Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 17:16
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-04_b92ee9a7f068b6873d345a3cd5ad8b8c_bkransomware_karagany.exe
Resource
win7-20240220-en
General
-
Target
2024-07-04_b92ee9a7f068b6873d345a3cd5ad8b8c_bkransomware_karagany.exe
-
Size
1.3MB
-
MD5
b92ee9a7f068b6873d345a3cd5ad8b8c
-
SHA1
a7248db108195bdc4610e1dd2d9376c9d0cc7406
-
SHA256
c33ef93fef7e03d7ef06b573e9a2428496534252bd3c74c132e95bc495b22337
-
SHA512
d28030514234b19ab297e615a723b64673fe348a4296c0889f0b1b709d77b3a163af8bab0dd3f47bc76c230000da5f000e506bf364e714b18befa55782dbeac2
-
SSDEEP
24576:sk1YSRQ5UOOU62FBnO+E222YJbNEUQKGOb:sk1i5UbU62FAQ228QKl
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 2980 alg.exe 2176 DiagnosticsHub.StandardCollector.Service.exe 3568 fxssvc.exe 400 elevation_service.exe 2924 maintenanceservice.exe 2948 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-07-04_b92ee9a7f068b6873d345a3cd5ad8b8c_bkransomware_karagany.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\6ea70932293b476c.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-07-04_b92ee9a7f068b6873d345a3cd5ad8b8c_bkransomware_karagany.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-07-04_b92ee9a7f068b6873d345a3cd5ad8b8c_bkransomware_karagany.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-07-04_b92ee9a7f068b6873d345a3cd5ad8b8c_bkransomware_karagany.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-07-04_b92ee9a7f068b6873d345a3cd5ad8b8c_bkransomware_karagany.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-07-04_b92ee9a7f068b6873d345a3cd5ad8b8c_bkransomware_karagany.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2176 DiagnosticsHub.StandardCollector.Service.exe 2176 DiagnosticsHub.StandardCollector.Service.exe 2176 DiagnosticsHub.StandardCollector.Service.exe 2176 DiagnosticsHub.StandardCollector.Service.exe 2176 DiagnosticsHub.StandardCollector.Service.exe 2176 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 868 2024-07-04_b92ee9a7f068b6873d345a3cd5ad8b8c_bkransomware_karagany.exe Token: SeAuditPrivilege 3568 fxssvc.exe Token: SeDebugPrivilege 2980 alg.exe Token: SeDebugPrivilege 2980 alg.exe Token: SeDebugPrivilege 2980 alg.exe Token: SeDebugPrivilege 2176 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-04_b92ee9a7f068b6873d345a3cd5ad8b8c_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-04_b92ee9a7f068b6873d345a3cd5ad8b8c_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:868
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3424
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:400
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2924
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD56ecbb3c12ec92cbe64856517250100e3
SHA1a44e0c15c23836e87239566432170473bb4ca49f
SHA25641c3034fdc8db0cde39afff6c176098ab5f1b18937465343a69b80ab1cdb3f32
SHA512ba053d5771837ecf472135b288b2d85b6aeaf62deb7628c47d46c1de7cc5da0ffda1618d05140ae2605f72986d071e8bb52134e51496ea9d153c05098d7b2ad8
-
Filesize
1.4MB
MD5fc380907053c8399c96e5d224377aaad
SHA19c8cee9e3cbd89522ea7733d00c2513dd1d12fae
SHA25687b736cda269d28c407f91e3924ce17579beaeca0c46bf5e7680cc82d6446b4d
SHA512410a6934e6aa7819048b1c3c51e1d57032f0cac01662d97bc4922a3bc237645ae41e94638fd6ad95bd580c994dc40420dc21ff57d43b51349c37c3575a6f51d0
-
Filesize
1.7MB
MD5ea4dac75047253ef407972d0f39e085a
SHA1b1b14189c70927c9f1e4d023d35d22fb6030abeb
SHA2567b9d8a85a1505c07df35217f0d749e7ae82ccf64bdddc4601408424fd6be9cd0
SHA512790c34a98daf03e9aebbd9465585be59c2935d823b36cc8ace05f25c68dd9f310293f536fe240c783166b0ce546a2b9ae8d127e0f923a6b76144027ff28e3279
-
Filesize
1.5MB
MD5aa1add2fa080d7035b4cbf3dee49e612
SHA160cf18081978c3a5e7e8aa8a381f8be02d641330
SHA2564796d685410d66d57378d380c41a579b8c03391112efaf5011cab16f2567cebd
SHA512ff0a34e7efd12afb79143849a9d7516a07c3aa719cc67daf07b70ce5a489e28b0f1596cc2dd29163d988eec19d8140a0f8eafb9dc876c77784f87dd317166267
-
Filesize
1.2MB
MD5bc3553499cd36fd51386e7dcca8c2f8c
SHA1225c8f4aa4ae7f70710750dc100232a7ae0b0f26
SHA256acb03c9967219b968f31ef784f24fa978edf8f20a9ed070584efd9781f3e9a14
SHA5127e8e1b88c76c0441f19b68331c928016cee241ee38977fe720ba29e6e0487c5b9d60ed089dc1107a28b854157200ac7e2ea859d3fdde8824edc98f561c08e541
-
Filesize
1.2MB
MD52f73bf21494d8de20791843401162086
SHA1935cf7935334b963ece8d6a27ff3ceaef0898724
SHA25698456b9d062c28721c494852122f16f4c7becfe9634481fb4434abd29d333b86
SHA5120a9f18aab2e32149b9eb759f9076040a3ab8a3e6fef81d50aca51b833b2e7bcacdedf7a3461dafa35fcc528508e0671ee8966ba8c7a327f6ace518b6fa5a8753
-
Filesize
1.4MB
MD5edb9eafd5dd9a964dc5a5dca39cc7111
SHA1cf394070a085acf1d9005fa6b3ecefa70260089e
SHA2563d655c43eeb098fb0858e9ac19d87be986862770719037992c44bbb4ea1606b5
SHA51250141275e883469f0b44d03ccde15345c2faddade1e916e8ac2a1932db9d5720e8d86147a387120ada936c32598be3a5aa88babfb2d10748080bcd2fcc2788ed
-
Filesize
4.6MB
MD56dc216c2137ac24a5cbad4993cffb290
SHA138036a98d5e48e45dde0c7e5a7d7bf4e2fbf6389
SHA2569de9543836de8929096c8f03557b00204a7f3a16fe01f8aec3bc6b75d155bda9
SHA512db13cbd538dd8598dcfa0a11d8f94b972b8ba302ecb0b7e8a5d3c539ec4aec60c2720b24622448cb4b47c015febf51321836929ddb894f34c2337a146979a12d
-
Filesize
1.5MB
MD503c017ed9c06ab273c6b0f9eca1472db
SHA11fb42d6d95517db356f74da2787ba7ca0764de2b
SHA256ce11accd26a7986e6a97a1d8c332955add24acaccff5bd991ab1cee503bb66a7
SHA5124cc9229a386e693e49f77661772e8f444e48313a0287fe92d4dd54ad0d91d35fb18be4a005daf1d906b0f08b2b7ca914b09ef645bb485212d20f5936ca8ca305
-
Filesize
24.0MB
MD588964d8657f334ec587f0063f905e8e9
SHA1403fb6fe55d58956c64ba0a634281cab4239bab9
SHA256bdd86f9b7baab608b6a0aaee997775acf50fd62a1f27a8d7f38a6325fd2c6032
SHA512e729ca62aebaef98f6ead9030a59081b764a0d2765e45a49dd6880eed15fc63856e57e7dcf698e4958460c140fd5f0c4e1f0082bbdc72b43b3f25e2fcac1d21c
-
Filesize
2.7MB
MD5c76598f94103ba54aeb1306a01d94804
SHA12932a1f15c7177752d7e98159334cf47ef847679
SHA256e0220c3932774619530b251254d1bb5c0dd1691d696b1f489ffec1ac2c62ffec
SHA5128507acb42e50356cb97fe7d092ea52866fcdb532a5ee05af7eab047ca8bae623b863bd47735a2eb14c6b87efddd2ac47dec2220460b21954ac080b0e305c4dc1
-
Filesize
1.1MB
MD58c2a79beaa16ca2ddb7cd7b1da25d266
SHA135806fd37a06fa8c2d68401affb1d9fbc98423e8
SHA2563001a928c9b054f1207ab7e02fc0d07adc17993a75da104745c0192ebca0056b
SHA5124d08840f47a7547a46b4f095b9cd21ec5ac634329d45902ff3bb91db958d4519cd7c3f511a69bfa942b26b248d002e762fc525dfb9d0f8e263f543b523263b25
-
Filesize
1.4MB
MD53bd65bcca038e1c87a4609d4a9be51b5
SHA1a35a856a7aba92e2baa66abae88cbe3139a8e774
SHA2560a61085f310d6e0dbfbf03c514fb5c79f2bdafb8a8371a7a84bed339fdd60903
SHA51278e3f92a8146f2e3d597a595a2dcb96a23358f515acd18d30fefd27039af06bedc58f7de0d3baa6ff637ae474b8e1b759539232667067b4ca151ab75c3ee1c91
-
Filesize
1.3MB
MD538d26c66e725999805f53970e9335bc9
SHA134fece3bb0123bf5b5ade1b969f76cea349cdb73
SHA25657f994543efc998309454e60b471d23fee68bc5589caffd8792fec803b385d6e
SHA5124cc2a0dfaf974f03e0fd64d0b73241f19bf85789413b97852fefebc8636cdf7d49435f74fe5a22c5676f19c4dd3a62ac2c24e5413644b64531ffb5fa9633dd27
-
Filesize
5.4MB
MD56733af8789f22e75aa55fda532519d96
SHA1584ce89c5f0026dd430d01faa6e3d73cb35db6b8
SHA256de9264bf7c79c6a40caed4ed74e7dafecb92a78cfe425897974328254d704765
SHA5127bc7d6ac1aa03f8717873502912e8453c734e7c883aefe98f1edeb36b5acd3cdb16e1c9d775dc7e17ecfff48f467605bc96c9eadac7d9b0a04045713471d8f28
-
Filesize
5.4MB
MD5266622ac9262e47d1cd480e2004f2ff2
SHA1f631e6e5287a2d9d0f633ffe6ab7cf01310d92a8
SHA2563087d2998edd2613683bc0d58c7c507408fcc64096861703415fe6a5868f05cf
SHA512bc3e11d364c16955654caef68c1f1f90cf8b427be48fabed655c13f85e6d22522031109077c3c7f2b920b87d0b7a345a8ec2a97b8c0bdca92b0f7ca2d99b7a52
-
Filesize
2.0MB
MD5f6d0f9929cdd697049fb43846c2b32e4
SHA1c8e05225e746af182d49adfaaacbbf34a9bd7e2d
SHA256f4f8f02e4df89b16144c1930ed3b51aa0f83c9d40edd2d989c0be6ca6c91ab18
SHA512dd7a75867151cfe90abcd88a190a904d5e706681f75b8f4b1b63a704a9020b733d7883f018912c3ccc4ea84b7c96322620751d522fa527386b2b4f92124098f3
-
Filesize
2.2MB
MD58d96fc25916dc67a14e5e5b6a4406674
SHA15b82d79b056d209da143e242da6fe45b7e38d95c
SHA256e0b76f7ff4020d47c260f58868737e8c75f51e615f86274bf8386cbc1b38cfb6
SHA51211295b7f8f3ce165d7063af9004d9a037cb2b447ac8fba7f1169def3f64856fa5253ea52e9213a7a062e22a446a39197afb799a538e1394ddcb31d0dac2ff7f2
-
Filesize
1.8MB
MD5b1e329458db496d1968f8e5c4deacb8b
SHA1c238344f41ab5109647481c7e0a829e5109b056b
SHA256040666acd3ca312af8be4c9bf4c8ee9f5f1e008fcfd17c06646fa0fd29d2a707
SHA512206f8d5ce3fabcd6a575b8e265e36d000ef7405183259a5b0a3ae102384068e77bb5a3f87e5e7b6a7b3f33ad1a5976a382fcf70a870c3700213eea539f60a0b9
-
Filesize
1.7MB
MD54c934c91380da998e97357b50fa13de6
SHA1c614a056a7f1ccd0d041d72d2fbc6db44eafc9b9
SHA2568dfb8824120bb0c5a2f8694ce545826b38e95d9aeb9987d4a09cf5487826a1e7
SHA51299522f1e438b4148380decb33d44c0f5fbe15210464e9b937f4a68bddb17161e88e9f38cbf6df4b7e938fcf94170770ac32511ddafac3f540f21674d59375bc3
-
Filesize
1.2MB
MD5e77f385763fd3323094406fc650ff98d
SHA1e9e2982e343df3ecc3ca4209d89719e41bcc565a
SHA256554212cbf0e8cb08ea76ebb1f5602f1c0f695ea2f10d2c477cbbda9350df9024
SHA51268ce9269f350cd18ccf5f8de10bcff8b8baf54d7bd707dc7aacfba215616d6dd9e7740e24c1464430d10d8f196a1cbaf22b48b1905e199228cfd727a59af3170
-
Filesize
1.2MB
MD50545be735da1c3c864227bba4d5b9ca8
SHA14b3db415e27900c29515d06d3154e9b971b0eebf
SHA25661a925f181b9fd3d6ac05188ec68706a7b7e21d9fc0f5b86dbabacd652af8ce6
SHA5123cf30559d14b36e591b7534cc8201f43f714b6ab4a74b761a4462a432dfe140dd6fd1564069d881440caf79b9168d9d8d7fa3905a09b88253966e5ac472b92b4
-
Filesize
1.2MB
MD5321d87e29274ab931121dce4e88cca07
SHA15ebdb543e7e5ae67fbac897b15923540403475d5
SHA25692cdb4b2b087d58ea825c50ac3b9c6e7a9bf3ec36a31f25e37739f9ad2ee8100
SHA5127be8e1bb3c767db1bc5eb684bc4be1066b3904ad5b4896702d8c40cd5f3e64c44d3120dce42e14e0860cf9066eab59dd796efd1eba6c612e5fbfae63b038031a
-
Filesize
1.2MB
MD5171f4d6c8c0fc15b1ef556d702db9d07
SHA1a43a83191237bb9ea95821fed959f96975d07fe2
SHA2566841843e73836cf3cc4ebb3c59a1b9772f64eef41327687b5e19caefbdb239b0
SHA5120bac19eed36a0cf778985664720496c507a00c11e05c3282097768ad17dcca9042fbd8ab5f254fd850dcf24ff4e8e860b1f610dd740813426cac48d6f430a59a
-
Filesize
1.2MB
MD59150e100f392f13746f6f20fd7b2ef1c
SHA151f386b52cb340ed7672e433b746eb7f89f01dbe
SHA256766297509500c39181a118f64f04969d89ba311204d9a140c6f7f53fea2af6f7
SHA5129d483ac0ed60d1df648220788abae827c5d247e22674de0bfad1195a8e4ebca848dfb4c8d02fb673af3cb0e5a1ad070d485f8bd4964753591a099d91716b4ad4
-
Filesize
1.2MB
MD5bac8252ed280f8e471f79a35b6033c9d
SHA16b2dfd7cdaa55583cd45ab28a171f4feed52fadc
SHA256a39fde6f2aef614e1dfa708e74266734516c021173c7a749f99b9e74a6797f1a
SHA51286f7e8e499279e0333a9d300d89c01e46283f1a719d9dd80eb7db2d72d946d1d09a41dd45e4b01ba0e4280e2609366d4124b1848cb29e2becda42862c1a75e32
-
Filesize
1.2MB
MD5bf60c8cdaa9f9385d77a90aeede1d507
SHA1465d8b0f363e589bc187f84b236e9610cc670f7a
SHA25602e2fded72bf558fc69c08474cc8b2544953e0c62b0967d3c7c9ff020b7f6f87
SHA512e6e10a9c762fc0bea8545c199dbe8afc4d514877a0a5c1a9bfb5bdb67945c5bbf785c2db0216ade8399baee4fecfcf4507561d997c1c836b465a7205ef8ecd14
-
Filesize
1.5MB
MD540cd82cbaf6991f614e45dd21f65c42f
SHA11748ae57272e80abb75f83642ab9109e41631e61
SHA256ac09e066c761769912f65009219b1bd9b41a032a3849529478b550c70dff4b3a
SHA512e28d926140748d5d90b0dcfcee0e33a79616af26d94888a94a22723fe707b5452d55643c8696cce89f13fe42ea444f09a2365a3e44ac6ca8aa8a094ee1fb1d82
-
Filesize
1.2MB
MD5e6fa48e41eff1f9fbb72fb8edf2f81f2
SHA102d513ee15bd604e17e58f8348c2eb1719301f15
SHA2561e9815b5e69ab18e10e832b002f0783018c2775adc36e395ee4a7f5bb029b520
SHA5121bbc2ef1577d911cf258d69f6a34a958b4318315a5a390f24c98d5162342290976c5c14746bfa094b0cff27a238fc1557b2d47db67afa9bd231518fcf794a28e
-
Filesize
1.2MB
MD58db9a5cde61bfc98990ac95645ad0714
SHA1252620be4da947658c7136e55190f3f704bd41bd
SHA256e96a9be57d8d75b0771e86cecae89ef9d2c7b603bf5f9b06a39a635b4e0988e2
SHA512597313dd2a5071d24d8efcf26064b55ff0ce49db4f02e08da1f4825efd4999d0b609e26e2173c6590554c9000eb551e4991df7a640910b9d37797c3490c4a34c
-
Filesize
1.3MB
MD5f60b87b7c0e9ecb8b1903f9ed38a0e20
SHA1ff367272e69c683dd1824d3d93874526a449c097
SHA256507091e8853d6c14b99ea8dd4f628fd578563644ec0ac17cad12527708f57efe
SHA51222afa434ba203541a39beef0a9a67082f8caadcfe9e57516e3679fc7b7c1d65b4af1cbb258aa835bcc0c305898c997d51cbc67fba148f072c07c09de7a0d20e8
-
Filesize
1.2MB
MD55da520d527e1612c3500630ffd5639d4
SHA11cba754e15649623f2731eee2d81e0a6cb7e5164
SHA256bc32ed7f3d6d9dc2ceafa055d251f7e28366bd7a9632a32808c44dfc0c0eee3e
SHA51291af0c60cc767e4fe2cbe116d6aa8c9655657e2008545c6eb45fd76cf2d1cd49bec3479ed4d559d2accb1eaeffc5dfb93e842dd3ae75c5d85e93dc819c5c022c
-
Filesize
1.2MB
MD5c8e09d0fc8a672b4d358c3a4a85fd957
SHA1ad4e0daad91e93d1493d8751ffaf27792e519213
SHA256300826a86d3168968a6e1857ddc5b28e5e8f5c81465bd386d63d9944d2d26485
SHA51203565dc9a19c3572d8304d7cf855e8f6b2dadc0c2650d61f0cf1e517cbe9d204efbc58c16442b24472cc97761b4f87ee2fbff87073cdb2ee31e3f99ed768f0b4
-
Filesize
1.3MB
MD5c9c601067d97dbe5c01c5bf12e9fa509
SHA144ae3b1cc78fb646cff2947a4ebac1bb641b7187
SHA25616b14e3eaa87448aac5905ca544e2ebe22d014857c088a17d41c2c61d7e888a2
SHA51280bf74de21ee543fce997f091ff9d1e1269d2955244f36e828c87bfc2c33784d73f1080bff01a0c80db7b2f6c6515b340c212f7e3b572aafbc2436a69f946307
-
Filesize
1.5MB
MD560eb261b25eb85fcce287b53493ed551
SHA17109bca5946a518eb38387fc3ebf411363d7421d
SHA256c9146dddf4bd13395394fa40348a3800b2c7c9b4b7998a091a88b266158156e9
SHA512746047ffa3279dfcaf75f514f0f2c81403173cab7920f56ce260a8899ef8fae74b3ec829064cb47d82c78fda27e4f6283683e58e0f52afb0747f4871caf61b1a
-
Filesize
1.6MB
MD5cddad776aeb70b4586bb63d961aaaec4
SHA110c75877d3e4fcb2423411d44a9211988904aa1f
SHA2567b9771e1b17269c1edc586cf54c2d37f584c7fc95686841bd97b925a35aa87cb
SHA5127895238c22213f5cc7b95448233a7339cbc10698e331e7c407befd3ad038bc7b956efde0e231fb853778c5d24e810832039019d867f8382e1a9f0ec5a3c6ab53
-
Filesize
1.2MB
MD5da61dacbfbe11ba437bc944e2129f19e
SHA1e525dd019b62fcbfbb6b76eb68567546a50c4ae5
SHA256ecc4beb2832375c13b7714dda41b4b2ad7b43b214f57d81e6df93a2bac79268f
SHA512ecc51847f89ca83eb0085e97bd2d1bf8fff93b95692b4b3ec6787b72d64e9d192343d11e4b9c87634929b91ed18a2d1b48bc4ef4d17d4b0fc39c35aeffed531c
-
Filesize
1.2MB
MD5f58a063fb68b52bc573f244602d78ff7
SHA1012785fb12f1f11262670a3821f1b96f2e3616a0
SHA25635962884940645eec83ab3079a21e9d31792b0db501c412b813dc79fa432a053
SHA51274b0664784a0d1b7042cda4c0b00b4dc109cebd79a27d1813afa45212040a4f0eea2fa6e4015cd3632c1d060bd2352677ed911854d359901c8cc5f25957dc8f2
-
Filesize
1.2MB
MD5b942e3895aeef4ebc7f509459b91fd16
SHA1a1dcf4e649e88d906d571ab688d27e5a39d67b75
SHA25652769802d64e8f8e65e80a5f8a0496fbcfb04760918e696fced1525d09845c2d
SHA512f480c3aefa63b7e35c578243fb1d59d03bd1ae6006bc7bf022b344069f59564f31e6735c47c02bbe02c0c6a5606956fcf6298f6c8c5bdbc4b99abd27f0e467ba
-
Filesize
1.2MB
MD519bf2edb6ba8407b6d9eb3f24da8b341
SHA1da76f83066d575a3ca13e2f94217354cb4245882
SHA2568c54e29da23726e06ef2975bd9270da3ffb1e89554fbcdb7e118fd0fd4720d9a
SHA512c4ebc6ebbc69a1a20015dce450905ecf2c7e3bc176c0236b44ee6a67340ded432d71d5375e22c4e4de913caf3a6393802b70aa6c1868c83eafc940bcf18873f6
-
Filesize
1.2MB
MD5925ecc6a90b2ad88649c880fdef039e6
SHA19b7db048e642751c15788844660a6fbf4fe4bda0
SHA2562340714577d33fe3dcb750d8110a6e5705de5bd30352d50d9cd4515ea0e59f1e
SHA5128164126c22a8c0c55d5b2bfd6b181b0aa83127851edd760199405b0c2c155e2e8eb0e15161c269278bf8a8d9a341d9c11d78a478d009c215fd26be0c3757ed62
-
Filesize
1.2MB
MD5c101af7d517f5446e3be28682a5f9fce
SHA143e2b3c5f525c51f9b556d9ee69fba1797b6cab1
SHA256bd969ebd272cb5a6f694023701d965f17b192a1ffa3d946b931a145edd73cdff
SHA5126e1b5494ab9766660f472ec628ff6f0f0e94b63729fa0dbcd56c1aad7b3291f09152e9c566680d7ae1cbd9374ddb5af29d535c61bd33a5110c89a3bc9d571465
-
Filesize
1.2MB
MD50b4b89c6474f5d4ee6d2a1500523ee03
SHA1aba9e6bdb13b764cc53a85c5f0c6865224b3d215
SHA2560dc2c8bb8497602d3ccf233244576322c8df6686bcc5d636a56423195ca64be6
SHA51252e0defea2bdfae0378f719437b367dd94de4ca44ea4f3999d0a5f2e84c6f91729b8bec7e1ef45469f4cdc9ccf7e9eaf2bc7ae2f5997b6f0196278627786100e
-
Filesize
1.2MB
MD57b47d7c6a7250751db05e26935510eb7
SHA1cc7bac13c8e2dd5a81d0958f6e9bc7eb6bc996ff
SHA2564bd3f649a7594f0d22813cce807a85038d7ab8bd6c20b48033114933d7db0d55
SHA51247445ba0df16a4aa758fb4db9a53855e5266564efe47d12fe9bbbcf1b43189d58ef228e77629df0ba484fc7e2ec4991d984b2fc939ea350602a4e9e984f73742
-
Filesize
1.2MB
MD5aa56afe0f3ae42766e68c4711d6835b7
SHA16c350e549f96bc3d621b23e31307976798d080fb
SHA256a19ea0f1b8a1f5a8d28926c03900ddf492cc7b5db3b3edf057a4227aa3bbc36e
SHA512fcc15adfabf8be3b3ef38baadb784fe67cda3465084168177715aa9cac62c62bdee6ac595c2a6ebb97193eb926169ab7794cf6c95f7b16db041f4a2c6cdfed75
-
Filesize
1.2MB
MD59e4d7df474a5ec5260834a9969ce8693
SHA15053f60af3ce0b947d9b054beb98fc0b4e258bf4
SHA256a8f5ada46ce8a0b71b80706b5f5cb68494f5a20c4af0ccf07a0dc1bdb678f64d
SHA512107b193dc2d66caa71ffbb4a75e52defeaa3372d94b0ff6b0533b2c93a8d58abdc13f7d0cdc82f65b8e7d0fe9669b4db68ca3f821183a4605dff9bdbd543732a
-
Filesize
1.2MB
MD5a5767059dafcb71b78d13ee2e5ad460f
SHA136176ae0ab7a1eab11c667bdef82d7e35175ac52
SHA2564c2f268ca358e56d46b90da01cc6f7940273187acc0dfc7b7ede51fb639afb7e
SHA512f434d1c3f69cce0b254e16942745118b821de06d1d1e4df146810b1927121b6a9743aa82704d6f58085e592a105ab749443caaa3a97882cb033be8916cf2bdf9
-
Filesize
1.2MB
MD592c64a067d39f8a77d5132fa46c515d4
SHA1711eca0f0bcef6be64fc1f90b5d2adf3de150a06
SHA256bdb6b31e1e833822296b27a14c064c94c3102ed23ddfbe30fcfc9fae6f30c7da
SHA51249353ec430b18b1e1d8f6b397c591757e27a703d0401b6051c476842381b873a42453bd39d07422ca29799e8b8abc0bf28194980785a819bb5384bb9f91fce90
-
Filesize
1.2MB
MD5f77da29e32c0c008f04cec17817ce21f
SHA1a54c89054ba8837ae36d4379f5f8ac1d7b7ead6e
SHA256921980ebaf2ec6e0451b8a3767deadbb75e3d771cae8b8bf85d94dcd3a8707b1
SHA512a19452d8b3dca703dab54c5ae1558773ee759763766643885372237275ed2ddb8fcddd75f158aec79ca3238ceea23522a93286707e6466d94c20170e3ca4226a
-
Filesize
1.2MB
MD5f1eaa818d0195713db307635541203d2
SHA1359210f9eeee09b94d068cd687bda02d189fe6b9
SHA2569045b24b56439cc7325238ab0d193ca06a60e6fe444ed44523b133096a28b55e
SHA512cf1fe0aebc50e652ccb8f544f710d1077514164301bb7d289030546fbbffd452f7074065d4608792b0f9d2e96582b227f348ac2e0d2e06dcb5907043f5ab625f
-
Filesize
1.2MB
MD5c3e6b96d276a59a509c98543665617c5
SHA15ac8c1b361e22a7b0550d0606678142335ad2c74
SHA256c27e2f4f90116d05262102bb700c633c3406a6fbdaf50cf544c365e4a6eb00a4
SHA512d32ee904bbaae5b0b21f5639ce22dd3e5466b6a733309accf561495f8aa1b6a4413c2e1d746d5f111c827af2fd043290d9b216181df9d2a65074d495f5bde006
-
Filesize
1.2MB
MD51c875e152ee9471f01c6ce51cfa24dbe
SHA14a878ba8350c4649623777816ec4880b6d60f18c
SHA256f5962be4bad0da037e768971ad9e494dc2ff55efb010af1311745538f99fb9be
SHA512a2abd5fefe22b37ec052d504ff55eea6f518da1d718684a1ccaee2228af241d6e0b76ac6b3ac360c33bb1bc19092419142814a0a4facf18c7ded4cd4fca9e499
-
Filesize
1.2MB
MD599bac82e106dd09126b74e5f100640cd
SHA192d0ef6e379bd034bbe0fda78f948710a5966fe2
SHA2565950b740155b7c70174c6ac36fc314bbf2c8be83395a90a4c0ef52495022324e
SHA51258da6b123eb5999d44dc9b0fdc22b99e513e67d94c4e3638ceba16f8ff9db3b6be68963cc01e2fdfc219df7359ce3ca2e777b183e3a7eb320ce3570d6db95667
-
Filesize
1.2MB
MD5138521a28f88a0e52c54df8dfb00a3ee
SHA11faf2b99207f67689b0db4e9afb6915b0a4a36d0
SHA2567ea09ee8109e28c0f90862853baadfb46e27504b2f5a7d7e535c97e6be282bd6
SHA51296d15b1cbda11f3acb46c90ee029a72d2dea5ab9fd2608226d4f18ee2a30a064768cf09dbf30a9a48f202e87eb8fa2f5c731d740008223e251eec237adc2770b
-
Filesize
1.2MB
MD5dc5e374a4aad51746eaf57831a490685
SHA118d047e35e2ca71144cd02f4d0cc4d02f464f942
SHA2563b93b2c13e14d3e4f11d58f6d10e12f043c837f3a4a4c35fbf9b3472dbbdc958
SHA5129972981b4069abe51eef9f7372bddac12fea75e897de75f5241734e76a62c0e868a2f5a9ec2feaeafac17c7e759d676189f876e88b98287010823ebf8b746338
-
Filesize
1.2MB
MD53d506fb5900d9435f2b5ab36a1252987
SHA1b87ac422ed68258f3b9f40c6b8546d006beb42ce
SHA256e716a47c6d75899103087e5c289cdcdd3004d594d9b5f7ccf690f4599b0c2ea2
SHA512ba827e0ba659019e541f4186ef0a00579b95c5e133c4fbfd6b0e07cc2ea339dc8cb35c957d36ef943c982ff83bccaae89fd40a82f6835d44714857fe545fc0f7
-
Filesize
1.2MB
MD5856c68c85d2e52aebdaeaf6def5f0031
SHA1a7abed60503d56015f15b0bf261c311efdfb5e11
SHA2567a64eccbdeb8abb188d0bff9965afd2fe456f79f432dc27afbca7e21bce4f74a
SHA5127cf8ac28e70600e7ec378e76566a3ec235d7f1ba8c4227d5a499b8e975b6a468bfbb54a37168e365ee57703de15418d67fbfefa7ddfb884fa0ca8376c6b95c52
-
Filesize
1.3MB
MD519598af3a81a2b1b96e46dc4640e60b5
SHA1f5389225a738f453106f9707577570a05872d27e
SHA256cbf734fad59450f4a0794b4f58a1838fb4a56ec7dddfd3d39bfc8a2f8e158623
SHA5124399766738f2fc4a5f9bb3458a81b848d94c94d404c06185becd696f68edf640944e1de6083a0ac64f5f38b69085672f929fb0e618d4565a3433f6ebfd6d7762
-
Filesize
1.3MB
MD5457e6c63f791eaf51bdeb89765363158
SHA1c42fb77e624f61c4e1c35214573b89f9a17755ee
SHA2565ff87262b99aa674aef41aa126c12697f03f818758de5858852090ddc261c409
SHA5128e84f8b37db1bab0dead6ea6f108fa8ae32d0ebfbdc9cf3d114d4d2d1719ff5618825ef09ebd23a41484ed7e1c33167ad431372831583dc8a30e71e03e1f24fa
-
Filesize
1.2MB
MD5fe93a8615796fd671f307413bf4874fd
SHA119b90f75243c3a440bc150d56165f661b687bdf9
SHA25616fb2f966a906ae3e2a6f0eb02e2594ad4a5bf9a29f8eb8453c12cc0115b3c49
SHA512d7aec53e9847c961e7a11374c8c56ab6e53797c0810d3289aa7ede12dbfe4ad4e80d876830f1b0046c072050f94395056e1512b0221b765f02e83ec57aaa4ee3
-
Filesize
1.3MB
MD55fae1414b9a5f49e7236965a39203408
SHA185ba79135e94824f938809ff3f5cbf7e50a314f5
SHA256af989975da289ad333a832b2e06fe8e3a23d50e43b9aace314eb8842414ceca9
SHA512429b1321d1ec3bebe5d2bfe93fee4d162d4106b97d5518b87e95ed27d05a6d94d7d60787751c67f4198bdc31721e3f5aead411a0fbf31cd9698d9c7a22276fed
-
Filesize
1.3MB
MD540360557efafb04a8af8933c5b1b3300
SHA1a739ef5a9bf170f9d037816f78e08ba2bad5bbd5
SHA2561c10c4834003e79e94a046b0f4331d32c40f10793d56aed5f5906908b46ec9e2
SHA51267325addb39125efa0df5d55569a2641c7605c9a8c805be166875b0a7437007490304634e89fe0bc1e186008a227be664df19c0cc67065964f31cf58d4f56476