Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 10:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-25_07f6aec8e3a9701421e79d5d56aaf345_bkransomware_karagany.exe
Resource
win7-20240704-en
General
-
Target
2024-07-25_07f6aec8e3a9701421e79d5d56aaf345_bkransomware_karagany.exe
-
Size
1.5MB
-
MD5
07f6aec8e3a9701421e79d5d56aaf345
-
SHA1
87186e0367b627e319014d76146d361fcfaaa203
-
SHA256
5b76f5a1eeda8eedc519a971104f7281fc15ff378940434d4a2f6b2052c487b3
-
SHA512
8e68ccbf1584acf994b786786e775dc32236905b60b3568880603d72f06a71b5a2fa34623ef305eeb3d1371cac9cb0ea2580c33636e1442053dea5a3625add61
-
SSDEEP
12288:HvXk1XGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh6:/k1Wt/sBlDqgZQd6XKtiMJYiPU6
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 5020 alg.exe 472 DiagnosticsHub.StandardCollector.Service.exe 4768 elevation_service.exe 1780 elevation_service.exe 2976 maintenanceservice.exe 4752 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2024-07-25_07f6aec8e3a9701421e79d5d56aaf345_bkransomware_karagany.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4402ffde6c5b9070.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-07-25_07f6aec8e3a9701421e79d5d56aaf345_bkransomware_karagany.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-07-25_07f6aec8e3a9701421e79d5d56aaf345_bkransomware_karagany.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-07-25_07f6aec8e3a9701421e79d5d56aaf345_bkransomware_karagany.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.106\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86687\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_pwa_launcher.exe alg.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-07-25_07f6aec8e3a9701421e79d5d56aaf345_bkransomware_karagany.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 472 DiagnosticsHub.StandardCollector.Service.exe 472 DiagnosticsHub.StandardCollector.Service.exe 472 DiagnosticsHub.StandardCollector.Service.exe 472 DiagnosticsHub.StandardCollector.Service.exe 472 DiagnosticsHub.StandardCollector.Service.exe 472 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1700 2024-07-25_07f6aec8e3a9701421e79d5d56aaf345_bkransomware_karagany.exe Token: SeDebugPrivilege 5020 alg.exe Token: SeDebugPrivilege 5020 alg.exe Token: SeDebugPrivilege 5020 alg.exe Token: SeDebugPrivilege 472 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-25_07f6aec8e3a9701421e79d5d56aaf345_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-25_07f6aec8e3a9701421e79d5d56aaf345_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:472
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4768
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1780
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2976
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD524664fd245a7abe16df7738e325da504
SHA1c79500740f93598ceef17916d11a2879849dc5ab
SHA256c0a03ce7febab6a4705a8f4d5caadfb518bab4646eec5837d4e21c694493e68c
SHA512adb8dbfba7c8c34f8aa40ae2e53c356d7b10346c267f79570c50c58962957e3ab84fd14870484ea25be6ccbcf5579045ac073083c0c348b011fac28bb83d1e54
-
Filesize
1.6MB
MD532055d50e88becb8c1924d6c6b173235
SHA1d30d864e39e351e8ccca7938c3b620bce3f879a1
SHA2564d47db617a6f764d284a48f234479144b53657d395db9439f1bfc92abaad7331
SHA5121c5054b6357ae022997055e9eac47601a3a9f7afac52dfe683f4b487d14ce51038e7fd5f5170383499a5853a945e73253323e789addd9c3a440d42ee009f51d5
-
Filesize
2.0MB
MD55721116aa26c7cbef2ce1c51c3df00db
SHA1106ebf6f0deeb4df0c7680041917256340510157
SHA256588791b3d362d9c8ee60b5aa37c552e99e26744bf2a5123becf5c0c16fd6f48b
SHA5126f28eda5aa161d16a59c13a2a5e56d061ef56bd5495307a115ff94eb206aea0ae81736701d9be8760d47e3c77f42cb44cbaf9596334af407bec5a82e6381c4bf
-
Filesize
1.5MB
MD565d199777cf0b229fbe2102e06efa24e
SHA1243d0d27bcd094b62d86227c6b85af1a0ac5b351
SHA2565d06713eb567bbee5abdd534e54e319b10632482730c31f52b69f8b084c9fe53
SHA5126b7badd80df9500619c362d4852e772e56eb1e6bdc149c6e1d997c211a393ec40a672bc7cabd00c39ae6714106bdcb5c914c76809eaae554f39229c84fce7626
-
Filesize
1.2MB
MD555ade011da361b676558d8ee32258b07
SHA15b5fd0e3e0f6ef7f9d1232f80743fcb90a5ba35a
SHA25695ab0c02d54d61a290e0b1a978a47ff3b6e5b9f0e884dbdcd945acda2a87ae43
SHA51209b168cb8244d19bcc74826d334ac400060d018179219fe094ae012e13a187629c0e6d9d981c337e30d78f78354598c70b52461a53584c2c777d9f105778aede
-
Filesize
1.4MB
MD5877970e517bd6fdb8ce9f7a2b388cc9f
SHA146c4ad8ee4578959dc11da65bdebfa2c46d255c8
SHA256864c922220d9caf317e22f8ea86bd2a2bfc57d324d014a7739b5e637e6e3c10d
SHA512cfbfd7d08524f23b86f85b56f6f0d1e6d34fe76d8e2fa66f24550686da552268ace2dd5e801c6da7d966d08eab41ebec5a4fe087e88ecea417c337251662d8ef
-
Filesize
1.7MB
MD59a61a0d7e685a594275c8d92e23fbb2b
SHA1ab2c7024072146503fd4a1f8de9de35374c795d2
SHA256828a38dc36f28e1afc930918a791f6502d55f2a8e3b5f966110de21131bdc7b2
SHA512129c425d67d5e35a71fa673b16d458bf31cf52dfa67e378762b522895abc692f9a00a13d24f22e93018be8aad98bd47e64170972259d50b663b940c2ee70f5bf
-
Filesize
4.6MB
MD5ce4ced2d76a0650d2f589c86e67b84b3
SHA129e81d559c0eabfc8f86320c5de3e4bacaa883b9
SHA256f9b342c6166b35ac6dbf9f989659dac148e32cf65ade7af50739175d479367bd
SHA51253bbc48107a6d260077a8eb7934235939d1adf19618fe2467200258a328469806cd0426b5f9e1b70e9d4770b89ef9b45355bc3879638040dc3cd79d59f6b59a7
-
Filesize
1.8MB
MD566102512e0a50a0cedee7db33088760a
SHA12462bc2f09a59fd5562a835447b928170e67944b
SHA256342c0f78c558d06768d41db76c7de7407d2430147be32af0bb8dfde7396c09cf
SHA5128eb743976e228f818314dfd34bd13f1698c9af5c140a797c89386aa044d144c86d55903edd867cf7c8d9c87f1f9f1f646faa384942900c98fe54bc160f7dc22d
-
Filesize
24.0MB
MD54c3fa4272993a705281cf56e6a131bed
SHA176f55e49e6c168ca8fefa58d24009ccf1c331e98
SHA256f7eadb9e63c385a017fb5b1b8e1d72dc3f11a031beb855b021563196f0cdcca3
SHA512845e78c3fde7197d657b39db145229bd79bc6fbbeda4a27fc1fc56168153e6a63dac86bec2b5b4ee50d3a982d77d6c79a73a6c825ad62188b0aa1695a90fc351
-
Filesize
2.7MB
MD54cad1ab0e96d3af5b4da820658ae8ec2
SHA1fc960a95b7d95e1e35245c8c1346d1c1d2c2c378
SHA2565d6f6d544d82572829cc0b47d927260ff3b43c27f19283195db144b662a6bca5
SHA5124a96c3e0deae36f2d98ca411445cdabf5e6a02d94b1439d20ef52545ee0914bed6e51808acc8496d7f047ab47b13a68e7968b1a84388c89877753285dde1041d
-
Filesize
1.1MB
MD5ce3e340171801fa3f7ba73a4b2afc6dc
SHA183c23284d3706f569a4c9cc9e2567721414c7abb
SHA256b91648f34cd74c013f1c734ac265212cbfa019f0e9291254f52a7d17d4a798b7
SHA512b08d205c786705ed6496961d6396ae99871fe81994686124fd1bf6a11a24e6d2562dd39206bd0deecd475835b724bc28ea223b8f9ad2c2e615f537b5fc9bac55
-
Filesize
1.7MB
MD5a09c61981b273371bea5f5d049deda2e
SHA1c248c0eaaef7f5b0e1e77acc43f702346b17af99
SHA2560eb9c012a24d04c2d336b407cd6a3402cecd0d3875ee72cfb30621ae2562f2f8
SHA5125e87dca7b9b40d835677f95582871234ac6895270ee876f5bd3e3e07b968466462b26463911e016f9d8d8ba589865ec149febfb391a3ced2779e453f9460e2c8
-
Filesize
1.5MB
MD502abaceaf2b8ea0a015037f84f8d4a0d
SHA15f28bae3d5c9c57b105541c347bbfb0331adcc6e
SHA2564be057c2f1364a65e56218c690b8036c09c71f8b1535a1bd689879a6017da0eb
SHA512874a6c28afbe867fd0b1fbe3fdc640ad17917e67e2589f4928f25e3423e14da8b1e019c7dc6f9e02ddb76c737d0c95e7d60eea8b8cb9521d17fe0b7ea0ecfa7d
-
Filesize
4.6MB
MD5078034dd69c2e27f1aa67777c38cd0f7
SHA19457179ee102cb71a2bb8cc8018164274e32af24
SHA25684e6db71b4f951e06158437c7f65168bb8cd9c31075ac01a8d8fb197962066a5
SHA512cd45378382a93db7615e8c07d19be98ffb25e6f129169faaa836eeeca55561a87381fc5ed649fcb1de54ee076c1f80e95f62cb61b1717bf1fa1fac400bca71e5
-
Filesize
4.6MB
MD57ab9a671fda01bf2a51abe2188ca6000
SHA19596d0f08cc3293b385ab23cba491e2aaed7e07f
SHA2569d6859f8aef1f7212acdd641e171324212c78d4c377cbd3d32b362c29c655dcc
SHA5129b18c45680fe1878e585e854461e5387d4b6626f1b462ba7622189e6c9c3f7cb8ad794496c4f3a2d173df3535e7960d442ad42b6e66e5b04bd2d5b6fd2b10e67
-
Filesize
1.9MB
MD522967672ccfc392343ebda4b968930a1
SHA18ceafa2ff0809f3e1a0fd580f97789a3c1c84d56
SHA2561b8c854f8268cec920ecf0304f930187e2fc56eaf33a1b40a07d5b29bb14c32a
SHA5128ff50f3a8f7f938915d731359e77b8c55d0b762c65c8fd4358e95105c84175b5404aa9ebea0100b2cbca3382cef32817c357087ca987a1d21745b1366c765f61
-
Filesize
2.1MB
MD50187c900ffd1c2634e586b15d9490a4f
SHA1d79171edd0a9ae5361edc6bcd5ed5eb7a5c33876
SHA256ed8bf09729254d9f71dbe11bcb770b25031915fd9f0699ccff1171e731384564
SHA512725dc78d0c84fad2d1ad2e4957a008e3b2b183c019e59da7cec7808e290fc15ce0f38cf6e25bfac82235567b2c3080b5afdd042c6e8cc02db76dbeafe0d9e75d
-
Filesize
1.8MB
MD5f798361ecf89f795b4f6906b215aaee6
SHA1129f8effe4ca6da215954cbebdac8c599f10afb8
SHA256ab7c07c8b4e3d648c9722adc9cce206c1a9b1db59a4e603ece82a73d884db730
SHA5125962d04c62baa9266392365880beea27d1842496d56c5a72fa28a2f84d2bb7877af60e464d8af9523cb6f10c79052f32395afb549b79b4023701b8a32ff3bad2
-
Filesize
1.6MB
MD539bcf2c5f81e026a41b5d08906a89862
SHA1e45eb08e4c580f625ca6d3d2335d079607961127
SHA256ebbdd8f945b66cd0f6797987a7e889f9e0365b58d8028ecee135f2bb64e2a11c
SHA512607c83cbcf316deb151ceae6f3d9332381fb0f3b6f5e830c1afa3f0e4507d3cf66aafe9e84327d31711a17258e749bddf38b2ce8a5df842f2b9bca4d5106710b
-
Filesize
1.4MB
MD5e8f876cb888cabdb57b468ec02665e54
SHA1a468eb4ea2a1c7521df0640814d1b52d9eb15859
SHA256122b15305c999a7d14130629ab8c07c7a953d948959318a4ffb58e9ab517e03b
SHA5121d89f5d5f1000e837ffca2176a4c99dd0f8e59e508d4d1444880d48997729778423498a459dfc2ce68c6c156d76f9d4bcb09d209509ed41d04848a019cc22845
-
Filesize
1.4MB
MD54704ce5bab8b23f4874808186b2137c0
SHA1abd84645faf369ea3e901c7effd6d4067f7c3ad7
SHA2567c87fdf5e6568aa4215de853ea803ffc5bd08dc2d5d78399e6faf1a723821136
SHA512c56822b60e5a657f64f21a36fd2b671880962937d47d8e3ffb771994ad55b0650bafed601dfb2e790de2ac69ec020a4ab7f60906b713a88012d41c773d318778
-
Filesize
1.4MB
MD5454fafd72d8c0a850ee8d5722574d506
SHA1e031ce66e2f5beb9e1fb2629566684eb20316a69
SHA25609a39947ac14fa1a8d7be6ea5bd9dcda2eea4dc7974d369cbb81f2bea11788cd
SHA5128a19e41c1b73a744f52dbf760fc3550a638ba774f0ea9cdf54feeb5b30558cfa402f827eb7b82364ef1eaaa40f3d416c95d533bf329d0a552dcddeb850b11974
-
Filesize
1.5MB
MD564d1cae73693e962331dbc2620e23c4c
SHA1130a6e46243e37d96dc0f07f106bde8b5c59cda2
SHA256bb8f324fcbe622b1a30811d6edd448491a414306486afd0866252e3201dde50f
SHA5129187223d716debb6e682d77e4140023aaa68ee0e5e366d8635958ba1ba3bee6d9ae57ba264fb22dfc46650f43aa290f386f1458c8756a8fa8fb88d1e1dea40bd
-
Filesize
1.4MB
MD5576fe00abb433b5ec63cf252fd0a5972
SHA108c125013652408388ef3fc8864f8c8f7da74fde
SHA2568b352c1ab7e7ecd325ec031161d720334442a6f5aa712a7d865d5f3f81b6029f
SHA512be142868a2f7d720e4fc959ad7dad67b995bd723abda9778182c00a768456a7b686c5408aae2678872e040f97bc0af2341876b6956ed409e0db00228f06373e2
-
Filesize
1.4MB
MD5cbe75934bc2be16be59ef027006089df
SHA1d19d76862a6b0055943872f9800faec50e134fc3
SHA25614a94f8a64b00ded05f179459d6d11d201316ea55217e17b5997a3e22feef204
SHA51200e6adab397b3e56e3cc19cb0c266dba083ac95c56768c50655a2aafc2339eb51e586df92f09757687103bc7131609a2abbfa819210bc2f32756dd3a851c5ba3
-
Filesize
1.4MB
MD5bf1c8da36596055cd06f0a4dcbb81d7f
SHA13209a04c26c7ddc1570e75574064a40631f7326c
SHA25621273e1167d4c6cb4380413bcd6196b44acf04dc29fbbdadc2e963d97c9a9925
SHA512ec2394d793de84d4d4308a1838d3ead12963d155558f1a58bc90d038f74bc95f75e6803cb7aedf68ad3c937c4dfac2d15fcf4bd07f148ad126c98bb75cda2560
-
Filesize
1.7MB
MD5b2867d85735f8661c58ce1b5223cb1ca
SHA1824d808397851a0a198e53b10b0468cb180f6d96
SHA25698781aedb2905d63f8412dece315c017e0451e6631aa7f7509ae5c5c71e399fa
SHA512035c7736bee2a0fda2ab3d1439c2d4b6c0b279ef27adb078fa7df6e65a140f4eb5789237f53187eb88cd98e1dfbf66688798c8454481716cb26a5962652922e0
-
Filesize
1.4MB
MD5d767882c1d29b394185d9de9e6e34cdf
SHA166f5cc6e89121c954c02a3e693114f392e692660
SHA256be794b2f70b9d5fcf2fdae5dabf42184d2b414dd477bda43f9884318147e287c
SHA5122529a9a183f8095e99663207b2f688d6cda5186896997c74f07ad968d3921fb1288d81d0a83c5a62e6d104025f26b947f494ea47abd2f6f41190c4872c6c73c4
-
Filesize
1.4MB
MD59a156ce0e5e0840a88bd6dced9945d87
SHA128a8eb7cd4b28d886193de198268be4863bebc13
SHA256a57617efdd1422faca1bdffa3f88e45c32db9f1ff3534e9467125c13f9bf96e1
SHA5120706e4353ff3460855f9781f7d7a76452c6996cd2c2ca28081e042826ace994b7587f4e6bb92d2553962ab72ec73d0b77784c8244f8d5fa5baf51b903af15960
-
Filesize
1.6MB
MD5d464d1d17f2a8a1e343340756fb86bd9
SHA1f6683c7a14a8d1a5a1b3a971aa9b40f15b79739f
SHA25679255a9b4d8d855640d733d5f83f55bd5c7758cb6676dfea6cfd53167c947a07
SHA512f1237666e9a44d34ad1d56df83c2e345438a545ec3155d17302c33784fdcc220c4f57ef3bff540cff29c228410efa340a3b0a1544131176c4369e0c815a5cd55
-
Filesize
1.4MB
MD50509ce445d654230fa90bf3032d1381a
SHA145e56dd33da4b18332dc1c073330d3cf673b5c4d
SHA25688180bdf74d5d4b140292332e0e7efb532139c60c24aa69989fa3218670b9104
SHA512297f318da50636dabbc03b9c5649580033fd236ba0eba8a19005c1aa4041ad3017cc75befaa904d224ebb69dac9327bff80a3c9c874ab698dba012ee89d0f989
-
Filesize
1.4MB
MD56585791d5dce573befff2b6253919c62
SHA12863cb30dfb9e83b2194afdee12fff60abca1893
SHA2561901624ed7d0437779f889cf01102df7802a1b25297d1af3c45f2d7c0ab1feb3
SHA512f2953cc2404a8aee1b3f061eda64c8b0b7a371bfbdec943e27e86ea098e099d9363edc429e741a84622cffae828daba25c6b10cfc37d5562bd49fb302fa3ec65
-
Filesize
1.6MB
MD5099d31c75086c68bd0905ff08c69f4d5
SHA1921e185c5c4f322572388bf66ffe3bb707c5e80b
SHA25669324f158d4e8e6015610e9b934c7573850883f9ae5da69116e05404ef75d9fd
SHA5124aca06cdb44e33df3a40cf5c0eb3e42b9d67eec67f870cb16cc55d3307cd43ac9a96c74db4b3947e8eb04f2a0cf94111a16b3ed0d474bc43b2562287d731f08b
-
Filesize
1.7MB
MD5ddb98c6885a071f857341a40d135d27c
SHA12037e24b2b59d7ca8faec83801ebe5210371677e
SHA2565fef2c3b7786fda27d7ff533e5c9ce3bd68ed2cb75e4693d6463973cd3e0c1d1
SHA512811f3680409930089027e1f892a12ac2476339fc46a94ba2a668a5f53f853fcb8357e5d8e61cbc7d1c2236db2f531c07f927b377106042700c12b25d22b15bec
-
Filesize
1.9MB
MD52c39169040df06cc267573042844189a
SHA1cde9f27a4b486eeb0cdec5180998a1ea1481e9b1
SHA256c5610ae360dd970596e2412bc6ac754f2f7958ac6cc89069dba77e120429ad59
SHA51273b5c4a7f0ae11f5878c8f1531b4570152399ac60f57d4498faf5e4adeab26653fe03001911fca254d9916e3a31b077e489e91eda662bf2f312305bdf6b793a0
-
Filesize
1.4MB
MD5e1d94aca9701b97f1955c66954a82437
SHA173b17b48404c4a754d8faf2255e19f47f5b3e297
SHA256b84aaeeadff77f323ce8be7ce7c9ee62c8358fcd772b42a2b8aa318c7dd11a3d
SHA512518320d59c5c8940a19d0929ebeb6de1feacb1afd67a6ef32ce7c50494105a4bfccd58051defc60ef324f3cb2e9d94e3ebd63218e86f8bf5a518212517005179
-
Filesize
1.4MB
MD5eafb2c596215e2a649b59fdc45b0b3fb
SHA1713d0801fdb034fce448154b4811ba6b3bc3dc1e
SHA25698c1b0ce56793b9706db2f8c06b825ea8abe647869e9c5947ea87d14dc5050fa
SHA5128d0183fc663ef6529aa92c9e5a01ad3f8b62ca9fa6bfe1520e7b6dabaf1b0aea9e5337b0346f7b75e5f03cb0fd201102ba23309e713b6a2aeb372a98db63a23f
-
Filesize
1.4MB
MD56524ada3bfce94ec8996e3a684c5a4fe
SHA1949208b335d3cceabbf3b511bb934d13ac96eb40
SHA25644fcdfe317dd98a35a381e11fbf72a1cef33e7424bcb10cad79dc84b398fdd5a
SHA512c189017693bb12ee42505265d43f72f2960c9f194a1b3b77f9baec62a60fdf45cb132133fc6f5eadce98e829237a4e416f803a7c212f5c7440c1ba258f566f61
-
Filesize
1.4MB
MD59fd14988ab9137b08cfbb70560852c89
SHA1b70a0fd9d478c504ad06e82365339ddea68f4c0e
SHA2563250b9e7db402ef66106f3cbacdef9f18bf7ce0d511ec48601dd6905bf6cff02
SHA512c2bb75697f19f687b02a3ddb987f6027b7cbe568036f6ef1ad505d479c2dd3373a87bc91f9ff5cef88af65a1352ce4b39e2d4b91d5238ead59a51cde7b1af65f
-
Filesize
1.4MB
MD578c330094036155ca38c94deb7a35fc6
SHA1fc77c1490a33e20a42e1a7cbf1cfce1af0bbaa69
SHA2566f8b1e6c81139d393bcc98363f5eb17dfc3b33700be02fb3a617c230e7995fdd
SHA51257565d30932cc83155e3217e3319d1d603dac540bb4cc817163560397d12eb997f8b735016c66784022dc7c1e2b56d951600a1cf1a792069c8a0d3c8458482c6
-
Filesize
1.4MB
MD5fc98983686da6c0684bc1aae55d19937
SHA18622cf336cd178faf68c1f4ba900a24c5f499907
SHA2569b3f0f1a8c171b416081a565abdf5eab08f45453209b591e2260470c25d58dcd
SHA5122d67d99c8bb226e3c5a86c9fd27cf5330ede2d0973a29e0898ad8c77f1b7581e6301a7e037bd66b4c3f1292d9b18ee58b43da994a6be3e8722415e608588d3cf
-
Filesize
1.4MB
MD5042a0460c79e5f1e21d20a61c132e8fe
SHA138ce9a8b101b210d35823d9075761c2fe140be5b
SHA256fb56d3f3240243ea9d6fde8523f1f5bff4f4da978f7512e443e434e969e17317
SHA512957f13812bb6ce68cf7c1f1b7c6798402b80148f92917c94c40beacafe20124b0cc759cc877133f5403b780aa191355bb98f5289af9891d6cb3ddcadf4feec0c
-
Filesize
1.4MB
MD5d846f3c6f155195f5aa3f8ad8d35739a
SHA1fd82a69be4438d03917d5fba868e364902167afd
SHA256103fdff7fd8e8de83c4cd79f69a173b134b035156df3e9f09b730c1722fbe425
SHA51275984ad82d46fc541561e2db220bd7b3d8f3dde4f71d3116bc7e8fcf5c43ea9c9c7e300b775472a99804d4e7c6b12146779124cb845f3e1e08bfd5901f0b9faf
-
Filesize
1.4MB
MD52566cb8318be6945fa0d1dd66dd19dd7
SHA18e2b313f1f56e80343f2c7764e3b00e376575d2f
SHA256ab6cffdcc786ea49f7b143031e01bf17f1485a52b423bba788d32564c884b907
SHA51287bb45245b90c2914da0f7a17c4d2255667022ec7c2b09716c2e5c7a47d626dce356fe9135cfbd81f3a1bf7eba865b9bc75413de577a64fafd93683febb57d1d
-
Filesize
1.4MB
MD58516d3e1b6814e6a299d587f8bf2be60
SHA1767e1d03a8001bc6a6b65eb6800235f44745d4b7
SHA256c6a7ce149f2e4a9ee0962461242d9dd1eaea5200fbd40a6d9e8973ee77585022
SHA5128110311da6707901c04fd71d8c6a7db0d4afde94d80d68e1b06a1de4680570ad529073bf7186b4ae6d095aa7af87282a4ba62bf0b2a9f22baa937ecde31d7083
-
Filesize
1.4MB
MD57680a12c6fcf24cb7e1e0ba3ba886e2d
SHA1fb648ea5d4d3eaa6ed07569f33540d1ce04387f0
SHA2566831937a22da086ccf16bd7a43bf983387c3400f6f062aebe82e567fe8847574
SHA5127d2aeb631ee3a86ef7826dd8fcda42324e0bbdd9e3766a6e6d83fd9e6bb82ece0f6f6d4062748e0f578a161e201efaffed42af034d1fb5ebd1d228023366f8fa
-
Filesize
1.4MB
MD52e6cc63e03e9450f5147699ff21478b5
SHA1cf3207329f93426e04e212c5d281d0a607b8c148
SHA25613b506e4df2c8bf1d4eaf9f4f1d57bcf1a3c0a1c8b940cfb1af3ed6e34775733
SHA512cf0773c38f2cb1f5db223e4b8f59435e378eae9d4a71b30cdea0c186e4a388126a60584ffe61ff6f777b94424271912c87140dfe1304465daf1b7d14f7519ad9
-
Filesize
1.4MB
MD5a65b2c2d2e64e03948e4933758043c60
SHA1541e53d344708125e6ac7c8621f4051a9764d2d0
SHA256e9c91d00fe11443a0b9a02fbbe8b09f1bcc9f6034beda8973cc7c29ad68dfbd5
SHA51265754f6912fd3fe772c12b1f5e0c1f0de281dd4e705cbbf95bececca097f9812fe70a4c3eb415480e621441cfa8a5bcbe709982c7620b2776c0b9cfe91dca020
-
Filesize
1.4MB
MD54c77511ead5593475b789c6e2800b02f
SHA1c7cf82f8ea397ec30cdad4d7fa1c6c2024214b91
SHA256edc279b5149fd060d88f631ed70c6084b32fcbedbbfb0eb762a53c30b3ca5105
SHA512629208797e2165fe53f19adb54b753adb8d6602d18816cdafb4a3cab6935aa788460a36c9c3d58882714c1492a98b7d5719b34a85a22455c515fa7f2313899b6
-
Filesize
1.4MB
MD5005f93d08eb4e463377fe6d815640a6a
SHA116ae7ece9813881c931572ba8a2248e35706abb9
SHA25627b92aab47848fd3bc65bac1240711becb244221f2cf0bbb341bb3d804acfc4f
SHA512fe292c81d13d6ac4adf1c32acff9ffe439e98f8157f3125abcd57038db037dc8cce593511c00d59e5781e05f86732760f04d98d988f4aeb6a3e1e435c69ae506
-
Filesize
1.4MB
MD5c524c5d05791db99f70211b3ff4071f4
SHA1c5fc59a0d9400b58d5005055b2e28635a2a98646
SHA25641998534cf482b6f97ac6c2952e86174a8334f345cc4de205f550962e7b65b23
SHA5120858d808374f40f057c0e2636044410cf0c1c51adf895fe05244f737a32c2ddbb40794dbd454c4b57d993f094d05a9cc8ad846ea6b0205f9f2733e1f88035a3d
-
Filesize
1.4MB
MD592ec759037017364bcbfec954c2b4617
SHA1c88b0b3418c69d8934e84ee9b790b7ffeeb47a0a
SHA256740f6bee9c81f8caf42128d47fea713e771c8a085e697f1306fd63d93048f2c9
SHA512575f2e3df768365ef38cb2fbc901f02a46a69a7b49ba2f7e3e37207dac1e5e16058c99c3c05523b51d155229ed0985e6ca3ce690b7af6b986d673e96f0ac4325
-
Filesize
1.4MB
MD52a017fdedaebc9230bc9749a1030c6cc
SHA1afb2ba70e76dd74c970a739aafcb5b5725ba10d1
SHA256d19757d0d7b04151bfe49b98ed8aa3870f037e8d4a251cceb05c897d1621571e
SHA512551f6c596f7f7b021c05da14c851c690f7b5376149b94b8d4440eb7a33ac1f190a6a1679f9c34959acad8d288ae06f623a4f2eb323c09e8826ca52f00ea11e1d
-
Filesize
1.4MB
MD5bc4374674cca54a03cc2246ced5e0e5c
SHA17b17bfaf2cd11e678be7336db8063fe1fa2feb8b
SHA256a7e4d820cf58a9d825836b6679b3a5fcb60d8842636595971894fa7f690201bd
SHA5128272e4466ae8d42b396d76be819c3037bb3c296b9077e3ce61e64e327f72b006f4ad031f42c9324bd6af7265ee83b89d49e08e07ed39ee4b185d63f397b47faa
-
Filesize
1.4MB
MD543389e6ac288b963407083eef75c885a
SHA1196e228a98dc839b010262da5d24c5242c8e12d0
SHA256e61cbe64a489eca1f6b6ee16385148748cc238e4d289692535ff7f49018b77c3
SHA5124299fc5fd3cb036c93528cee7e70a5b1ea5eebafeeff80d506260989ce28ad3aac0721557b8af1715d4a4eda281d5681ecf550fcfcea60e602b9828e6d184293
-
Filesize
1.4MB
MD5fcf6105f09dde3563895f841368fee77
SHA12b3bc271c1fe34b51b31b4d48b1fba189264fb7a
SHA2567d5ad1bd5b793359275f24c3c8b0d7fc67c4404d78280c1d4f84e79be742a976
SHA512b4c29f3ad79f4e2bf6948b4472ce4b2f66d7154a4f8bf9140a45c64ecff7ddfa538735ff9f6d150558d79b82ac5cc2ddadb0fce2c964ea6039382836419790d8
-
Filesize
1.4MB
MD55f46472a77625525001b89d50e68d04e
SHA15f5bbd74bbcaf72ef416e83cb4dd677bc29c77e7
SHA256a2b7d3cb88be07df7dc8195a44aa5bc0cb53a5f8804b030dbbce434bd3a99135
SHA512c0bfac87addfccd8b3ac7529ae02604d41ce4bfacc8744e3c23c7c9cc1eb98e257e5cd137d13c2dd592d2b6edf38d425e62aed7233e7a1703f932e4183ea823f
-
Filesize
1.4MB
MD536e68e4c2f692671a8e63c08baca5fca
SHA12a3e0d8404be65834c3b51bd30161c16ba22f8ca
SHA25632bf068b54f0f8940e36852f3cdb11bac5148fbc8e9203a2d7bcb6d6f530cb80
SHA512d9c18b26fcb4506898884fc5eecb08a4ff0605268e2fb60daaf20692f2ba38cc29c238b46a9241b4d2de3fdd19f132d34ae36cca6afce632fc6912371f6df03c
-
Filesize
1.6MB
MD572cb374be30d4d07f35c89e76420ed4f
SHA17e8713da002620dcf49b8624053d89154c25fee9
SHA256ba427165c1db70bd2536dadc9f6010d6a242c9881ddd278ca6548797ffb57824
SHA512b9a4f2d01725366703eca286f0b8a0cdd99a9e59c97dc3352a45c6775db20c81c7d352d02aa5e28441c7db60f121b5b99ce49aa902a296b85dfe03d86acb6280
-
Filesize
1.5MB
MD53571a29bc9d6461c41647b7d0e78a57d
SHA12b40d7a40b1481507dcf2e4fff3533cbdc98aa8c
SHA256d52bba122118e5afa349b8707e63e5a8c12d926959ff74570887a73069843b44
SHA5120bc21001276dd3f366c1e105dd6e952587381e707c88eb687238db1226ba000f316d117aa36372252850ff9a860366369210068f4a4b6257013dcabbd5d05e35
-
Filesize
1.5MB
MD5f7e635e39f9ba6aa55365bd60ae05d1f
SHA120d863d189b8cc7fcf60550135df160bd560842b
SHA25676f5c831c3eb5eff687e309357b7ccc2e32a71820597a9a3d34fd99365669cb5
SHA512fa99d20eb33e530ce09f5d680073fdcb71e058cda79fd9fe9e8bfa21956f67ac73b737565e5abf1de51f71f40bf59ab788bcd74d7c365975d90d34b1449136e4
-
Filesize
1.3MB
MD5e44ac53a90552a656dc6e65e89721eba
SHA1bf51f920934d8abe071cd6949fdd6ae8aedb84a2
SHA256ab55126379b69c3d0b9326b0a78aa63f94c9017ba837cbdedea6899f6af5133e
SHA512202e34134470bf2746d7302e3b579c73ec668696bf128bd25f0c14f2042967be295adb3e01cdca1ffd78db7d7985522460e759524b17908659b3203b645b403a