Analysis
-
max time kernel
149s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
16/05/2024, 17:08
General
-
Target
2024-05-16_bdffed9d5fa724a228ec9793722fc102_bkransomware_karagany.exe
-
Size
1.3MB
-
MD5
bdffed9d5fa724a228ec9793722fc102
-
SHA1
e7e8e400bbdadb0ac5941e75382f48e4a0609b26
-
SHA256
fc800c3c9b351e71d02286a12148d1e4707f28088b611c3dbeac62530e4af0b2
-
SHA512
6b0a9bd215383bd4ce200dc4c2ba11bdf4da12a6d79c650a54d2eff2432bbdd0513c737de0dc62d02b9b2d39b3a57bc7a988cf9ec4eec44a9e216be4f21359f3
-
SSDEEP
12288:qvXk1DSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:mk12bl0fitGbna8FLk2m1X2D4brr
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_bdffed9d5fa724a228ec9793722fc102_bkransomware_karagany.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_bdffed9d5fa724a228ec9793722fc102_bkransomware_karagany.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1392,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:81⤵
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 9002⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD51f8cc0396c34d8fbeba7fec2f6056482
SHA169eb57398b36cfab5e1bcaa65d2747944fbb7620
SHA256cb4ac9f3411423cb03ce80abc93a7b7da9334cc1b8732012463fcdf684dc6d67
SHA512a878b0286f2ac924d41b1c8c5073ca528f5177fb59f24f360737e453703be5371384ee2c3c44f6e608a77a25e506a5c48186eb62d6beda0f9146844be0f74afd
-
Filesize
1.4MB
MD55d87188e88b39691412943b525d90c59
SHA15a54f06191dfb8ffee335980210aa062de63eaba
SHA2564a840a06d20fe2597643cb19f27abe61e696a98f6e75c8504abe12ab3c65f577
SHA5128cb0318973348be22a1310beba456e82d471c70931b17e140208855bce3d888cc9afdfab2c2fc7bfdb1be9966abe8c9ab22188b196083304cf23cf7bd8bf1668
-
Filesize
1.7MB
MD54234b20ef4df30009bd6cef1d8b9204b
SHA1ce7935aaee11c377f17aa3420c2a59215ed15c4e
SHA2563e8b3dca12c964c64d4b09b4616dba56a3384662aacd699a146eb51eb4efb589
SHA512f758555f1714e5975dd364a442163b93d3db4ccf1fb9dd7b30c53414e8368aeba39ee35a99e2390968dbc37843e7ac497ddbee1b624601d776e9ef12a85bc23a
-
Filesize
1.5MB
MD5dccc6628d3b89e236787f772e8dc3723
SHA15bd3439f741f51c48bc02867d6418856fd3c5d86
SHA2565dc9f6db3abf5b312b20b3f1674095117b4fd6ad70f2e103786c4cf911e4ebb0
SHA512dbc8396f989d2a7555091cb69ac8043deeb5f59d326e2e50dd81f15a36406b7efae0549d4686e4f03ea573f5cf8179920ddfbd18a4a93051ab8a485f5e1e16ab
-
Filesize
1.2MB
MD5ec94764c637f50ce94f30f9ef473d4e4
SHA10b8b3d77dce45657564c09f352b10cfa2675eb8a
SHA256d08cc3d570cdf4f640e2d623d8e0cc110a0f33b14c77871f8f8ef3a2b7704b42
SHA5120cc2ed5874516fcc768d775d88cdd6bfa0c985b7cfb6202003279bf78851bd0821cb4f28657ff657ca2005231b1550fceab5e406e8d2f7c60a94181ab8acb8c2
-
Filesize
1.2MB
MD5a2b17727328f010d4f637c9b06c1928b
SHA16c390a3da3c3478389cd6fc3730b8d553a20445a
SHA25666a2fb25aa5932b83762d4058e6c5fbd20bebf51e0efb10a4058463dcfe2d78e
SHA512b5df28119a0466248fe6586a85a2a189d00281b787b83485796f5d917f9962cb1e911c5134178a96b5f51ae282ec5c17b2011a95e64b9f0c05237cddc9213d0f
-
Filesize
1.5MB
MD543436f7d998a09830c9d11a2c8035446
SHA11e94c7df9716c7527622b64479a0fc4549e56b93
SHA256b08e83da3651536a97aa74214a96ba87c8cdba5a04322d28e11db2e7f6c3f784
SHA51262315f69f34719a55d7e9503bcb3877ce311d82dc46e639b85a55cb36af7b06db50cba91422eabaa636618d0be3293fc4e5eaba537c21807e6584e7e2cb7c820
-
Filesize
4.6MB
MD5d1263197c1de2b33bbae5cd93f6168d9
SHA135801b9d584f32961c1b4f1901cdd7ce159a4513
SHA2565a0f6e38129120b58b982992eba79a570bfe87499d1660c2561d7a963e105197
SHA5127b99eb6c49845d0202d0b2460cb3e51a99130f288d448fc2dc356abe1af11b457db51e8276677c5b01ba39f20881e7a76b054adbdbf307b4398455f666874364
-
Filesize
1.5MB
MD5c6724f550087e61c93713c6fab22640c
SHA17740dd9ba16bdf4abdc98ddae27b925cf4771e62
SHA25646b099b9ea84d0c2bf1f4e7dc1ac71c3f98089a325c27f54388ff77fef184f71
SHA512a87a9d5893eb72cfce315a9e6d1942e8997d61d33753bcdd4608aebdd87c9e48ee74de449371b5c6a10cb9d0d2e0e818a76def56281437b3f78a2ca50187eaef
-
Filesize
24.0MB
MD5ef2361c995ff84e457bc6a7ddd306b8a
SHA1595a0d14970fa28322547688256f9c18fec16248
SHA2564cc3d9afe3841927320d809c34a63b87ef9301c0aa60484b86c82b4065c0853a
SHA5127fc713b12e8f9d79402c8ac87ec23443e2780d5b579c0be844bb92d63043259bf5e17f9160a2905103731792b19d40c8b8a9836727da715e73e1295dd269b9c2
-
Filesize
2.7MB
MD5f36e3c2d29e06abe377cb93efe1ae9ae
SHA1148d3e67deb3fd77bd3a3abc8988917fe3da8864
SHA256f6ccd8cf321afc15b09d2dd9fc6908081d1b26be37a6c9cac8ac6f908af9907a
SHA51254e6a9c78b5ac253d351bec04fbfe80c86ad4c6b01e9ec059b9e9fd863db63557f76cfceed8147d57301db381e7dccea7c422f24ab8d93978a70be296fac49ab
-
Filesize
1.1MB
MD563ff91aaec7cde6337bd26930f048219
SHA1188789b29cbb12665a6cd726652ab5a449223718
SHA25654b8303a597a15dfec08f3a78cce4e1ae148788f260382ca85b6a91b59e6064d
SHA51274469e9f274a77637d12ec3c9fd4fe260888390fe0cb171a3fb95408e975239df9b344b8ec4786ba3c5e16bdb6940713ec1a0d87eba605545a4a959934c70da9
-
Filesize
1.4MB
MD5748b5c4dad66df9a9557601521e394d4
SHA1260dbce389b87862777a919de45e07725fd4e6c0
SHA256b55e2a2171cf36614e0a703b6bba2d002c84f2b450fac1ca324025951efa6fc0
SHA51222b284a941d317c12d138663c9021d286836ae2b7733e7f03454faaa6d82961a3cc72f14b57d6fe2359c938b960b79dbe1f512c773de038be730cfc162b19508
-
Filesize
1.3MB
MD51d159e5ad7b2dea461fcb19f3d6e98f9
SHA1d11a7906d34963ba3f03b71b11a530d81846904b
SHA256985fdaaa2cd0bdd08a7442ed0997b0391bff22866f1d6974fa7854cb9d12873a
SHA51248be50b4902836b46d7e1ed266b0c14e4e9e9a443f64a93a26320d870cc6553a7849fc73e7198f67967d98f9e4e9db8f972ed3f2e503a0abc3ce33ec64a51551
-
Filesize
5.4MB
MD5c0e6c8fb6c4df64efcbede3f87438e97
SHA16a28c82376c43b40c4a3e08c96efcebe8af129b1
SHA2563534bbe5570455ffd089d941d279cf29df83e15e884e3bbef898a21e4342ac97
SHA51267b66778ea05f6ed8872f1dbadd39216f31f8488833f7b34a481cc506cf8ee513470178f2d357ec962bdfa1ffed677a36f61989eb9f843ee973a1779af279416
-
Filesize
5.4MB
MD5a334c946f002ae1e8bdcaf2c32b2f4bb
SHA1a6dd3f67b8ddeef55848e17c4de7474842c436cd
SHA256140aba963a8c7b0979b93f69f60ffe6756400b4931779fc7a088d1dfad397330
SHA512d9b18c7ce1d010f11d9e46635e8517d040cb93085a87a5b0cba1148067b16a2a54315051342a40f441c57c14b6864b1bbfac388975fb0dfa56d91de9db18451c
-
Filesize
2.0MB
MD5a194eaac0a5d800a70888bd59b1e3592
SHA1c1f05f694a536d88e5b935ec9ddfbcfd1848f361
SHA256f37dfc8d6c68aa666947a96e22d8b60065dbeb4fdfc8b3dc1e1c81424aaca6a7
SHA5127c9702f2414b8a22e8c9ecf5a8c0caf848583e8b88914d1fd0868ab4822a8f058aca89f134c0c358ca57f8d0d1de7d32012ad11ade1ebdfdb2cd1473b24931b2
-
Filesize
2.2MB
MD5c053592989ee7be01a3101dac48ccd87
SHA1de1d947358c1b35bfc0252268df2ca748a8902ed
SHA256e055767f4821c1e5873fcb35ebee91a0c1217ba8699a7771abce71d696f9ba8e
SHA5124bd26352c828bef129c02170cf27735b8c42b466be6e9b568ba20e35957879b4c9e6c2464abb053072a62618ec0938e70ce3af1ff41bad04745276ecb5bb7e7a
-
Filesize
1.8MB
MD53d1e7a1213aff61a98256aa013b0bbed
SHA183fdb1517e8c45948ab56bbc88f40955439b5e13
SHA25682b022d4a76b2743175b36ad7d54195a1e9cda3aab769b5702cc5a57d909641a
SHA5120edd6a6901b5199e674a890235886e4e1bf8c024bb3a9b04a4e0413548988dae2810e995e1a0d5b16e36965da3cf0f7dba7f7ea44ca935caf1bde15ccab71b93
-
Filesize
1.7MB
MD539c508d73151a1530af26f579199e565
SHA19c661da5abcd5f18e78bef3c07a6e9ba6661d6ad
SHA25646309e9401823d8bd0812f94fa5f05ba75b734703a2258b01abaaedd61b21cc5
SHA51210f523a7660386919a9dec08df8392a04563a67dffc1d6fc546aa767e89709a3210edcd3984f148994ae565fa81eb560cb5e5a79048342fab1345ad950f7548b
-
Filesize
1.2MB
MD5a8533d7b1ff0f9968e94ea6a82742e18
SHA143139289bf2064f566d9395a8b97db009f5cfcc5
SHA256f8d09c5a9b6b44e296c10fbe24998e501defd72b6a2b3ca30b7640053af6c28a
SHA51241a525117977918e17ce6da4fdf32a38f4cedeb81cf9f9432d0384d5dfb98077a26d5199f50043b298f50e77d462845bf657ede89ce447f44f7ec2f5344e2950
-
Filesize
1.2MB
MD5f56a0acf6a290df07239c409650f3b20
SHA120cf2f0d8d584af85b73d8b10d1c4ff4f01b0a39
SHA25614753a181043a8011e23d7a261e7206aa66deb00d0325fb8991e3dee61083839
SHA5126be9c3ba268a907b9c1f23c1c33a2101384d22fa0515223f0405048ad1253a758d1a290312d0e7519bef1f69e4356fa5369d8afaca1725e355dce3d4f6ce2682
-
Filesize
1.2MB
MD5ab9e39c971dd90b6c4506915a39b4121
SHA10b9c2273e3c2d60c9b1f07a8591adf1f27f57180
SHA25654e6cd8d79d8bc1c934deb4b74322aff89e5e043ea800ce538bd1aed75bb9bfa
SHA512ea887642ba162afa270e144b69db8a669e46ff8dcef6030f7861c4ec5837d3c3d8c2d6ae72098d034246fe9fcf53d2c31ff51cf4aa410da7500bc7cd74259b2d
-
Filesize
1.2MB
MD55b9dcbf6fd68c2d94594252dbf5edc2b
SHA1e0374e3725988052645a2eb3c060c9d84c9446c4
SHA2564ad4c78a9e0e11b11804dcc4078064b757dc554f67360d9ac3543b70cd4179b8
SHA512743fe680f4ec16de1aaa5dd48833436193700054dc8fc0653a986fa6c2eae768c00eba855f8f776fb86838faad6f7f34995272883b21099e6853d09f3b0f60b5
-
Filesize
1.2MB
MD5a1eb0ff068dff240aae2f9a89a665a9e
SHA1cbade139abbf0709ee07cef67a0d8acacf88a988
SHA256144ab4071170f53836e047fc4f587b9718899c295530f6223be2729b5a18271a
SHA5128b7c161f9babc0bebf3e1f13fe5ea6ddead3570e70c2007c502b438c4e4234ed4d919df1c095f1745207c61cf519f01bc9db213453313ab77793d91f6d261006
-
Filesize
1.2MB
MD5f1a4f11644005cef01cc09e85b52dd1c
SHA1e54c85300834711d0f2b66c1fffed2eafadceceb
SHA2564e2099a0a295df4fe30d9fa4a04e7375b3ad1953303eb47e048572d3aaed8f67
SHA5125fe74a1144687d2d09b0310f265289cc051d503b3fe307c382ea9e20df06966b879d835287c49ca1b4d7376635e875ea07fe5b541827af129aed171936864602
-
Filesize
1.2MB
MD5aa250590b15c00d2e0dba8798cecb6ad
SHA1509f8379cecbac27c9e100a0be5f6d2f8ecde60f
SHA2566f51db5dfbdfb49341f24661434d5152e7d86c6e73c61aa6ead249c4c07aaf85
SHA512bf49fcb2f476cb43a1de3e53068040f5b585025330cc716b8521faee1def74a3c3d30dfd161fcc0c013e794e5b56a6c95f503f6ecf6fd329c5c3ee3e35d4f7aa
-
Filesize
1.5MB
MD534a929b6af194e2aeb201d5e9ae38d73
SHA193e0ea770db7ba208f9f47d5695f693397e8b010
SHA2562197009a699a7d627fb8af904fb8756ab09ce1a3b4b64bd420a42dd793711a31
SHA5126791dd14128fa2d370de5d8280e293ba4cb45093f4fb7218c755d41ac303ea432903946d0dcd87edbcaa56fb5cef55f0b641c4a82e5eed742515fd9f74809af6
-
Filesize
1.2MB
MD57bb479f59c8d6bc31abc7721a63cc601
SHA1697ce1cc9472f713ebcd06c0482f1f7420779071
SHA25681b2c8ba52b15e16f1411105d83a2027b171b16e8032656093ffb28c2d3c3421
SHA5128858c97c04f2232da49e433be57f00938d96e3a63ca550dba656e3ea075c82ce02cc479388488afea268e5248914f3d1efd8f8d8d70352c8b04ef5243ef8e462
-
Filesize
1.2MB
MD5e88b1a2b42ae656d9d7a78f7446800ce
SHA1c19350167c678474759a5492f417e76859161d61
SHA25630d4f78069de6c07a40d9efbb73dad2a7c4717d6f187749177b8a1f42df7a193
SHA512c0e7e277ead2986536d493c0ecf99db20fc28d577a667ea80f44f5f8bcd6387d0a5426f6608d6b42608a689ee0f441b9176089f6054bde5e95afb8213c79179a
-
Filesize
1.3MB
MD5ac2b5179e2a49083dd8900782415bd50
SHA1b6eeb5a33fae6ad144dd5aaf95eda801bfce46bb
SHA2567b32a1a956c7bac84afd9c9717382d882a7ac1fe044280c3bd6931d5e0730265
SHA5120459310e192d4e324116aa10bae51c8189c02dc56fbf3b22d8c2e686f27800f8458ac45fd7f92c7222af2ea5e369ef76da9d5cfc994e576354b214659688fbb3
-
Filesize
1.2MB
MD56678303fffc86c1986ee575a2f5f5de0
SHA129141791a904ac255024b847b7205a99b662193b
SHA256e0a7978f7df09bee709f0fe2a85919f0f073d13614691f481f1b0990508d3c2c
SHA51209ca945669b36b2f9a6458b0c0209d026a71ec7db342334a46ac16b2994dee6aa39e1e84cbd051d3a9c57f85b30cc8bbe73c4604c777e249938b256f7fbf95ee
-
Filesize
1.2MB
MD5b04f752bda27aa8b8d177c82d74a1d37
SHA13f6951c26cb69523465a3e50a6189ccb387ab2e7
SHA256a4258106d0d2c047d8a9a72a239ad30a1c381e112c30a0443f045323164d262f
SHA51241492e9a08cff109e3f3d02ed65ce0601b975eb90096431dc7d68adfb13fa185c653bbaa9f8c5de76543add0d4177bccce5b75c5cc49e2fb380d63840dd4e6b1
-
Filesize
1.3MB
MD5f0bcebb021e17c8f10cbd1efc41d2c04
SHA129f826a365ad768cb6458475c8a07b6a415c5634
SHA256d0c86371fbf73a942983710b4775ef2a6e63c5df145e8a5eaa84c83f5c53f8e2
SHA5127d1568a00c26002a93296d9d460b8be96baefe10659c76ab39f42ce346fba3fceace971c5932a1e49beef1ebf5990a62c1dacabecde97b3fece2947e37d77996
-
Filesize
1.5MB
MD5e65f63e58c7d130b94726d3418f9235a
SHA18bb36d1d1b1323409ecf8481e57df613267cf242
SHA256bde8e3c1b28e28a1cd8ac666799798c40cb08b51a306215cd14339b20a843be2
SHA51208cd1cecf2a4aa30d890dfcb6bb85da6ebc514d40ff40495194b6ced090d9475e6197a79adfd681ead5cf3230f30b89213cacd15a3563ee6643e2c4726d1aadc
-
Filesize
1.6MB
MD5b57c32868105b8a5291302436f0e7270
SHA1e4e23dddfe9d448f86b352759d4a301963c35d29
SHA2568054716237fb898021cf7ab7d26ade3cf80dc1c38b6ef2cdfef70c9224e33f99
SHA512541e72874b255fd2e3fab6cb17fdddebab41a762f70b5da7ec009bc29cf64a53d92aaec4b4bdeb119806703dd4180e4707a570b8c77079644369e779f7ae43ab
-
Filesize
1.2MB
MD5f5c2636b1e78e93649e6b1de44dfe8ae
SHA192bfa092b6d28727b3288f72a3e5c6029a729612
SHA2562e9a796f848cb4e2406cff633edb7a01038c9901e5ae1a9b29544307db3100b2
SHA512b71fb319084dc22a5ae9fe6b73308919a63925596786d271a86f531a7e3f2a7c600a4fb7eb25164020396c6b914964ef128501292cfa53c4176e4d01bef73396
-
Filesize
1.2MB
MD599d230a9b9300f27babb4fe8278ad6c1
SHA1bc563914e492eb623ea46071305783cfeece3bc3
SHA25650a9a607bf862fb649882f781deba695cc792262c7ef696b68063b26a3e38d0d
SHA5126b4d370633e758f6499ffb9cc27eb855eda9015463b6e5b073bdaac9ca357da977e5a3fc15e74d6cc91bb4cd4d602c735ed15fcc70431490d02c7af8bf4ad41f
-
Filesize
1.2MB
MD5ab3d7408eb9a5fc6fd76b201123f8e6d
SHA1776290260c3b02a04be0383475ff3e20eb88189f
SHA2561d2639ac93d7a14a25327cec73b684ab96af84a7ec17eeb59789fe94eae9cd73
SHA512264e9e41e2fe5c537985a18d58f709901dcffaa05d6e1b98f0dc2be1d430e0ef7dbf7369b53f57b87d7806be695cfb7feea29d1c846e33eaa50f75cdb747f91a
-
Filesize
1.2MB
MD563dbb4c422c40f3344683e0c465c9c15
SHA1503502357f95dc003b12bea5ea987da4c782a3a1
SHA2566bf2e62b646962d86a46259a99a07ae4c263b33ee413e5567680c0e70469dd8b
SHA512e07124eab3a2f798b2a2b4574742fbf4be1f35ade9752a48f3f48cbc4e371677b1f313dfab04b4eae3babd4782509f346dc58cce241c828b36138577237d3d9c
-
Filesize
1.2MB
MD5e462e3e652d1bba9bb410c9e704f910d
SHA182c4ca9b92750ad4e1714cc3f2f8339a9c01105c
SHA256ff784b713fcc2de072043c43a5eee10682c069b37d2009d87cf591cc48b51b2d
SHA512c531b0a47f3c80c8e21e96f8d337a2ec542d51f6e50b1f52d0d277afe81dcde24cc627f25649c99343cc2ad01dc4c794a816e005f4cd37a64d082dc5a61a242f
-
Filesize
1.2MB
MD59d8f9a6b2539e385112e244632279fd3
SHA19a94fd17b681ecaeff26788cfb1aea23d8ba3900
SHA256d4f032027c93c4c792f53c9c0799b1e659c9b7751558d6b2ea6e33adf1cf00d5
SHA51252d2bf3117baf2273b7445090f67e0b2ad25df4effbf6c062fb51977c17cd4237905bf5fb2e00a2e8885e9d7d9b975b478d1e697c28b645114f2b4dfd54241f8
-
Filesize
1.2MB
MD5c950aae9532c9394277860e540db1c1c
SHA1db578cd1d82bfe6bd50899c64ddc785e01691296
SHA256ea14db346a0ed6a32a9ebc3d33e88deb9acd8d547813d073c143097de8fd54c9
SHA51247d3295659b8a46f816d78d9c1c7ce3dddff3200f1dac3d7073e467f518eeb41ca0bf037e96c166b3fc2aec735efbedb75ce4431321e783ed1d9fe24864f9c0e
-
Filesize
1.3MB
MD5aa2d674a5710687a4f44495bf211196b
SHA1bbd456fc4aad4a3625aa6f0ba559b99eeab1608d
SHA2565161cff0aa1ff99a6f13e6fd5fc5f0c403a5b841c9c0504409b152380075b1ec
SHA512af7496cfa0fcce4baec6836648357dde7217843189cd97288cb7013740d31cb9f3fcf217c9ba089da073560881a21ac874f5920a6f2131073188245b5702d690
-
Filesize
1.2MB
MD5366bfeb3a6495a870d16b63323fd988e
SHA14e05d4db358053bdf14fe289a16d2e4aa7210362
SHA25673e3c2cd781f4b46e0397f7333246e373303696b54a5ef74cc2828eb4ae38396
SHA5127906d831375d0a1bd266787c51487a11c9ccf68b1ef7e67b6a34cbc001f1ce3a271bafd1ca03afd720741288a31f48f5992ef0452626cbcdb5659eb039095e39
-
Filesize
1.7MB
MD51d1b48eb4802cb2ce13c1b9ec147903e
SHA101d7ac3b223d58f3a115a79fb20bc85488925584
SHA2564982eac16f91048d77802f417a68b57dc6de3abdf2a1fd522107a7abe1bbd258
SHA512b3f87fd3f1a1c4234ada77f066dbfd327a0b8ada6b198ba90a3e68e0071981ef68ba4e320472f800b1773865bb31efb75a5079bcdf3d77d882be4f7fa145f73e
-
Filesize
1.3MB
MD5eca61132b284ea5df1d360057d018639
SHA1e5719c72894ed28b9a8277d1d0f41fa0a5374c0c
SHA25658641859edf9b9cd8c3cb813ca21c32ffd02c7db9e0642b5f1c0e2899ffcdd7b
SHA5128e4e00fe3ede6add0cbc3d0ba7139e1d1b465e0ef4d9f129d3a24dfebbf690c6bab3c931a2106cfb1dce3e22a2d944076b6881f98699fbef74000f0f1fd84a11
-
Filesize
1.2MB
MD59ac2c71a59b257151ee1baad7d5305a1
SHA150a60f99f1fbc4e30c811092ed85153c7b5b278a
SHA256a80fa298249f372ae92f09546928087a171d88572eda388f2fa82b3d21b911db
SHA512498467526642eebe3005533b92980b511645323e29893640d38ac199f9f2f1a9f3ed1dd4c616f6b79833ecf21baa63622a177873dad40e2b24525369b7dc00ea
-
Filesize
1.2MB
MD5981a3bfc5222f05424e641f05ef6181b
SHA181939a17823784d12b54e735463ca1d35fc0167e
SHA2568bdd47672aa79a63c0fcc4dfb77692158d5c2bb40d3e0e0f26ae9d465ce770f8
SHA512aead33846ce237b668e90b4dd6225d99f1a22f68e718d78acb13190cba577306a376a05f4ff02b9b176fd287022e886f0f1b3211d3549bb0864436816a2dc1ba
-
Filesize
1.6MB
MD5f56f4f19126b39061e7fc1a8c350309a
SHA1efa961267bf652031d37fabaf8bea1fec6b5884d
SHA256cc7e636be99c6b6d0ee1b16cb9ea5c7efd6e5b03fbbc7ceb90cc5bd525cdd6a0
SHA512e62baec94889617d825d5808823a2f7f6edc02702b3ba5df351b89b07310562adf26074a35e1cfe4a00d45519f701f69a0f5b97f07c8a71c40d500a531884a5d
-
Filesize
1.3MB
MD5c974bcf20ea81eafbdc28203e8f4e5aa
SHA163657bf5fdf1e848f0a377ffeb5e9ea853017dec
SHA2563171dfd840c905da66863d63892db787e8d2e229f801597ed81f03c976d2f569
SHA512db3200c9a96472f02f1814bdf192e15c2f98da38cc7c88fa77f8c22c0f50bbb6c01299e0fbb4e0bf3b36b6a585bbcf0900233a31fa7344e292c5aa53b65d6f89
-
Filesize
1.4MB
MD5f15d3dcab3ea6d32f2ab5dd557973378
SHA17e63011aa643ca48a9e0e4b0c316a5840c45056d
SHA256a8e636d6ff2fb44542046b63a529b5ef4dfef9c1866063507e315cad38b3ba3c
SHA512123125efb2534538aa41ccf8918199ca126ae827bc197c94c56d744f8466dd054ad14ac3374cca89b364a6d6c51e5edd857060f3be441c8c9e694104a6a3438b
-
Filesize
1.8MB
MD5453d53a7e40dac58dba6bec593cf9ecf
SHA1af4cd353f1763aaa4f519b43a5d47e26e55dc199
SHA256284be2cdc5c17725226ffa7972c8b1d482d1356ff38d26257c9f6e70a56d3a4b
SHA512657784ab1c244281b7bf0eba082ea76e5e185501d39193ef1c779c5cd1c99f2fca0d93188cd191cc4c4fd7cf626f9dbd9a2f20ed5d9fe0cc236eabd63e320858
-
Filesize
1.4MB
MD54519311a9c16c1c97ad6fcb28cbdd815
SHA1935c853ae6cda5e21eabd8a6bd119257ebd4d3b7
SHA25696555451a1f9f2f11812a3b8096897f867f167d029e05d37ea0f3719bb00ea92
SHA51286bebb8b0108edfffeb2d1ad2385c74fa74450f41766df4de5de7dc5480a01a8feeaa2d1862997cdf4388a2e785275008056b3b2ab0bad8ec09bb5be0fdb2b21
-
Filesize
1.5MB
MD5f79c741627afc1cf63e7290e8e4c7e55
SHA1a743b2664f838b34a68438c858b82e956f216c24
SHA2568807bb4b526f97f018a91962225440c04fa113845eb592764e24cd26ef1dd4cd
SHA51295d32ec1db8b6128a2946dd0b4b76c2962b7c32c1c665c27c3f2654d51f3075a90aa109981833c75b0028bdf7e79308ff0f3ac5c8b93e719e43a9b7f33289e3c
-
Filesize
2.0MB
MD5955bf8b653b7873196093eab9d2e8316
SHA1d5b01fd311b69a3387e4c47fa1da9f8e1595634b
SHA2567e741f7637c355eaac62b550755e9bffb815d8f3cef78908f641c402eff0e709
SHA5122b927c6111f8779aedf17d501a1b99c3bc860c258e10253fed9b855bc5ed920ee5fcd170ea9eb908375fed2d5cd5afd755cae531991302aff3c6a86489ea90d7
-
Filesize
1.3MB
MD578fd1bac9653f7bff6c595ced01c921b
SHA191ec07b785eccafc2706828aab3229f4ffc0220e
SHA256648038bfd128112e3ce22556bc5f5ee34e9f3038b48744ce355b3dc544bd37b1
SHA5120bb31a7eb56dc1ae6a4cdd34b8d9a5af2c6a315bf9e47a5b943b8b45af1c9c30f59a4e0d895784a96dc51c04f192e0d621ae011514a3357ac806c83b7d84fad4
-
Filesize
1.3MB
MD5a370bb0c675d383a5e3c0e97b81b2636
SHA14aff23032f5ffb560c9295ecefe1814ce2efd920
SHA256c1dcf19d89a26fdb34d5e7cebd4f40200d86458d04e8fb84d4ab8856fa058aaa
SHA5128ca64659594b667d95610d36a48478ed0941a8a54d6188bceb89be5c6ce32fc9c24205ff8ffdd33fc046192b13bba1b4a614f8e25ef138c3759bab6947fec241
-
Filesize
1.2MB
MD555a5eb2ea51550acd74e63f46593cbc7
SHA18174c0c9d02999a0af0033d83d6831a678f2d39f
SHA256ef3bdcb9fa9c37a177beec3eeb9cc2b9a3d2da46f42479e61cf1038af1725b33
SHA512c4cedae892225beaecb2b7f6fa6f7d17e593625d2cc0b4dc6c7da8e2b1fe2d255d2944624dae0b68867732def06ddd8ad1658443c603cadbca5000a688242e75
-
Filesize
1.3MB
MD5030297ab8f1ef9c3a905b387187f7f71
SHA16c1186ee0f5ceccc4ecb00365d6662a707021f14
SHA256465d837adcfde1e433ca6ef642fc0a096ded8cb60cd30789dcb9fdb232b84c1e
SHA512acea049d56de6fecf820c78090ba270682992e69c49fdc0556e00a806510fc44943a3611747c31229658f7860c79182e2ec0a443889b6ec6cc5a023199593562
-
Filesize
1.4MB
MD561a8d68d94e48f4022c8e9870467401c
SHA19fe6d5a77ffbab8faaa0814bd9bfe82c446f2e67
SHA2568620beb668fb9b1937f2e9dd47a0be1070de2671a151ea857cbb847485811d72
SHA5127a759a4491f91084937ae8d553c8b321ff51ca75c29b6857abf81374afd81f5fc95c6649636dc149cf35daa0133468247e67c4597f8c3f871e0a611195efa982
-
Filesize
2.1MB
MD5b50674fa21e36e6909c7479aa19cbb7e
SHA1fdfe7ed9a6ff692481b675d9a82df3d6ed3326dd
SHA256f88fd6e768e1beb0ca2bb191faef6481931bfe396f1a3f0243779312f5373780
SHA512495ee5967d14a5335b3077aa7f64e9d92ba1a0877c4c33cd7d413e0b128f0ca651fd4afc1974c142390822ce7159bc7b1723f5432d99927bbdd0229a1678c72c
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB