Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 16:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-05_514ec755f6d19f108dd3a4476b445e25_bkransomware_karagany.exe
Resource
win7-20240704-en
General
-
Target
2024-07-05_514ec755f6d19f108dd3a4476b445e25_bkransomware_karagany.exe
-
Size
677KB
-
MD5
514ec755f6d19f108dd3a4476b445e25
-
SHA1
15a7f0907681798b8f44c7713a7dd95f55c78fe7
-
SHA256
e725408041f1790affab60e9c453c07d0595728fc909c5fb37cee78358afcc45
-
SHA512
fe5ce4046a42d52fe36e084000f8f248207359759a17e934f7a1d1516089de4bb19e56f107dc2d65ddf8109e472777fcdfa424ee54b675fe0031fa1c314410a1
-
SSDEEP
12288:OvXk1HgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:yk1H7ozX0j52pMkuLoiSJVlIL29mhNq6
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1820 alg.exe 3148 DiagnosticsHub.StandardCollector.Service.exe 4752 fxssvc.exe 2032 elevation_service.exe 2360 elevation_service.exe 4068 maintenanceservice.exe 2392 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2024-07-05_514ec755f6d19f108dd3a4476b445e25_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-07-05_514ec755f6d19f108dd3a4476b445e25_bkransomware_karagany.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-07-05_514ec755f6d19f108dd3a4476b445e25_bkransomware_karagany.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-07-05_514ec755f6d19f108dd3a4476b445e25_bkransomware_karagany.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8f66cef916be280c.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-07-05_514ec755f6d19f108dd3a4476b445e25_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_94843\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_94843\java.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{14FEA263-4012-4197-B537-102BAA8CB016}\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3148 DiagnosticsHub.StandardCollector.Service.exe 3148 DiagnosticsHub.StandardCollector.Service.exe 3148 DiagnosticsHub.StandardCollector.Service.exe 3148 DiagnosticsHub.StandardCollector.Service.exe 3148 DiagnosticsHub.StandardCollector.Service.exe 3148 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2456 2024-07-05_514ec755f6d19f108dd3a4476b445e25_bkransomware_karagany.exe Token: SeAuditPrivilege 4752 fxssvc.exe Token: SeDebugPrivilege 1820 alg.exe Token: SeDebugPrivilege 1820 alg.exe Token: SeDebugPrivilege 1820 alg.exe Token: SeDebugPrivilege 3148 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-05_514ec755f6d19f108dd3a4476b445e25_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-05_514ec755f6d19f108dd3a4476b445e25_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3148
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4860
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4752
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2032
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2360
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4068
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD51e64930919b61987152c5a3506ac9e3b
SHA13c657a80e48986df6c1f76a5fcd2e4b3f657392b
SHA256246c067c76f5ed343a31d4207b1f4a6d46029ddc5c3cfc7d05ad0673953025ea
SHA5124a232122369d99f90ce2612aa3614cdb68ec5231e990890d37ce40bc1f1b3a5ae40a3ba40c36e5b71b734aeb3afe3f1dceb43254a2dfa4bd96e2d2bcf8392a9e
-
Filesize
797KB
MD5b7d02feae9621400e3a16469e2db429c
SHA1660d8197777f877e67d67aca800b922fa5df7d3e
SHA256fabdbff30a1faa3178af67f0f91cde9346262bf55484142b49503f4ea9887e31
SHA512d9404b55c406b53a44e9e715460538de7b882237153bade828d3bb444d33664134d037cc644eb5658ebc54ab30b6d1a44f4b6746d85f4b6857981b68ca722b5b
-
Filesize
1.1MB
MD57bcfdc6c70aefa253867320e2e0b7ad3
SHA125cd1297b018bfb3d15980450a5fa1c7a9542a8f
SHA2564c8452335605c2174a4555b98a4655df256c018c1a59328a98c4c9147053e3bc
SHA51203f617125451f0feffa90a9edecdcdac28bce5611645bba5b33c601d4190c40b16ff9b298c8b4669354126800824307a071cf1d8566172e7e2b83d5a819c4b36
-
Filesize
1.5MB
MD5ea9fb0a8a6d16a4dbfc904ec81320d10
SHA135b02dd62a6e1ee21a453f3db42be75440b74d89
SHA256c776b29a959fbe62514f1be76174cd3482174f5d53e137f54e85cc30ec97b863
SHA512ad1de37f2932dee0e301f946ec96813137965ca8b3b3f3089002186e7153938e25dd26870fb161e53124aec7c7690e2347161f44a1abcd2b3142a584ceb78023
-
Filesize
1.2MB
MD533464d15284272abee6481eafe4834ed
SHA1cb951791f4131c727fb9d8a9e36b5ceacd01e042
SHA256b0d10bbb34d1e5d143fd73e9029a4bf8c82dc1815e41aa6a63bdb743e5cf739b
SHA5128db6faaa0076048a831c4add685f85e7f50527b0fc73848fcbc9c46de66a45e0ff27b5f5f2d6819597e0ccc05868b1cb5dff17d2104f58b0d2c37502f1c4b412
-
Filesize
582KB
MD5da596f736d4dd078b6edaf08b2c32ba4
SHA1df7abeae9f2c2d6f9dee060805e61cf236399903
SHA2565b7fdd50552bd1a43961434bfb3ded0e1530c961183f3efe59f94c3eaca3fcad
SHA51294496e61a274e43985fa541c877d335271d6c9f37b85403f9e0db816f625cd523eb752b545e544f21e2d4e34bafdb81618222753f826ec41e29d075af9f0ebc9
-
Filesize
840KB
MD51fcb3edc8fc26c4a588623813f1a290e
SHA1990b7e8e30ac4fad8e3bf1a716eb196b63ec3f51
SHA2565731606f392e195e590ad4d68b4a2367375d67f3bd7d96ee892beee163ddf8c3
SHA512e81f15a73bb9c936ef1feacd9fe3d0bbe2f4a804fd2d8615959781f9ac3fb07051254bc40c09a69aab8cb2b59d591bab0425faf4bcb3172145df44c783ff4c63
-
Filesize
4.6MB
MD5a1e88cbad678bb9e4e0a44afbe7cb3bd
SHA1451de59f8547ee6d2158cd004f0d120c9bf90f62
SHA256fa7ec19d1b0e392a3288388643f7d54455a9af93417a760060dcefe176fb3210
SHA51265e3f7f4c2b2f60230fc0dbdb51bd44cc6a356ec1d9a8c083263a85031ee2f12ffbb120002900d39ce0dfcae0520ae7c61eab295f32cbe378d8b381d7a6f8a16
-
Filesize
910KB
MD50104cc1ebaad93c5b78d36fc1b649dbd
SHA1a9fab0b7f0a2beb364ad4ce75dc00d8fbca36906
SHA256141c88fb67098c2171e2c5a6cace971ec111f2901330306be7a861284ad252d5
SHA512e32d6ffb43ce9b7158b1a7d9ea0efa5177abf40b3e7332d6b74c16ab935e6c95949947a6218d350e6a2b58cfcd61d564a1e51cf77480974ca809d3f5caea7d19
-
Filesize
24.0MB
MD576c807a29497db5856c6c939fb2d4b5a
SHA1776fb3d716fcf3aa064c00b613a86ce9e1a937be
SHA2562ccf7fb0e402e7e99a8d2044e2de87b3fdae4ed298fecd5b4639d8ada3a5b6e0
SHA512f8c722b228eddf1619762539720f76f337cc8b6a9b8a31111c270e8c76e328afa191209c57d567482a3eabb0f7292fdbc6b4fc9cdf94e5daf1e2d073aa2bc067
-
Filesize
2.7MB
MD51552a802c4f533e0733e44d2149d2808
SHA16816c1386f59b3633d9c93d11207046d69083983
SHA256f2e1c11f728370d68693b35195124625edcb4dd5f4b802c46398a4b9d7823205
SHA5121e442061321b409efdaac0a7cdf5cc5f287d48c975fa3e6960be43572d9eda59f0d258e08ffa62dfa27c5c6aa9ecd55507ac26117a9713fc8b0ea1582e77aa93
-
Filesize
1.1MB
MD52e52019608cd1448de7b9a8a0768c587
SHA13cf807fa5a94c294b1ca83445c15e3a32e6f2830
SHA25615833da93d98b9565aeb688814d800cfaf45d75ba837a955a17ef830d32eebbc
SHA512780e4d94efa8129b041bce09476c23a6d6e03c42b60839417068f15f14e853007790eb73006098c5e5d858ededc25d174f25d7521700f2dccddf2596062f23f7
-
Filesize
805KB
MD55680f7016956d8b95165c2dbcde62c7c
SHA19431608904d5ccae746acb88632d3bc29fda31b8
SHA256f30125b09b4ce88677eccc8ceb49756b55caeec4032658f01c17fb5078e79e86
SHA512666e4095f9c67aa3137df20c9fb81c189f2bf23cf2796195c057d90f0bc821bd54aa2735afff842336ecd2148c41606d48acdb2f7c2090690944e940a14f21b3
-
Filesize
656KB
MD5e177fdeacb6f22748d2ae37deea2480e
SHA150e61fde4cc3407381b039b83415091d10a11568
SHA256ac943ac536b04ebec1af4f94af3df7b9c7d0ff10b9b8d413a9ff587e9f96162b
SHA51287982c36e58e0a5d47360e05e5a74dd09a9c16afe2c846ee28eb65bc6ca43498758e63e24048713a0dfe601eb7330d0e4d55c35536b5462214e1a2e4cf95ea2b
-
Filesize
5.4MB
MD5944a5913272cee0645b8432c1c5d8800
SHA1e7987b7d59892f2cc2d5744e29f9c428a59fef6e
SHA2568cb35709512e5a2789c6681079c3ce8108b429870e835e83bd1bd5c946201632
SHA512b096fd89aff5321f517eb4295df08f3dbb243869e384d0740a9188b73da8543ea590219b3a7e1febd06c7852266070b33ba2f75e4f690cbed14f50364dbe695b
-
Filesize
5.4MB
MD5e8dc0a1dcba03f24dcac5d5bd437f8c4
SHA19687e3ed2051410360127dc1dd06db148bb2c9c5
SHA256961bcf90e25382629af8c4c46bdcb80f0896d84a356636913eb95e4840aa16e5
SHA51273e3f55b69f97b84cf51629c46900503ffd53fdf674704a9e41310230d2c0f9a33295ee6c0d314569ec96d516a5f034b7ec053c0277b545d9e4a9a29cceb7482
-
Filesize
2.0MB
MD5db81fa96acdf83aa7010c0f737441b56
SHA1930bc3281b40272ceea338207670ab91dff5a5ef
SHA2564e81e1445e28ff11687748ece06ff1d5b0886758b31621b67dbffe1743b72648
SHA5129c6b936fd5ecb6bd6b68977854592324eac21d4af56f203ff16e3e4630addd1552ae057449582edc05eb0c9d39220d70e223486adb8a346a8cb521c6b1996adc
-
Filesize
2.2MB
MD5742fe4302c9a29e9c0d6b2f3927f4393
SHA15dab0e9f9a65f3864d1e506972d1be74aea131de
SHA256db3261a7c3818ffb02b2917b1a088c34eeeb0c4cdea87bccf4939b4805a74db6
SHA51233b06b86585bd44015f9de9c3cb7212a48850fc8c26c4b6af37e7c4325a9e41e4a0b6d45c8a31159e38d3184d666e91e0ad17595f7d2b15b22cf33333e142d1f
-
Filesize
1.8MB
MD5907e93d8e59c8407bc2676226171bcef
SHA1ffdc1a4a22f58875fd10bdf39ef27ebeb34c1e9a
SHA256fae2b853d2a0bac6c71b8f320dfca8ab9ebcbaed5c7d06aeca2d6ed0140f8cc7
SHA512cc468c394ea83f2d037a0207da2f72359c934cf191e506101be2c84d125c6634b64932adee2a4a38fa126783936e41817f41e7850eda5c78d39876bdf266af95
-
Filesize
1.7MB
MD54c8c860f33a38dc5f05e89a30c041622
SHA16579ad3489440db3bcd0eec48a941f5ae3e7c99d
SHA256c8af56bd60cd382193cd01e97a76182c126ac6dacca938e507810db4c823ecd5
SHA5123fd0b301b38334a68d054f9d8ea3ab734afbbe76638df14c891959ece38d119ec40230351d84afa1f1ab378cf4fb7d7369d77cd28fc01b2545df2f15dc8df4e5
-
Filesize
581KB
MD5728576a382ceed549675affc058688d5
SHA1102ce26d6b080c4b383e9f777677e014b9a4db20
SHA256a9bbbafeee06d7b3951ce871761a1f1336575677af55c0589fb31544e34e9f12
SHA51220cb3143e96df932fd12f99d15de1a7273f9841c29de88b41278b3b7e3e3247e5a90b9a4b4d041f6d6147ea5735ff8f533b842440c22b86ad404efe4726fdad1
-
Filesize
581KB
MD578b6be76226f850ac0ae9d004fcc5d3c
SHA1a2f6e77699849cd6d4979e5b97977ae7805a4c0f
SHA256624083f59758df0a4d97ddcd638ff3c5eedd0b9115878cef52f2a3466323687f
SHA51262051de1e89b1473a870ef296907f207b1619dc1d82a3e1ec656b3ba78c429cc98040bf472556937de56178b75e1781a3f8f32b39455fefa0fdb3801a7cc03b4
-
Filesize
581KB
MD5b84f3d6094d3cd08b0eedf99299a1b34
SHA14739155b320d6ffae36c962963996ee8e3b81a6f
SHA256f5bde9d69a7c43cbc7158b9b54b61a77f79687e1651d067080cedd8f6b8b43fa
SHA512418244f86919aa42a0733e2f6ffae324f934c6a7fb37f30f02d223d13fb344c7dfab2c15d4bd936705c9e5748ed1b0d73e10a3d371e8b08eb1161a754d383639
-
Filesize
601KB
MD59840af8b9e297c584f95ed44e955c3de
SHA183f4e10d39bda4da802ef8283bb61864144f6e8a
SHA256ec7fde81e1d0e3a2e9f49cc9960388e87b5d2aebdd91e49d31aa559ed144ac70
SHA512560fab60029acdb81839f094b37261da72c8117ed9dfd69e59909741a8067814f5817c8933b6b65df7747b9bdbe312f75023b0e9946da9d8ec4447f70e0739b0
-
Filesize
581KB
MD5eef6ab4c7ed5d0f61de68dbbd7d93bd7
SHA1fca2511a536e3425b4fb8943a197c0a372f58128
SHA25652b7638c13ee190fe68f96146e6220762d19b3fbe2bf6fa5934e805b22563be5
SHA5124b7163c4cd8d2803a771c47c51b6b20d3d297f3b9922b319b55464096a15fa25f40196869091abed8c9f6cc85e3cc3e3ea661930f29c715074670fb5d054fd9f
-
Filesize
581KB
MD5970d60f6bd6355a6e1ca339cc4d082fb
SHA1af2086becf034e67946d58cf4894264cd357c7b6
SHA256012dc2403808fb363269ee48821e42c823813fc2c689df530e0ee805cfe8756c
SHA512e8e83e7fff57bd884f708c01af7c8e799618751cadac967c61e4b436180af00304284d5eb0b07bc1df6ea421c10b6e6f25cae28d1477fda417b660d90453575d
-
Filesize
581KB
MD530766d42abdcdd98d9cb416baf9eb264
SHA13513fea737e77c14f9d05a970b5689229069eb30
SHA256fd7e29de85064bc527acb07c80066161c44b2140082851aaa8bc78502f5e0d0b
SHA512d2679707665c7ef61bff3ace81dd09395a416bf96c31dff77cd46d054bb23ff247c1852a8e343462d41f0aa252e2c1275d6f51c4f0022fa27cdd78ee444b79c7
-
Filesize
841KB
MD56d1ae60db6cfd65e58ade6d15a651217
SHA1b6dd551c9c2246cef62a3c4c0e8e161fa94920d5
SHA256e904ef2d07c797abeaeafb7d4707bdfd30a86ca52578be19474c6e81f772aa43
SHA5129a29696b20f71758774f2467a953beef5ece816807bda230023c2183f0b281dc7351b478bd2a6f5e6954ca36006d2365b3dcc4510aeee6fea2778d25b74141a8
-
Filesize
581KB
MD523c59d44543fce50f39c93c8b734c834
SHA1c42a9e64184bc18cc38ceb5b52cb0bb4676eb95b
SHA2565dc4333fcb530a39cbbb5082484fcf408b4f2b620f4ce38e128192254f213d89
SHA512838a357ed00e869d897c3182806b97948e1ea5ffc7711934a7c7c7c81bfa7b513dfd0dfc71cfb4ae0b22f1060e026cc8064c1f498eb9f0048f12568f3b4da6dd
-
Filesize
581KB
MD5a0ede842b954ec5dae9699493555beb4
SHA1f31bfe156b32fd37806f7470a48e2545596bce45
SHA256ce471bf849e2570e938a5000c6e6f1ec0bab5b2f5150f05f51d70d5107fe7887
SHA512558c9cd3bafad5e09bb82dd3a7735175005af2f1f6e8d40ba24befafa843ab28eead9701c706ef4d4ec7ea2f563d6e420c62f3928b14a4959fd575b4bcebc51e
-
Filesize
581KB
MD543e730b5bbd0e83fa471106dfd716e9f
SHA1019d6155a86dbd3e78e0cdbd6297df758146073e
SHA256aeae4f706795dbcdc908fcb10a9213b0e9034c843ccbe7328da1b9bb0a73cec7
SHA512953353d9b97585ab9afc00235f9f335bd5e918f0e3bb17cca85a33073c3d56926edc88a276b2299b97eb2cac3f8ba85843ff6483c053bac38d9963de3236c281
-
Filesize
581KB
MD5819b03406d669189c523dc1e649784ce
SHA1d06fd18e8ee4fbb493dff5cb07b602f9f5426117
SHA256a557fcb4a4e776937b15fd8f22639264ebbcf3ea76a59733e6a6f5c295701924
SHA512f925d4321c442472ba12d6d75d198ef1e11edf525f135bfaa6c3fb0b4a49294646282ed632e406e6883a637c9f62e366a1885218000a58fbd51fb9b84520f88a
-
Filesize
717KB
MD532fd50a802a044b5a8fd4234c156e0f8
SHA12ba213679417e0fbfde1ff2ec1d99b69f8f10b52
SHA256e73dd78daad4deea30127143bb04971f7e414bf843c20e31155bd99ef7f0cb58
SHA512b85891ef61c6d22c45a50aa74f6738722d01077e4fcd1f20d51e29a8712c4cddb56e25bd056d3a2cfc9985e7a69275ab60d76733a394dd706bee5ff61499d962
-
Filesize
841KB
MD51cb44fb80bb99b91cd1a008020002f87
SHA1de798be6e31629ee1083995a4e50b8c0cacf04c5
SHA256614e875da89c91bbfc74945486a419b748a6fb1c80563fc2f4cd48a56742a134
SHA51288c0f5f25f2a696d173a8934750dd223e188b779ba40b8a36af85973385a746c8d71c89d0449eb3f48308cb156e1d18716cad3e5586de0a8760c9873b187f576
-
Filesize
1020KB
MD51a984ae0687463dd31b436377064a42a
SHA10534cec609bb95b11731b4cb73a5657bb4b146d8
SHA25647cc592dce8f166acc0fb7afbe17de42f31c94c424a11b82c34b1ec30b4c8e66
SHA5126421b5c066ba01bfcb2dc2b11811a66bf3b9a8d53d6b10559592ec2522a112a745b759fe0ceb6ec021236aa26ccdb1afa873a05a908275bf929090c944a58436
-
Filesize
581KB
MD56860b4b72c943511e7c62971b09c683f
SHA12e7db6c0e34f2bf444421f43e73a9a77170674bc
SHA256d4da83c3ac3b1244f67a4f13853c8e70527d747dbaa482e427fa841b21f78bca
SHA5129a7109f747cd2885a4d99327b65526f33bb5141c0d093e38b36519178173ddc43a01bcc1bf2e29041e515fa9d0109baca7402f1fb9703ce45c82a982d5923923
-
Filesize
581KB
MD550fb587f6bc927966247a75f26528040
SHA120884698863eaeb6ffcab885a78945453f9d11d7
SHA256910e4dfdcf5593611e5e5e7f3c7f2136fccb3eca877eb8f325826cfafaf00e52
SHA51286bbaed130f34e66685dfa3d993212894c105cc95b835f1b1b8ed2e26ad438df6bd0f4951d730bde82aeaccde5f458fbbfb4fe89d2a467da5f305885f1957b77
-
Filesize
581KB
MD5db6816f5717f6ac2e3233ff83cf7d30e
SHA193e7ee52f6b8218f8967ecd4749116e1c6be5514
SHA256dcfc39f19ea0cd95c33b54efcb18ed94b69fc6bbc14335d814b37040d4613097
SHA512917562ac7034903eeff12c09618d46045e689355a7a349bc23d938a2b707a40bbe530a28e0648c7ee0f5d87da108eb3c291cc6cadd0bc2f85ac8ad77ed87ed73
-
Filesize
581KB
MD5ca9a65da19f1bcb1b1707c10d84c604b
SHA13a53fc92dc1838ce4aadf8374876d3d0a314adbc
SHA256bdfd52a56ecb18971e229c0d4b3042d096db1f50698dd7ac685ad074b57e4014
SHA512e4d8a743214614cbd2382f56ef47bfeff65932c2b3b69db3af6b0b88bccfec1f830ed423514da40357e64b33bb261c68ce99f617229a55c7aa5d6687a7b7f3a7
-
Filesize
581KB
MD58a186372314d7ec3d8b33cd161b28123
SHA1e3bc43041fa5084a3b2630fcb765bc053d22912d
SHA2561f17b31777b1265f33b0ce13465bbea5c4d9eeeb6aebdf758577ba0913edfc30
SHA512eefcd857984683edb55867c124cba8ff2f9c604122100811637ba21ac2b4ce5c026f36c02e08e911e3452ed979ae5759b146a0460aed825e51f0c6bc8f6ac01f
-
Filesize
581KB
MD5bea7d82cfbae80ea9069c5628d5a92fd
SHA1db5ddebf0773e03af600a9db54061e132d2325b6
SHA256a9b7cba73598ef3fd2ce23a0bc1f4cb5ec311bb4283615d71cf2bc58bc71141d
SHA51295eecbac8fd729d7dfbd9dda1bc0d5cd2e0ea8286d9556908d687510023a30dfe029a0c3b0f812f6b09a1666ee583680887341b60b68325d7f8bc3ee2dcdf0c6
-
Filesize
581KB
MD54e09b298b97239a367a1db42e3ca7064
SHA1d105c5e7c5d2b43075a20c55f98f0090a61deaf2
SHA256eb4a3f15aff682f922c85649ac5c90a90eaf5aa721449a7045a4e7664843637b
SHA512c54ba34a7c497260bc68af537c78059e9a898efa0becca18ac0c03fd428959029702541257bab108ca42411e377be74a6ed2b60d785ed908b7f60dfa5d817822
-
Filesize
581KB
MD517985b4ba9c313547bec1ed92becd4bf
SHA124d6e7a648af532bb06d832bcef5e7abe5a052cb
SHA2567792e1d38439f8d1f108c9557ad8bae009855e2b05359c8fa67d001397de898c
SHA512c5be61eb67f809188466a733685a48afdcad13979cfaf2f0c22f34aaaeb115edb30a200dca05c85086339e02a5744329242e82b8b0c2863b90b1b0cee1a6c3d8
-
Filesize
581KB
MD5a0138d55405c8fc66e0d9e8473e69297
SHA14a54fb04d4767070b01b19e959432b4f637ea110
SHA256bafda3ea930e03e6a0c31fe673bd5d4b314134aa1b2f7d10592e60252089d805
SHA5122d58f2b5d1fd930ea13e01e7482319e995c8c33645e551134fd2b1a1480d0df3fec0a32dd7e49d15191a9f36f0a1cb3b1b1edffe1bdf13a9e9c87d412dee55ff
-
Filesize
581KB
MD5ab648b59e5314fefceb65ab655e872a9
SHA1625dd3c1565bd9eb295d0811d2b63d48bbd5cb77
SHA256f6c7239e91db5fbcd29f194aca689597ea0e36edd2ae969821e8d965369254ea
SHA5121c22c462ed4e954b33b9a1833ef558d0b364d3da3fc94ceecb5d2b0b4f006346e5ccf04b5a06b8e6bcc987d726fedb166e24d835a673ed2bbe1dbbafe19aab67
-
Filesize
581KB
MD5f12459d4c02cfe959b635653103e97a4
SHA1521f1c1f4d8209e52a8e1ae527bed2c8985e0724
SHA256260cf47b210ccb4d60cd5cad63d77e3eb5053e83b2ed8e168bc387f3f2626d7d
SHA512883cd1287727d60d2e5bb638636c8877148f7eb3d7623e52b62db33420b1d68556090f9f51186da967f0e6b81ea5d72a418df84337aad2f188e1ed3fa896844d
-
Filesize
581KB
MD561f2b9b93451bf1a122053724de6ac42
SHA1b7f963e0150d4e0a5dfe5809a59650d7e652205a
SHA256de89215fbde0d71a4b39b6ce1cead1e086986a0b85f7de0ac262c720b884ddae
SHA51295d172d8a22be2f379263c070e4971328ee23de9ff0e0e3f69a9cdaed4613adb68f555f07d4c88588722940f2243972581315feae486c16b18f1878c6bf9313b
-
Filesize
581KB
MD503e1186b7cc27463bf1b03b3d3283d69
SHA11c5c641bf12046ce106afac8dd8e9e520968209e
SHA2564fe7008fb64c6129df7b7335f7c8a5eff6d3826b9fc9d3949c7c3ec6973dda97
SHA512185daf6fd2c761bd1529221cc0d15e197a8c87ed3a41182edebeb042d3fc33c74043515bfd4f2489c3cbfa5994e40786a55cf324719272f7458df6c66aa8de11
-
Filesize
581KB
MD51810d04e33ec4cdcabc3c69c7b844e94
SHA1a946a62f9aa4ad24ee1f9ae33956e0fabfd47016
SHA2562f4ed12b16438211a76ef05c254738a6b78d64f25ae58f63493c2915abb5d136
SHA512f36699c4f533bf855034ffbaf42bb2aaed3ec57f75846000abad0b45036f46add43e36f9bcc3ab25587033e38b325a674736b0de10a2f733866efdde59d6e766
-
Filesize
581KB
MD5c7ac96e09407a45194868cdd2009ecb8
SHA17fea540483e9a3dd5d4cb3cc3277993b4fb49a4c
SHA25667c13c25e2513f648e704004728f3f6743ee526debbef7bd09f72cd709fb9674
SHA51241725305bc5eed17c6f06f969a06e7a3494ebe64ef60c4a2c2aa6c28f64fe22c03e0b61057efbb14dbd599fe471bc5e808834d9eeede9e2e1f6c70ba512b683e
-
Filesize
581KB
MD5a4dcb963cf4078c104b6d372c2d787bb
SHA1a1c4c5de36eac0cf021401e3c0379d9f946cd2fd
SHA256b1de34a808f47cfcf2962a6acc9d7b3afd70996ee12044ae20add165ff9fc392
SHA512767409a4a197c24609864f6263fe55cd53738819a9e5527885262d61e5353d22a20bb78d48ad4537ba76a64ab75e833e7215ef127cb4677f91e75e71b3b9ea22
-
Filesize
581KB
MD5254d34acf838ad040d2ae93459f5e8fd
SHA19daece66053881e51bbd4df33fd8a81c6be7c3a1
SHA2564ffd71a25b614428aeb5326d24e0bdd3b4cf53ed735ea56f08dc305318167373
SHA5126169fd4f452e50bdf75fef05aebd06c8b03673bb3ea7782c36a028f5b858ddd456fbacc367acc2e4042f6bc0c5cf5dd89e61332a3cf46f24a877a1cc17d2a9ee
-
Filesize
581KB
MD5a4ada765d3c507210b483480b3af5990
SHA122f141cfb69634fcf884041a4aa80195dfb997d4
SHA256a82928813ca05b178e974b6ede32bf786ab545c257e08cea15e5a1dbb9ade27a
SHA512ba63c174c2f12d18cb377808bad5c443aa6db4d2d733e37ed57bbefe54860f12f9a06a0e909c78bd3c4812635316e24455229a5a052e992aa64be9ba55fc87ee
-
Filesize
581KB
MD5f7714ed903755a29908f589c05edfc35
SHA1afae70400c94a7d13f147b566dee5e89c1ef3504
SHA256db44f5cd8e8f527762015ec9d5754c9ddd9fe94117d6841f91d7b4b1611da4aa
SHA512da2e45c2390e954c2fd28316c5af1db508f1e49cb48f668bf635cbf2e3b91b96cb9397a8b77ec9be618c7ddf5209a8645ec8ab849e0227b6dc468ba654907b28
-
Filesize
581KB
MD54a03967e341b8528c9567ca0a5cee004
SHA113293203af68a0b44948e5d8bbe8de1a27470aed
SHA256c55c44001607da00edba64041f5100b40951828aeccf9e14a8fd76f510f57ba1
SHA512e58099166319df9895f491b5a693fcdb0840ab221c1a071d004ef5a471f480d2b0f08b08d8fbabc9abd88992b05a3bbbc88aede703feb98cd83bb5bdae6ac5ff
-
Filesize
581KB
MD5cc6abfe27e310234de167fe091e54070
SHA160ae9221c93a8dd8923a4b1220b89cca0ba9132f
SHA256b259b837201b04db33c98fdd1d8984c7f7ba3a399b9603be1160498e833bbacc
SHA512126edcd796b4419e2f9e7d3b468c6ebdc8054b2a3129f1d07ce6714860b335a9e12ad73d1d9b987e46adbeac6128548b15f1ae66ff4a38fbc6af395efcd4c202
-
Filesize
701KB
MD54545d3bf578dce3225e57af2fb7b08ce
SHA1c51bca5993d3d211fd52b45acb18152c54b50652
SHA256ca62cb109c5f518551958871e72a6fbfb32b6f1591bf913757550f1816bf848e
SHA512b7f69faa9c3ee276548800bbef768a59d49d0bc2007ad95ab9a2e70ee4092040bac1f9c5d3052861afae3135fa8f5071392449ccd1715312e15996a4bc3fa146
-
Filesize
659KB
MD5f956c035cb7b5654f804798d00f4e480
SHA14b2ac6a2eb5a16c969a2e7be894983194bdb0830
SHA2564d603ed5fe212d04e7ac95000bbae15c35cdc6393782b317523686441758c6c0
SHA5124f20c2726c7c92edca5351f8859799b0fb2dbcd6e2ac4249aa2a113b26b36f355df652aadc8e1c43f89e0867cf3bd62ff0a6fca0eff79c191977d65c855ad0ca
-
Filesize
1.2MB
MD53fe5745853ace7e7a08e9385a55d5caf
SHA1c8fdafa7fd8fbc2105eac295a0e8cb254b6a7853
SHA256c7be894bc8c093ed207440f1fb2a35c5347278f57e14666671d6a2ac1799ff83
SHA5125a021692101dcf15da622e4de3130ea14dca77e088f04307bcf5e2c453c235780a326923621effe95333d6a74d62d3db2779928c0fe3ea89b12929cbb8bd2e79
-
Filesize
661KB
MD5e442a1adf0ec68a79369563300ebeafa
SHA118f04a0a32531e6c6e0730d3bf3950a65453c4fa
SHA2566094f8163165854f593aba8bbefa8a5a1abf78830197f926eca110c73d4727d8
SHA512cbecfc1e86095b8b579f58fd2b48f76a3d47f3c238299710c9162c9e787a744379b778ed0635d8410cde45b04572411d18d941ae01e6b038de284d4f56d13dfa
-
Filesize
1.3MB
MD51d279a501ab52c0c590fbae3ac1481c2
SHA15df718a03009f301b6eb3daea3c694cf472090bb
SHA25632997660f51bfd7afd9a16caa026359f5a251f12dfb566dc84707c7b73e0e47b
SHA5121f8e48cdf4b8b2584549e04f9c3dca8c6f570387b80ef829cff0cef73cfc6d279d2628e96ff147c426058b0eb4ca69d302c109e93d8fccfa646e9ed866155eff