Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/08/2024, 00:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-10_b11db1402768d21421f8fc6ab5bce503_bkransomware.exe
Resource
win7-20240708-en
General
-
Target
2024-08-10_b11db1402768d21421f8fc6ab5bce503_bkransomware.exe
-
Size
1.6MB
-
MD5
b11db1402768d21421f8fc6ab5bce503
-
SHA1
e747c5fecf06ef62d9943d628c8ccbdcaec17864
-
SHA256
06ef60cb94c91dc098e065321045bd5197b30764132b7edafc2fff2c165c9674
-
SHA512
186c7987bad27b4a9fade4b96fbfe2bab761d6001126aef2f22173349038cd7c0239a98240ed7dd7cf510734b0171f88064f55f0ef70106b12057e142f1fa763
-
SSDEEP
24576:K3n/i63ibxVirnlBUKZ408vTZrX+lgdW:KX/iMuiLlBUKubZrX+ld
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3744 alg.exe 3700 DiagnosticsHub.StandardCollector.Service.exe 524 elevation_service.exe 4196 elevation_service.exe 1372 maintenanceservice.exe 2296 OSE.EXE 640 fxssvc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\9aa2ca382dbdc151.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-08-10_b11db1402768d21421f8fc6ab5bce503_bkransomware.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-08-10_b11db1402768d21421f8fc6ab5bce503_bkransomware.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-08-10_b11db1402768d21421f8fc6ab5bce503_bkransomware.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-08-10_b11db1402768d21421f8fc6ab5bce503_bkransomware.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-08-10_b11db1402768d21421f8fc6ab5bce503_bkransomware.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_81359\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-10_b11db1402768d21421f8fc6ab5bce503_bkransomware.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3700 DiagnosticsHub.StandardCollector.Service.exe 3700 DiagnosticsHub.StandardCollector.Service.exe 3700 DiagnosticsHub.StandardCollector.Service.exe 3700 DiagnosticsHub.StandardCollector.Service.exe 3700 DiagnosticsHub.StandardCollector.Service.exe 3700 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 264 2024-08-10_b11db1402768d21421f8fc6ab5bce503_bkransomware.exe Token: SeDebugPrivilege 3744 alg.exe Token: SeDebugPrivilege 3744 alg.exe Token: SeDebugPrivilege 3744 alg.exe Token: SeAuditPrivilege 640 fxssvc.exe Token: SeDebugPrivilege 3700 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 264 2024-08-10_b11db1402768d21421f8fc6ab5bce503_bkransomware.exe 264 2024-08-10_b11db1402768d21421f8fc6ab5bce503_bkransomware.exe 264 2024-08-10_b11db1402768d21421f8fc6ab5bce503_bkransomware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-10_b11db1402768d21421f8fc6ab5bce503_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-10_b11db1402768d21421f8fc6ab5bce503_bkransomware.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:264
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3744
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3700
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
PID:524
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4196
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1372
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2296
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4760
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD53653c51fe0c94414302544d35af219b9
SHA1a64825d5c54c9128e91b47b00a3262792a66adcc
SHA256ec5fd58d16c1ac8528c7486fe64400355fcf53a1284574b3405e5d8486910115
SHA512bf82a34bd43eb992bc7d0d9686bfcc549b7db7a91a22a41cce8cc73b600a837fdaec4e75b620f4cd46671584cfbe880dcd774fba311769e0d6cef9d88de5a040
-
Filesize
1.4MB
MD53d5f577d6961ae532543ddd1aff6fb66
SHA12ddba57131b238d06de9afbb0da04b3848dcd268
SHA256cee83209f798dc6ad1e5af8b7c7532ad9381d20595d97f65232784b8c9b15bb3
SHA512ceeb8b0d65b12adbbc7cca7ef4c99d16145b3a3b4e159e0bf396f1e78f49e57ba88bdfa1b9ccfe6d91b3848b98a639a7248601364b72e8a2e912ec67745fe0bb
-
Filesize
1.7MB
MD50b69f30a53719e9cff7f4d9b39d4f96c
SHA14293d6da47bf2923f1a50894aa7b361dc46a3051
SHA256ecd88467bebeb9abd02f597a755d5aa5c3b006af8cde33c728e215d5a2707d66
SHA512d830b560336aeb6b8e3b2a366d9bc0f7ac794bc80e93cbe8a5eb061114b9e9c0d211eac69ddf09caece6ab4d5b7eede56577cc8477962e137bfe1c23b269d2b5
-
Filesize
1.5MB
MD52f0cb114c450de1bdf8f5608860ed9b2
SHA11eb73d9b26581c99a870be859120f96b2e27b592
SHA256eba56bd5d33f80e22feba3cd7f4bc2b7286d61f9a496f46a8f51550fe79f731f
SHA5125b163a890b47ef37d2574d12c31ff7ce170725cf013d86b5f43752d87c8bf783844ad5e974e9f752c31239b9c70d30bc2095f55882527e3e9fb647ba6bba6cae
-
Filesize
1.2MB
MD5f90243ea004a06494399de2a291517dd
SHA1a70049a694025f97f10970774ae77c867cfda966
SHA2560cca97a9ca31533504a02c09ba5980ddfab0fdf7854e7d5da122a90970ead0f3
SHA512a21f766f0da5556219ec0ceda1f091e922b29dbd5b08ed29f8c6976f7ab40b3f996e3b45a4281ee095c29365823b28e0f28cb09ec81a41ff6e201ea489ff64c5
-
Filesize
1.2MB
MD535f77bbe8c16ffee1f8e7b711555fb3b
SHA1a323a4a44bbf178a6ee12e08b980eba3f72415c8
SHA25615d80fc8561a8dfe7fd60376632b20792c7e1d3cea110752e5861adfa8ec1622
SHA5122bd70b4dee6fbf70ec611dc3f1a6ee5766b3f73a3475f3a165e89c670b692142bb36ec4575aec5e725a8cfa54121cfe645a3730d9f4d9f448ea86a497ff5ee8a
-
Filesize
1.4MB
MD52bedd7d220d953473fbce57aec6dbdd8
SHA19c30773ff9649048298381d6b8badc390f216b91
SHA2562b58ed43d629148efcaaa3539a87a50b912c2d88e0427511aa9ab40df2fb0bf3
SHA5127b5bf0eb5cf83d26821d1b852674ae7b9987ae3b7c38ae15ca41f1009f11521133b590d57237c66e761cd04d1134971bab64b7471e6d8d826efc83a9b07c730a
-
Filesize
4.6MB
MD587dd647dd8246194718a492f73f02ebe
SHA1b99c769861808cacc58f36a50a66ca04a0eae375
SHA256106afa7f486e4aef5c96945a8a014f2c0033f6c4312f4210cee28acce43d805f
SHA512c443073f924accf62869cd5a542d84d158c9708ea4449e722a2a8c2e5569ba2a74a82a5d75e5e92a9554f679250a3572785721641fdfd801a03ae37928f93efc
-
Filesize
1.5MB
MD5d835f9be1b43c97a829da95716d4fd15
SHA18b08be2d9fa9c0720ba399e74050fcd99b5677f4
SHA256da383cb5bd4dde996179ec75df8658281d512ffec3ebca0d31c465337a280fa6
SHA512287efc9d278e00259c4334b7f954d6803e40617c66c5d45ea3d06a497473d97298764344b7820acab1a7ef9e06636f16589857a9f78fc1687f1862972b7cbc89
-
Filesize
24.0MB
MD54d722c6e8be41a4705100495eaefdf33
SHA1fbd254aef6e7cea87e0c7b06bdef502f5bbf16e0
SHA2569b96d0f32ca25457676950062773b7b5351daaa041cbf87dbc5305b6cb02a5be
SHA51253746b29e6357facc6188ce0aad16833363f8560166a4084eb588dbdc3a8d8622d8cd9580ad688a3ed02921a8354f8aeaac15e9405284382f7a60cab39d0a097
-
Filesize
2.7MB
MD54b754c8d3afe3454d017d9bbdded48dc
SHA1a5d98ec71d166fa0d3884d937f04bb1bef94bc0c
SHA256ef5b6c06fa11335f458035c7373e624e8743c37880b79ff6d6e46947ed4d854e
SHA512e77c7cf9c0451a37d9917bd453b7459a0b4ee38682b87ce54c90c2ff162d08e99f067fe1b40168bf028f634f9d6a7e121eb7d8dd87eab69ecb4523c842bdcdcc
-
Filesize
1.1MB
MD5cb62425b2eb2f97a4f846118eca3cc12
SHA1da2e9e5ab759b3f89def1426eeed0a7185ed8007
SHA2563751bd051eb60705e0e12d602ae9d14be0b67b2fbaedb534207372bca7dd6057
SHA5125a096f9f8076abf92057c0b2fb1be136bc47415a49f77124378b85fdb4582f48e06670bbb9948d85aef08ab98b2419de17ef707b9ca592364bfa29b03f365f83
-
Filesize
1.4MB
MD535db744ebe5be31959d97dcf7d20304b
SHA129156b31895984b4331399f37a516aed5323a819
SHA25675274f2569c39d6243ae6818d7ffa38ccb236c1e8165e5c01388dd75d29a73ae
SHA512554a6aed303f104997657370a8bad6f32c68707710b8692d76d198d1a1ac7961c86c9329abf026ce77a2bc14253cff118fe7e4e91d65a000b44be10b9e363138
-
Filesize
1.3MB
MD5f959bf8a6c30f743812ec79a844a71a5
SHA1c36dea5cdb3ab679b0107fdae5a7d8fbb0a3640d
SHA25695223a9cfbbc3fe1e994831c5fec3e594b9cc98805a4e8b357326f96cc131e74
SHA5128bcebcbbbbc2ea2ac91d646c68ce3b74da3cf9a605d931f34ee1f5255e944fb2169b7bcc5c6c76e15507a4edcbb7b639ccd83d1f40cd8701f8e9479e0eb548c9
-
Filesize
4.6MB
MD507574a7c560e5a9bb9ba910853ed7713
SHA1691b9a825a59f8080ccd1a608983da1680922bc7
SHA2568de2bbdc67a160da59b3b105bfa9a6b93bcc112b1728d26834ed71321bb03eb3
SHA512ddee81f76c9ae52d178a00692473d7f5844f5f3c26e7f74a1d0ceaa7c9d726bcfa6bb27658b91a75a8508aa15708eded3aaeb1eae20c9a563b15973fe4adc351
-
Filesize
4.6MB
MD5d3ecedf8fcb9b75359b56f39ef1a1679
SHA13f489caa64abca320f0e681e251b0116a8f76288
SHA256e75e0abc86b75793ffd84aa03bac95d5742715862ba5203ee6440fccff09f5fd
SHA512a341265f0452f73b30ff24bfe5fa128ce496389e223d901c35f2403084902b2a17182a7129bdb1fe6f8404ffcb2cfb81a729d5e9de92117223ed5dd9ef2d5a72
-
Filesize
1.9MB
MD576d6ff48d47219b5842f0805c46dd75f
SHA19588fea29d0fb799869053571a079e3b06c5be00
SHA256018ae319c55cc57fa78cc001c15b80190193fda50cc36bccb217b67d746ecdf1
SHA5124eaf970c2b15c72a2b50028d433e32e1765568877355488e921f5e4f8d4ce7a6cd2097ab58cd62b07533433c5fb988384cf2a38a64162cf22d519b98e9074990
-
Filesize
2.1MB
MD57ab51d571e73d0461f6f134d78df04f3
SHA16424336026ed30464ce5bf6fae6caf258456f705
SHA2560dfee8d65e1bb306453055a0bc45483ad2205d5490b811bc258195bd83dfecee
SHA51292468da588bd7085bdb9e6c964c231c607686025f7fd6ac9d118a06b5e730684d370c93058936f7b15286ed126b4733f77d5ea7fd059a93dd24737c0908e0e34
-
Filesize
1.8MB
MD5afda7d59251938eed7dfcd443038c1f5
SHA1ede18b1113533654444a83bec1e9b7c344a89ebb
SHA2560ed1e57c9d4c2f1957295c17ec200db5eb1b91e1c26808abf7fc25194a73d109
SHA512ea0e5057f38e6c13795c31c96b039489ce5c61a7296ae90c66c68c76ea5c53ff523facf466e49df00ac1382a6bf9c6b495bad49bf778207885555399b326e38d
-
Filesize
1.6MB
MD5b0363784f101dad9d806823d97e612b0
SHA1c36d73b9d99056073a5c3b87fa005ba054afff9d
SHA25656437b9053385e5e53fd35afa4239b6a594c06672c0f57b4b53ec5d73eeb7e8f
SHA512565104169c5be53c0acdeb58b4cefc72c6e8c7eb9d71928a82ef889dfa41bff4cd41214c3ac89b8a9640bbe8d3a133a0e0c2c204e2e1511e0b4e816d6275c460
-
Filesize
1.2MB
MD59a472796d3e69a924c3ca33639bdb618
SHA1783b7cda61b8fc438df9986650db7265f1467316
SHA256222368f8e07e3cd986a52530ac1704fbc3b410da3bcbd76da3ae4d0addcba920
SHA512ee4260f594e994546abe5ac314012cf0cb437c58a3313e3af14b7affac65594d5720fc3b65e9e6edef984045cbae7b4acb5cab775475d99cc211047dd43c936a
-
Filesize
1.2MB
MD5ac564a1f56825869c612cc8aa9e0e3bf
SHA1a6e96d3a6d8b46d74f49a6f0c728a8376ae22d42
SHA2563cd08e50306ddc060823feef2314e4d799080bbff5bc60caf1e8cf602beaef27
SHA51219a6205ae4927e614f5190ef16930e775aeb11d950ede618e3a44879bf9c364c2c9a6c98992a30bda3456000dbfdf95ee27d86286191b4dfa10dbfa7cae43db3
-
Filesize
1.2MB
MD57d2d5745f66696a2bd62646bbfdaae6f
SHA1c3807a8dc97b5919572d2260ace4b17f6dea0901
SHA256f1a26b5b989d520fe9dc817d9cccdc3be346e50add1449427ac5fe3b9d5885d6
SHA512059a879fafd8700e9fb892bb5e3f67c81de365940b8a92f6d1d992e42db8e768f8db7f432de6e22e1dd1cf796a0d328770a981cf4166bae766e0411bc2f4c41d
-
Filesize
1.2MB
MD50560600c6165d57dba01a96022cbd2e7
SHA18d533aa90859a63ff87a42486de7da0b8df2eed3
SHA256185c2dce45198a338a826b3d596e00ed783920e2035735c1b4d9b34721702e06
SHA512c781cce31776eb21f3a74632cb93557376d046796e5c28b582df637ed979f77fb5da9c0cad89dcee8563eb252e5302c9f007f51178b032293a54aa2b7170a33a
-
Filesize
1.2MB
MD507334827cf0d27b6ab21c03ba7e1ed35
SHA17e9628a8ba71651cd3aad9b32dbd02ce5959d6f3
SHA256e797282cf6b1ad05cb9ed8ae98f38b969cf1c0b7aaaf14b79d3d0da42d700ced
SHA5124fff2b464d9290aa9c33c0816d108926c4309fc28e4f5688a4e3df715bc858be08bc8018e53281002111da54c80cbde5bdfec239e0c60d8b3a5bb240491805fb
-
Filesize
1.2MB
MD57f32b9dceb6cf1f85985558088e57b9d
SHA146e1d93dc3df2a717257194b9e11ebdf07020f1c
SHA256a354d3b2d181bbfcee4f0e564ca0c4f63ae1fa5969500dab99f642a49c4aeb50
SHA512d39f2dfae3e50d80760119961c4112ed91495a68b2c751e83ea23f19557569006bb0d4a4ae165b7dbb5ac8808795f3cc9cf08d9cdfbae370260a2a9930e94eb8
-
Filesize
1.2MB
MD5d0f2a2e3cc02201ed74073d7d3bc2999
SHA1c1b95c714bf495f9846fcfea5462350f8f3d1984
SHA25684cc55ec01da796c5f49b1869ffc1502aa901875fe367bd0c33edc87391eb83a
SHA512bae928cb14cdb7ac4f917fe70dd2d99756a4df1301c7163d772e3023ec1237e488b5ebeeb42e436859aab32cd843bc47bbdac1a7541589e9d104b22b11481002
-
Filesize
1.4MB
MD52b6fdcfffb0ed9831c6b69001cd0912f
SHA1eec85eb9672315996be0998a9de0b9cc44f71ca1
SHA25639a11cc0bbd290c8bae995197d8c98de0a85613cb371d80927778d16871749a8
SHA51298d34cbde721c6b2c0ad222ecb00238d1957bea6ca353b10f62407189cf44cc9c78a21dc32cde85778eccf181c19570c7f163e0c1573c73209a3781f48cc9ba2
-
Filesize
1.2MB
MD5f5f2a3fb4f33a8e27bc417037e4e0232
SHA197972dd266c83ddad0dda4d3422d81de1496d8e6
SHA256a48ce8813d4042958ecf7b9768aca98a5ab361b86e561b9a08f626b40ddb2050
SHA512fdc06d0d96171df25cb54a9357221dd2fef4eddbe9f507f16ef320407a004655126bf5720278e592451c56eea1976e4a75b748b5e1f6107d56db8a009afa7bfa
-
Filesize
1.2MB
MD5045683ade01980c8e4e8ad3026ca1de6
SHA188158b6750f68cb4c5ed3bb4bd9f73722e5934c1
SHA256cf6d18808792b8a9967a79504db6dbca80a03911b12573a32de7342ca068ab0f
SHA512dd229bdaad360524c2b79086ec74f9dde673a6495bd9369731b8f6469a4ae8dd5fa13ed30ef31c2f94949fad2222c92aaa4bebf6d3f6f97fe19610bb983bd366
-
Filesize
1.3MB
MD516908e4e3b730c8ed72010b199e40c3f
SHA16fc133d74c01c68795478ea13dcfb72c208eea5b
SHA256cc9334262f64c4ccf3e2c4a461be95fe27195fd3db2a86c274748f9224772f02
SHA512547a803d7314924f66ff219110ce34c484e85fae9d610b8977f2e8e1165f2294eb9c6d0b4599a538216486aad534eee0f4cb868a666401fe228f6151eb6296a2
-
Filesize
1.2MB
MD51b9f4a63a364059198d482f2e7e0dabe
SHA1476df60cfec9daa8acd0c4f21f5077df92be3679
SHA25641fc5e15732e5b77cc4cde20f02ce0c70a6e9d2e40b91c1a93c13b37f1e0b701
SHA51223dfc3ccd9a54f2899432f0fc72ab4440bac46ccb003307e1d6fd9165ab3e815302aca7971afc7c6675daaad1c365ef90dee91df8cb284f327b202a6502e3f95
-
Filesize
1.2MB
MD55c4efb0cc4fd8f6a0011364d7140ddcb
SHA1cabd6522470b80a23fb36c1cfd878739b44fa53d
SHA25684c36b3ab975cb4a581d74ceff162e53c55d21320e889c63a29eb4c5634dceb2
SHA512137dd3e09085cffbb76f23dc4cbba7d76344e518b237b273a4b895925927a7cdaa65280f25498010f8b5e2633c1fd2de87c50ca552d1b61ac1b96947cf429cd8
-
Filesize
1.3MB
MD56a6965d900a0cda4bf2dc7dadad0c1e6
SHA1ec0fe0981787f1f0ac02d8df5fdb10aa438653a1
SHA2562b9e3f1d8313b91df2c03af0d4457e583f1c19fbb20e6e9f1dfcd9209933da3b
SHA512256bfd3db42a037e1db1f88c53aeb1d0814c49c9873cbfafa9643c5e45106aacd8fbb45aaae4511fe1729fc07b6bdc33e2934807ae0bbe4417cb3039d75910aa
-
Filesize
1.4MB
MD5db0d09ee158453abfb3d79f2d59703d7
SHA1d19d7a2a5eca78d031f8d5bfa18d1a03339b2950
SHA2560dce18e05632eb78bc5538d468c0ce54933f814bd196d0b80580826573d60927
SHA51298ad53f41d1aa96a9342769887b5dae82e863d966cc9cf8473a9668e2a176e9ec5a26e69299b34b136859500b340f15fab111dcb464b1dbc61822633a4a7e580
-
Filesize
1.6MB
MD53ecc325cd519eace63b93c7ade2ed97b
SHA118ff34a4632096bbc69ae62eb896f70f00be8844
SHA256fc18c4f129162a9f88030c35f708d385f8e9629e241fa1a920de25415103e4ee
SHA5126696f5aff6401125b58bba8070b07989be9a4dcec6a2766968f25d9fc0af76beb2f42fea41387d6905ab34db4ab6e2dbd3c7e8cbea66d6deec56c83324dfd4ed
-
Filesize
1.2MB
MD5941404f4288055e1136bd2b8355f5642
SHA18d00fcee2c9b71485134d08d11c4cedf520329f9
SHA256a29dcd65bc4b1d818561323811b6734a4129eaac9fb0a4883f14e428c5ed2266
SHA51233622d9d237a25cf128bac25a71986dc7c63d5e3af25efd1c7d2cde50d9023d8d82e4a00f1417468eda67abdd9ab6023ec57530699584076d901949f9a9c6314
-
Filesize
1.2MB
MD55f3eb6192ab5f68884a2f9a6616b3a67
SHA1bc6b613d502003d9f279cb0eb060e4e8d56f7e12
SHA2561d97a486bf3ccb6da64af717313c470435c8c02a503ac0f503a9ce853e5585a4
SHA5123b25289fe717e045c2818a17609ad6235d3ec7634032cbaf96648f3f16f00be7e1dbf3cd1a67541b2c8a7b35ca0a8db2d2d86d7df96874da374d9c0ceaeb0485
-
Filesize
1.2MB
MD5beb5812e5fe55f32eebad8ef0f1c2d5a
SHA18356172e84f65226646930a49ef7056982f5e688
SHA2563cacea9e9cbe6be5316b74dd94987a64918f536aaf9c5843a76c159531062a01
SHA512d425e871bd8383d03da09a923fa576c72ef978880f602a6badd2e7f2db81b5cff12be70bd050c8b977ed52cf760701840e452571ce20dd1cb36a004202d38281
-
Filesize
1.2MB
MD55b570e3467c8b268d351dbae23a05d0f
SHA1c2d1f63dfe637f783b6c549b863343e44dd55673
SHA25674de1fe05582f78a0b83a472bc1cadc4c69219dd3147ffa09b1bf2d6e25a0c79
SHA5123c42f7541f97b87e6926632bd5ec18ee762c9fe92f37a4f7efb1280d3bda3263652527cec8890e2e860e6083bcccc80319a787384b873cdbd8587170d0451dd8
-
Filesize
1.2MB
MD5b729a529c02ac4b9f0238aae81ab7b00
SHA1fef2d972a932e491d923e936c92f4a35db696d54
SHA25614429de6c0b25a709491310a4a250341d3c7b7fb341b8ce33970f5bf040787bd
SHA512c97cc41db795840bc8b29fa36138de9fae07c38132d0035e84fd46db2a600e4c5f8ab6a052928d2791a94cd37115bd4bbbea593ca6050f7e9ca2756af7f33f93
-
Filesize
1.2MB
MD5e4de4fd24334588fd2b79970cda88767
SHA1f3810af527d4b445b80a319567dce06bad480047
SHA256f303fff6e09fe334296353baa9a15d43e05c1148c01585a90856b7f04c9e9fd2
SHA512d554faf4e035d29a656ab2ffd7fff916b9e1ade03a449b089215a42506f6980a3bb926d603f75b6606787c3490d6b52949ab841ce6c85a91e80dec5ee34395cd
-
Filesize
1.2MB
MD5bc883374f0f6b3fc43deb25249751f9c
SHA1a86b4bc0e1c6c9464fa9ae3f417a1f05bbe6047d
SHA2564713f804381fd54942e1e8ee784afdac1eb89784882133f1e8a3db9eac93bc10
SHA5125af757f96e55d2eeb4cc465951f04c15bfbbf122c83a35cb2224d12b2f48dde7b29491d9f512b84fc1c355bec2d18ca6279274af451d26f46b50b209b22f4376
-
Filesize
1.2MB
MD50338332f296d8babcc8b330eb72e8adc
SHA10dacf7539cebe7a9753783eb7ab7efb442d062e7
SHA256a2589ac573b8f4a87da2f604f94120b44d29ee1941838d410d6e43db4f1ac3f3
SHA5120de0a2a47e9cdad6d03a638b7de7cabeabbe557cf3e64bcad0b1ab7b938ed33227e08dfc5022c4567a87cd9a1dceefaae40fa8c6992817e3a645a8e3b62d63c1
-
Filesize
1.2MB
MD576199fca16a51737428f981feab36372
SHA1e54d7a69a665043e0083a6aaf6ac21c5e07a5e01
SHA25684cd534a6fcc3ac68a371f38b0291579ec8d6cb7b2e5f873e0d4a4a793704119
SHA5128c632b445e647d92f697a33dcba63ed9432bd23236c1bc62b980f8aa07788c8e8edccfa06878732cc868c229ed6bf9415bc3ec73a56ce84d475a284c8fc9be40
-
Filesize
1.2MB
MD55d1e2c15d812419ac758754c5e6f199c
SHA18c8342105c5df2f7a3a8df1e25dcae52b0f931fc
SHA2568b68b41cde5022182a90f5b218fc580ea3241a958d13b90e13ad0e3959895ac4
SHA512ec820ebf14d8ffe08b1793b3cd4cefce9c2edda0b5434623d8dc52662203dbc1d4ceef5df5a9f56a1c851bc66e8f082d1893f84a61e59a7c8039d1fef8bd9b45
-
Filesize
1.2MB
MD5722680791fcda2266f3f77104acbfce1
SHA128edfbcac8c94bed5d2dc81703073906cd1a89db
SHA25655ecdad537650102ee089982835db25c0466f28c6968aede9d8b6bae45c06555
SHA51237520cf62ec2a78019e1e517b0773a17878e564f4eca0fe9985bfd6b09b2a27dbe53255d411c78f625001c439921b761b129fb10cdbf5bc0e5a0a446b5d953ee
-
Filesize
1.2MB
MD5b8a0bfe07d4a7f4deb87fae871b3a290
SHA1176fdefb48a8f1fde3323ef9c890da0939c134ef
SHA2567f0d1d621506d5b6bbc562de798b77830907a399bbb00d4ff826af4a984c8f89
SHA512fd8758a8392220462840e407926010d263f3df5f945e0fbaa2daeb706c8c1f40dc429edce6db116ae1a3cfc423b499e07e5aec987b112b0fc31d9e87a950e83c
-
Filesize
1.2MB
MD58d600e7d608e84b14b1ee44a03248563
SHA15610e46b6db25561b49ac2da97873be03b2cebd2
SHA25691841bd77de85a85f02600a59130c06bf39e26ef997eddd1666510611ea6a1de
SHA512027a063f0a92080d7639a2e5c5b7b8822aee7db4bcee57475d8d12fa25c76a5faf6b4808183ff633bad660302db1901636a9e15476a93a0c59a859a2bbe93e2f
-
Filesize
1.2MB
MD5698c4f51695f9187c17c0cc2ad85369c
SHA185524a115be9a90be8cacc950781fb33d1d89269
SHA2562de3ff433b821c621f5fa6ea3fc4e495a4cdf621b00b1c3f163cfc9eb52b775d
SHA512d3241a3374abb9338de7fbb530df43f21897c56b95a03ad57aee2726b58c0f51647c035d13c4b02f8243c36a638ab27f8fabf482b39864c59353fd90f0bb8736
-
Filesize
1.2MB
MD5982ebba161903f6ad200244438d2bad9
SHA1bd75453a32506a03ada804077d6260474efdec36
SHA256b1e4a6a0317d7c2615eaf287cf3903ec7141fcac05e67e110c04fc334dfdbc7f
SHA5123a0bde65b41253434af094cac045d741d899861a89577e3330c7c0d601016c40d282a477b4cac429ca5876d977db42613dbd1e9c318fe9bb3ff96b57d5987d43
-
Filesize
1.2MB
MD5ebca61dac8d94aa9bce6db543217d1da
SHA1b1191f47fa117bc813b065779a414054f326eb26
SHA2567480bfd8dfc6ae24915c98181eea3f9ecd4ac2860b0f9693c6c5c354497918fc
SHA51255a086ca83af864b3b90a65e54a5dbe90bec6409392d6501259f2ad49eca83f88a71ac3a8eccde9a05e48a8b5552da243a88ead2dcb6c3689c6edf5288b10b8a
-
Filesize
1.2MB
MD57f05cdc80ec5347a9806b1552cbb8683
SHA129d65c1d2f690c05296f94b0e223a8f32fa04625
SHA2566e207fb519b9e221b443d34fa85224454ae7deb96c766403103e12d3ae3f647b
SHA512a38f05c8653f73a2360977d0a93228011a733aca4302a94dd9ce85f4722bbb6d6270a843c607f7f2d0df961b212827f9377e63049efe3b494245574ec6826fad
-
Filesize
1.2MB
MD5d598b29c4dd986f4fa239781f5270683
SHA12480d75050bad3bcd12ce85abf3076e9a5e70b5e
SHA2566292501d6b4ac77d793833c5631762bf14349b62dd979b095bdbafea48a83100
SHA51290b72dce33fa7d8618d4938bad9241295ed37a0d4f11052a0d67c5855b71b74c12a228ecbfa5a2df499c1cb741bb6469144e2afa3ebfb481efa61f503fe1f914
-
Filesize
1.2MB
MD58b2e32f9c2a9b7525c458c33d479ae08
SHA1cad1c51d35a45d9dc837fb2b6de52b61de0dcb40
SHA256d498570bb4dfd57b5a45ece48ea954d2204ea5eca48923c9298b397e1e2ff592
SHA512d5f1b831bfecbd80c67235177daa4a43564407bbb713d5d2a70df252a4c4fa0f2bd14c751c0fb94daf566793366d98143398e9a7b0af95d71de1aa6d49453766
-
Filesize
1.2MB
MD55389c553e22d775b18dc0ea62a874ee1
SHA1002d1850a5eb7ce9102dddfc8c5a7823bb7a5545
SHA256e6a91060132e6c7946a6df3f9cd0865501046ecf69d1673a2d1a25f3f281f7b8
SHA5120800f71363a70c542a507f3ccd84f9979476637204e92de6e13d79206bd70dd566edf596a8f68714b4e2239a52f52ef60c33ce297cc75f8c8ed2db1991461709
-
Filesize
1.2MB
MD5791b6eda279da3cf74cc51c430ddc1fa
SHA15b76f452b95b98b28f59d15519f8b74a5f011d6b
SHA2566dbc41e02ef4d1bf21c441d5278a99f52e1b0210fd47770f888a5aacd02b6528
SHA5121233e7e87ef9e096d50a2c620190d74dd6976cfaeb6ac5c25ecf091ec053aebbf39e335b6ea84e24439b9a31bd6b0c0302b7f8a9c49270b19a5c56a3ad67bd1d
-
Filesize
1.2MB
MD53cc98a5689a3e04db242c2aaecffced6
SHA16e00eb1b1e1e0a7877e18ffaf5a9f3c384faa2ed
SHA256a2146b17eff4012b122d818073ac3ef23bef479ca424ef2ff06c3e80a79ae842
SHA512b61665cc68087b57e0d190f6615f3837a20634db72b72091501181ab7c4ea502a62d309364730eb8bff132e28e3cab76effd687a2d1fc8d9e7f7f7f22748eb7f
-
Filesize
1.3MB
MD5fa92e56c8094dbc16ae1ed129470f160
SHA14c67a7c95e21282689ef8a025be416d8356c0ad0
SHA2565184646bf0b9715d1e3cb9c68918e1c43136c6e28ee5eae5e59fa9e55dde2498
SHA5121f8c4227ba564554d5e7697b2c4b065f5e760eaf9fdcf5896c005350319c4a07fe188655826ae18c3dc826b14e41f2090df01517699fa90888e4923cd30dd5d6
-
Filesize
1.3MB
MD56b5048cb9c2a33be7a97fe6002953d49
SHA1eb16abe4cf78131dc91684d98d46f55c485b1a6d
SHA256a55c312a3830c8d70864d28ae0895d8f977a3f6d4f91e5a5148f039eda32dbcc
SHA512ca6edf9525305a1e23c784aa772bd8cae8477edb650667b30af933e9d209f9a49e09678c875c9c6afd7f31cadb80d4867a82776ff45039dc03b034a70d9f46a6
-
Filesize
1.2MB
MD5bd627ac0738cd41c1ea62c7953ec10c5
SHA1888cb20d197e76aa308a91e8abd24e52ac0b6576
SHA256f48cf75aec23754aee2cb3758349cc9fbda5d1d05b7d8fdb3389dcb78bced2d2
SHA51273a7f006df07d3024789fcebb713dc80d91c32436f71d1529d70b36cd59cf686ff6db554815e3758d273c2bdfd86556e06945614d5f5b48c69fe0ef2676b28cd
-
Filesize
1.3MB
MD593abd5b21a131fe7fbcfff105a95c39c
SHA142083a96f118ad5824912d728b9b48285a553ab4
SHA256d929813e3cdc4e2b07575aaf9f748f4dfa8a636e74c0e71c53ea54be56c93843
SHA51254cba04faaa2c9484b94e41aa89185ea93834d7d09fb067318a72f6aa9c5b21ce815fc9efb0599a19196aec36ace8693a8f39d4e24273f879a272a8cf6c7cedd
-
Filesize
1.3MB
MD50648e62ffc1968e0fc891916f3826d56
SHA1f3630f6d90324808c5cacb1bd7196bbfda4bd7b4
SHA2565cc5d13ec2b0737727788a69a2b7713f23f25944aafa958968153133a0e18e5d
SHA5129694ccb32946985d3f9b8a262ee7eeadc04d4a5057ac18609c7b94f65164377c66b5bcb94cb3c7aa0272414187893e7ea52b52eab8c5cb8b9f0e2c325a7d220a