c24df448d5679eac5cdb775784d124477ab1f7c92e1e2f04353264d90a5225b58241f8c5622555788901f4977675
-
Filesize
581KB
MD549de57492b399653ac6ea6eba3f0532d
SHA1b09d1a43f927363b8bacbcc03cb61b37fc722662
SHA2561ac14452dc7486236965c1c226335cf6f780ac3d474ab6a56f9c846c837fd592
SHA512ea7a8824be4773cf450382ed8914be4ba3f0328c53f6745c7e0dff205da96f2d6baee6e8d0120f7ff591b9d51449aa456f7838aafd64d47e1e3e9ea7ac626623
-
Filesize
581KB
MD5385422ea5dfb79acf7376abba2118233
SHA13bf823bebf8d6af6c11f741a8d25e4e97c5d0092
SHA2568b0963ecf59f61a97c336af71a22353553ec7e5fd43af5093fe262a527d93be0
SHA51230c6ec714ebf9ce7f71d363e3127ac380865a4d14cc8538d39683912f9594b285c6923b9f7b6e30701f362efad79eae1b726c9fba5588e522167118b0a0977b5
-
Filesize
581KB
MD59260c83120131bdf4ad7e90de85d387e
SHA1f6a6b374e4721dd73cf1116c2a2824a4a53f4c35
SHA25687ba43cfa786e217628e7a98a573284e42336985dcae2d54a4396317cfe0cc53
SHA512a6e2bd5db12b4dae52daa0ed77103f0d45199b84bbcdb769a7070aab296895a3c9ac5b292a5e39f6d09196c247d33905d1bd59029ddf9407cb292400d5675da7
-
Filesize
581KB
MD5edda8b5124e0616df9b902bb1c4a4ead
SHA197bd3ee715364c60b76f9ddfb6324601b2ce8efe
SHA25656e574639694f575e4b7cb1e4d67acd876422c2c92188cd21866d43e165d38b0
SHA512422406d28a63236ae4652bad526ce2bdb4266443f48d0fd4ac4d909116fb5e94f1a28547664c3463ed26736faea4b1e3330e714ee4fc837a0ec46113c065841a
-
Filesize
581KB
MD5070b7e54fc2ba032a82ce4a1d14ab128
SHA1fc4dfb06bbd19016e20807ac31a177bf15640abd
SHA256f6456bca70d820ea879cb99f5844d578d7a59c1ea927d5f2bc58e6f54a648f09
SHA5121485ffc8b37bfc44162387e6e1088adeb88365f2b508b208d320908db343eb120f1a53a26018c7c26ec5da5e2e3712ff9b0af979f1d15a353cb0b89b59365cd9
-
Filesize
581KB
MD5c777d022329e52fc6414e7c1928002c8
SHA1b686a0bd42ffa3e1dd2ea3b9f79874030d8640b3
SHA2563404721137600a242a9f5abab88cf227a0a010b074cdfac50849379f1a6f5f52
SHA5123ed98b877217b55d1b937061a431a9edee0e80a4d2307173bad686896a7ea5effb95e2f1072d24ffb2a006ec6d871fc4ded44ff6f8e512804dceb860e2ccabc9
-
Filesize
581KB
MD5872793dc4c08407a5e9005c17899071b
SHA1ac55e515ebc8f88d45a5fe39674ebdba8cb5e460
SHA256300d8d81b67a84b10cb02f52985ccf9dfb55f0449d86501a09f78750e568c7da
SHA512054859bd7e1f743d2442d04200a107378ee11e9d7098c6d7dd5ccbd2a29a6ef1adb29dc85b90b83920c0141e1fd74214bb806a5d1051baa1fed8060ca960d818
-
Filesize
581KB
MD5008853a8f6ef2317e3ad7cd6761a05cf
SHA1c21f4aa3aa7f05f94e4f1cdb29c8608e53fe7d53
SHA2569b32b89f2863ea54b0100c0db6cf91d660f3e4987132550d0d0ad5f30498d542
SHA512f4803cf1c2eabcbcb650febe6633701fb09a700650e7749a0a172420e2a993f02696db68b4c28b3dfef209da558ecf7fb00a44b4e9598a7af9de9ca4e84783c7
-
Filesize
581KB
MD5ce92dc58a082307aa67e89b84ec4271d
SHA1ef72f13f983736553b3c8b426ad7fe2d8efe8621
SHA25699ba360ab1238f6abb9db941ae559502499f3f221b50eea0048f8ff3297a1444
SHA512a1559f47da7b63b35b1e74822924a84c75845041056a4af82afea35ceec9d19d9b067475cefcde2e1ae9935ba6448e4aeab27d0532a313c928dbed4328e5b026
-
Filesize
701KB
MD55f8af80222f84913ccccb5096d8b0308
SHA12ef7afa819b98647a7cb568efb41c3955adc5497
SHA256f57f229cb580f5890dc309956d5bafb036bdadb4f33b2dca4f2c2bd82d19f96c
SHA512197f7d818dad5bea3bf3aac90b94400b33fc99ee0ad44f127aa01a7f8f6b04d71dc20ccfc3b9530911d48b83bc25538363c1fc222f8b51180bb85514311db748
-
Filesize
659KB
MD58c4b4e5a3f265c3574fd4a3b1383d523
SHA13179f9fc0a6b014cd3563165640f50be93db54df
SHA2569b980f3ad2082a801bc71b0966b67912db11d870527d44e787330164b240c7a2
SHA512e408770e159545a16e83a7f342d523256d8c1d18492db735f387f1316ca6b6506a0f667a310d277fe3c56a9f678cfb4f98c06a9ccefec4d78a291e3b88dd98a8
-
Filesize
1.2MB
MD5531517e662d364fb83530caaaab4240f
SHA1392d913ceafe0e657d8e3b99b484d462a8a85c19
SHA256d81c97991f98b1e7f898f9eee94e0cd67ac74bb5cb67eab82090bc90a564c642
SHA5127f8f48511107f5bb20d6f17a06bbac9a68010296f2786dfd5ad6f5e915cec976ea7dabe453ae43bf25f082f2aa151df305a80a144c451d2384f16c81351fa96c
-
Filesize
661KB
MD589171058c1dab39c197dde473be2a233
SHA1d1f32fb44a92072caeee5530f579a7e116b8694c
SHA256e1b6d91bf293cbedef66e52e6318d308227f8822426c00e0eb82d01d08d6ade7
SHA512fd8dfd4253c3fa99702eb02af8a4c3bd72e86dab5266257adbca93d0b8a0ebbd29c369080861b121ec41912162e5845ebba0924a8e7084364f32acfa0fac0b88
-
Filesize
1.3MB
MD5f62c4df49229d389d4eb29ea9bd7799b
SHA180fe569dc68cb082c42781cd90b68080e1a147af
SHA2565c9c7fbddce7b4cff8d53b04da44ef7fe89f79138a7239068d47abd51f9b4035
SHA5122fdb160180410d2b682d28783df1b534d7769b73bb0a4107177d7f6fa72feca4684a7a9563ce4bca7aa9618767c858c0d3c556af1e3ab7a3b07ae4b5230d25cd