Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
19/05/2024, 20:03
General
-
Target
2024-05-19_93c1aaeb5ed4e135f5ee6e5dcbf26e31_bkransomware_icedid.exe
-
Size
2.3MB
-
MD5
93c1aaeb5ed4e135f5ee6e5dcbf26e31
-
SHA1
9fc4bcbfabcd66cba8afb7c1bc12b4b5b9b4a42c
-
SHA256
0443e5c3324c7e5a019576f339794d0c89649e818394c1beef71572ae6679729
-
SHA512
5938145e6ae27f5e3510f30b7085211571d833d999717f4b35fd1729430a498d21589c3a9ab16adbc9981dd0148993f7d27770c9c32399ac106cc1822fccbe69
-
SSDEEP
49152:DDD0FZs/Yl7dYUMQ+fCi6p6O8IFeII8uxV1XL4kDmg27RnWGj:3D0FZs/U73MQ+fCi6AeeT8uxV1XlD52j
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 37 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-19_93c1aaeb5ed4e135f5ee6e5dcbf26e31_bkransomware_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-19_93c1aaeb5ed4e135f5ee6e5dcbf26e31_bkransomware_icedid.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 8962⤵
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4268,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5ab70218769aad63331d055d625934344
SHA189649facbee1ef5f147732f6a10bccf837f0e13c
SHA2563692c00e7ddaffb0bf85c0de7036b9b91ef08c2ad823911995e370ac9059ab23
SHA512292b234e2d15568032f910b3710e91564810356d6ba5bfdc558bd0156c6fa46f0e2c84f2d91a4b9ec1c5438021e66840b4b2814d23e93e7bfdd8043788ac84e4
-
Filesize
797KB
MD5e1baa4290e4959de895297050a764440
SHA1893ba570179dcb9f0f063b0241185fad4a3edd7e
SHA256617e1d7003882f3bd46eb35f7db017e230e6c77cbc34d099fa550db29fdbc078
SHA512c577068fedf77b84b1f9a4945bcd265bc99aeb8fba3c58a57380ecd1181192ae98229c88d333033b99727c06869a08033980f46f00d77b75487ae74bcbc792bd
-
Filesize
1.1MB
MD599e6a099faa29bdec47defde385a30f5
SHA14e75c65fcad82012af8cd719d213cc9337f017fd
SHA25602796dee93583e6069f858910cf06b6480c528e14bb31ba4e0c44ae13c71058b
SHA5120fc3e4a97562b4772463f48c28670970d9100f1fd3f500bce61b1a27245c02fd3a4e70ea2f7c6510287ce434dcd1a3d25a655285ff20ecc9ce8774b71d9097c7
-
Filesize
1.5MB
MD53b5702d5f431708e4bbbe5cddfb02bbf
SHA177aed9508f3e93ce04566817b3b4b4b38f2b28b5
SHA25661f4d8e1fe770a09e6f0ef49f45d367545a0c1ea5e5704bd654a44b4e123a4fa
SHA512fd6b923045adda7d747a9da53165f4391db96a1380b4bb9f3d16774970162ca9fe916e5bc08504e4dd9c4a11386c1c06fc7f9e9ab78611caf06e60839247f2fa
-
Filesize
1.2MB
MD5a8bc971ec572e2d9dc3d8dbf25dcf1b1
SHA14b836d802361d79e953534b337dbda991bf1fbdc
SHA256f0933676856fdea16b0aa5b80751f32e6fab7ad7da5b591590e0006529616cc4
SHA512c3d235a926254fcadcee29512084f6d6cdb69f8cff157997767ae282233365d9a3455a2b01bb721b61420ad11603859ab6a3d8e5becec26fbd22cc7e88f1ffd5
-
Filesize
582KB
MD5f93fcf8d91f6199d758b97aa7ddf3be9
SHA1556077f085a23455f3ac95bddeec677db64a027c
SHA256f86aafcbc0fc8cd2b431446c9d0d44b9582aef1334f021aec36d0ff36895643e
SHA512435a534e982edbf5f1684c79c38aa40261297b9171fb873ee11551d946bb8867f3082b5d3c73700cdabfe0f6bf55811a23b20db12253c2dc9e0b1e5b37e34e2f
-
Filesize
840KB
MD5bc62437c081c13851944fd3b48e12387
SHA1254e556730939614df495ab31581951724ec7d55
SHA25697b67d3b8aa94d462eb96ae5193cd0d122e32f40bdc3f2ad1e989bae17714675
SHA51284827d0b635d10bfc6fb0c442e699f70e395a53ed570b596f24adf9d439ecfedfd026497196a6999f45e2ef459243f1d529cc8ddf3c753bc9c1c5b9d9d02fb6d
-
Filesize
4.6MB
MD5b74019f201ca29bd4cb6e80b5d3c7eef
SHA141451b25df49077107feb0522b4a6e4a9b5278f8
SHA2564ffa3c804a9722f64fa259f26789232709d0a100b6c73c780b63d3b8ee6e1955
SHA51200bec8d6621606d05f09381b47374a03440d600a92c09b914461f3af45158fa5f88f8b3f25a39435500fc57661401fe48eb500b51b8497fcb59714b89e608640
-
Filesize
910KB
MD58b25e375050d6603ed0856a34aff7737
SHA1a31d34b840ac68514c1449b134b4168d523f5262
SHA25627974a5384aff2e0e2c7791b55f66aa403c628321ff970df522affa11df64288
SHA5129209f3d25dd309e3db564296c9d5910d459d6de7546605ff3b2451e75c1a1ef89b2a3505714bd0d5e79b151bb9f2e0fd75977fdbf67d38f038965ca4f080e211
-
Filesize
24.0MB
MD56c423f876dbcb44fd82d10515a0d8c51
SHA1fe575a81155a18a224b618b61f1239c4ae0ef080
SHA256b7440fa4c1e503b94c61b564ccb4ff418af9f7cb85430afd7d23ad6208589448
SHA512b1736206824a33081ab197d660d5125cad0da32efa3a73cea9fadba091dd107413097eab94df118dc3b9a68448a9446e4d5df85eb0bc6d0cfed75ab927a6e067
-
Filesize
2.7MB
MD56c100ef902981e8fdc9bb997abf49ed6
SHA1a30394e0451fe1dfacb731fd3180ca1781de3ccf
SHA25625c6454c3fa78d6783d8902d683add9d3f2e0e5edf4ff5f6c87fc11fa04b2eee
SHA51278d3fd9cb93a408980987eae16e89ed412296bc9a3bfb2e7a5d07b449ef38085b91a57d1739917d5e6b88d55f69d9125e5779a7113487b8124846b6598c5c2a9
-
Filesize
1.1MB
MD5e50ac1738a4115012d9d0f6129ae9245
SHA186c29837d123b2ed98f2e7804aaa9e066bb3c07d
SHA256fcbc0d8e7b1ab889a76d130cb3e9efdbd211a9e2726a905631ce67de90823cf3
SHA51255d198d0bec3a3f63509dbe7a7ba6b0c5f422fdcc003e2ec163e50a786bac02c6b8c9f81afcdf89cde69326b76930a2f1ffeb55ee525eae732e41decd4c3c945
-
Filesize
805KB
MD5272ed8970a533490d8b5a7e9c0755f33
SHA1805c16873cec240acf9c495d9b846c9801899278
SHA2569ce1ef6ff845bc149759e00911da5a835797011d75bacd8822e8f522a78f5384
SHA512261b9db116c9d9aa4c88720497026468e1a5f1ad9e2d2163d5b025af331ea4dca4284a143145f85f8d3fe24ed47be51fe98037c784830068c1560023b7ef9f5c
-
Filesize
656KB
MD597561a48baca86445071a6590971cdef
SHA1a20b93882dbcd69f9a743a1c0b8e4095338fe492
SHA2568af29d1a08b58c95d125eb9ea1595d67be52fb95b8a8f495fa0ea40020d3048b
SHA512d4a471352fd7a9caf22779e20e396470dd86c32d7281bf812dc0f4d68a364b7c0647b69346040dd9d85e372a35c108195a9fa297ae13e8c3fe39d8fe078288dd
-
Filesize
5.4MB
MD5aa8ccc8c0349724e4f0124ff3c8ba1ad
SHA104d651982107fccb92a8c7c072aca16eba0b05c2
SHA2569054d849451f7bc6940cc6fa362bc3df33f30dc4570df1825e1c0f35798b488e
SHA5123ec4022e4ca979bd83b8f6f9d0336b2449b1501114a949519035526b6bf9e539e3e8af4ec975a42fec90469559cc04ab25815825e80c9e0faa715c64e500c29d
-
Filesize
5.4MB
MD504f7c95499841dde7b0c7962f5f177f8
SHA15544898e125de889caf07371f6e4d9c2f7309238
SHA256609712507cc07e554ac0e1ab2ed9ea43f7b24cded9a76886b2772dea8a74fc81
SHA5126e98e91c3abf504afa0ce2c00863b5a3360afc974dbf77251109bc482c79850ffbda36257b546c5f57c9a1c24345ed19ea9abfb9f573ab3e9a4b2bede72fe4f4
-
Filesize
2.0MB
MD54d283e5fddf09670662f1a4e3cfad214
SHA1558c6bb7eaac54b4bd7c240d2fd2bccc3748631f
SHA25665384943f7e1ea8b42ff8c02ddf7226e40cc52d4daeb95696cf07c70ef1e615c
SHA512db5892c3fcb0278a116c000a02afab07bc86816e0ce4feec42ca49020625e0ab7b2699b6e91dee713a17c1aaa1155256de5a643a8957585e8da586fdd0f34dcb
-
Filesize
2.2MB
MD5cc6831d8f2f0991afc107354e8a26d8c
SHA151dd5e2128a4f5ca155b8350d2f6ee96e2ceebe4
SHA2561d1a2380191e69ffd2043c0feddca66267b28ac5324080905c8eca511792c2e1
SHA5123e6940a15f4dd1235cb8b5a4f4b3b6be196153e60ab0edcd9c9e2dad2f47488f2969db6e17df50f12191c681f1e47c3ffa39a214566f57508d2a66fee2d324df
-
Filesize
1.8MB
MD5a99406ab174c52e947399ecfda9df1cd
SHA1e2654635cdf15f2dda4b4ddf7849859c7cc83b77
SHA25645303b9a7975da6dd7099a2ce6a0d421a4b331182797326f7918d8c5412b31d9
SHA5122c73cbcec38e208afb9e0e5b3abde3ad18ffbb194078902338675674e34ac98e2e12b4adce1b740adb830e25df722ed9934fda65e810f132b4dcd5dd7a25c4e3
-
Filesize
1.7MB
MD5c1bb366192117404558066fb7a05cdc3
SHA11df531f222c90c6871a251e4232010d6181ceaca
SHA256f8d9397c3fa90c0349804884b7daa86eb060c44d4d24fd2180a3b6dcf3fe294b
SHA5126a1e8cb71716b4f1c8cfa7bd1cea485164eb642df2c0d3a2317aa0c7e6d9b2e51392d8be1f00e9d98955d8c241ad976d320e668f16ccce9c3bbb11c83cc16802
-
Filesize
581KB
MD5e5ce409ee626d0a2cfdc0fcd87b4a00b
SHA1f387e77608ad2f642fe047f42c635560db7a60af
SHA256d7bdac46a0f3f26365df975977dba12fbc8148bdff9c0915c2a9e166a2b2c5df
SHA512ea5cf19ddc68e58dc85b8f4d1a17a2ba8b1b775adaaa937e6f933a2cd76cfebfe53a35f7cddd1c2d3f7b4b08464aa94bd49252a98d06bc6375e3dee0b1be7a2c
-
Filesize
581KB
MD547e760d4f148ba4954de9d3fc78a4c16
SHA1315a733ff37bc9319bb09e1e734a5d1259b6a5cb
SHA256dde975dba8ffcaac6aa990bc587f5358e0eb68defac2158b9a4ad53e8ab09450
SHA512195f1fac3c180f0b888c27a0ec50f634229c54ea8287191c0ff5b2afb9ceb7fd373066cbf55121c9ac038269accd9c15f6cb93deaf7179b816c9a8aa48256b4e
-
Filesize
581KB
MD5a9b6e565a327bc7b0363c3b2f6243a59
SHA12212deba06bd5e50b16e9fa7c70e2203dfcdf6e6
SHA256cc14db69171f29674550d739d426cc580b8a7826bdc96c1f947b51852d6d3e51
SHA512ceb52b65ed344b248d6ddf7f94adf33bcc822714dd21e96d5386d6d3ed4a3b10d78b587f0ff460d856b459bd471984de6d3924b7b345e69361a756595c9e4057
-
Filesize
601KB
MD5df2ac0232e3f46e5fe1fc7af5fc44ea4
SHA101baf7dd7d07320eee4006c4f4f7da7dae82bc17
SHA256c142edd679fa6abecb6e8491dc3af340f81bec22b9ed2cadd701c9cd5df9e788
SHA512005c18145f08f932668201d28266e23900c045af674f2c76c5fd28de74192cfa6c9cc5bea130cd66832b104f5358d1932329312115e5315c9887ccb521285023
-
Filesize
581KB
MD5d21308612c3e01e2978c516a45e969b6
SHA1b62da18388de1b7941e48a2d85337801c66f8b08
SHA256c5eebd2ea921f80491f4e8813c5e85ae12d24753b368d61660308fa293ded061
SHA5127cebc24798a96886e659adb72cb72572fd60d9805f7e66ed1b568c68ef29e559f07a21b25f16e0f70fec801e8ac47672e719fe72dc732153360e655e4b15dbc0
-
Filesize
581KB
MD57c4d29bedd1575f65ee82fb829754a2d
SHA19c1a962f19b8cfc6440b61ae28cbea71185e8321
SHA2560f9d21268313d201ab9b8bdde32cbe5d7ede51857433e69812da4fa473e984e1
SHA5129682eaeffcdc8758fb96d6cd343980900e9a532e3828e27a7764fd7c0ed97854b362abd3f0f3209b84ffb8fbc30f2e51ee09120abcbc2d65d0c88cff21a8e8da
-
Filesize
581KB
MD5e5875758948c47ba33cb7cedfa7a9e20
SHA1d8ea6246906c86058c649ee6bd51621a73eaaf06
SHA2561fc7d87ffb8cbd8289b838c0bc5656440fc7437362331d93eda38046541fd330
SHA512c39a4cfa64af3a9301958ee402e6992e32364934123620ec0f5da73916814ac5afd626a51704b28942b08cc17a8a329869486e858e524218f2cceb121515c820
-
Filesize
841KB
MD50b4e6fa8ec3be391a5db16259f61168d
SHA1432d03397c6d386a77bf3f7b92863d2b84951d65
SHA2561a4e2d080955ec64eab2d6ff35a81bde6cf93a25332ba2d0184eb9d5e7a78737
SHA512bd4c2a7cd5a6807709d21fd23aeccf26a874495f8245fea7899b7ae96014d170c11b8bcf5b72807c1a703861603729c2730feb28676b4dbea072d7441bf72ef5
-
Filesize
581KB
MD584031990074946207c3ba1c16f8b5478
SHA18cb6beff3c9ad2bd15b6a05b10e1f50dfd8a23fe
SHA256b93200f920645751debf163afa8187d1de10785e8389c665b5813914a2cebfc2
SHA512861c196fcf4f959b5ecd3aa26afab84185a3b73f88f3a94c038ef17be0762e955b8c50a1743fd0c7f6e4d585346d28ac1f8a54e0e11b948838d0372d0cecc1ca
-
Filesize
581KB
MD5624520416dbca1b23d12a0e0ffac65d3
SHA123df4e90361f8d727894b5ef5d8438175c5495e2
SHA25633d1068bdb854f04ac8ebc9c422e90da3d96b7d1163872152df50ecb3ae0f854
SHA512a040af77f9093d3a0606ec7173131e4ad317fd56e4deedbcef4d3bc6589ab9572af3b83a1b34af0a5f84fad5efbfef4bf08db6abe0d1e1e32674d9722ea72f6c
-
Filesize
717KB
MD5374e26df83bb0a97bf2d525c22fa5665
SHA149de56cc1ff91207b7742b82163474f1815b62b4
SHA256b08b35941515706d2583a0a29318d5af56bf8c99733bb38e3e8b13706fa033c3
SHA512095cad2c18303dc22c79c43471be31c21714bc27a10624ed88ca319bf89c1eac780a18a15262d5208215d47b3a53cb9a8cd433923e93bcd5e4ab40e7032069b5
-
Filesize
581KB
MD51e6b0e6bc4abe2765aa123fde7aea9c5
SHA1f7f811972f942a52b709fdb6db798bc1d8b6c3c7
SHA2561fc2fa51e9100719cc253fc4f324a30af5a113db3b94d38dc1a07924ca94c329
SHA51296b03c6f22242169f742fd85f97a8965c43660e8c5181fdbddb07242481d3eba176fa42cc240cb18daa3ea688ad844ccc7d417f780648aecea6e101df38d4e82
-
Filesize
581KB
MD5043d467d817276b2d0b87e9d1d24d61f
SHA124a2ce689123f92625be3ab429e85d89645ac191
SHA256de81a9437fa55d9d9d6e0ccd8f99e1ba78ea02e764e8816fa0fa107f2821a443
SHA512d9856b7b889134a5f8e9ffe2cc98b683720ee2199a65d8917cab2bc29ee452868e4088bafc185551a5dd21dae89cd4c251ca2304f932c3e1212b88e98cfd3eb9
-
Filesize
717KB
MD5ac490b1ccff1c36877fa0a04ae651f08
SHA1185c4984426ef067f04ee3106c8d7907f1686451
SHA2560817e1ea12d9535253da7b12abeda88eb73e4ad8c858c82073ea062dc6e20329
SHA512e72343f4739201733f2fcac980a6c547b9b8dc1389d05fb14cb4d16de9a9b54465bb24cb9f14183eb92a2ff0c0b5487010b31762363630ded2083e578c3612d7
-
Filesize
841KB
MD5fc07b694462e694df02e5484b6cab546
SHA19fc1f67c4e1f2939daa7d99055aa6194bda003f9
SHA256a06c65745e722181944f9a0da8d7388782dd795518edc764746bfc4cf6dcf28d
SHA51299440a82dbb046b60dbfe8713e243bdb480c61a38bb17b5f8c1a6dfb9f7f548689e037dbadb2560f9c22bb8005af6729e0b525f3e98be441e0f697981039f77f
-
Filesize
1020KB
MD56e703edf58838dd835ab98efa0029161
SHA169a330bd94b3cfe4241de070594179ce08773fc4
SHA256cc336f98076664998ca3f7516262c52cbb1a8e19354a4e549f88ecd4b3f0bd9f
SHA5129279d3b4cd73e4e5882b2363b56e521871059514e0fadffd475299f5beb61caea6bbce5ebd5ae80e7c10dd91beb52f23708135aacff89c9b0611c70b8a05a239
-
Filesize
581KB
MD5eb163025c4028e4afb03d0c17dd746e3
SHA14aa3afffd4c43cbe598ed1e52812b514c9045661
SHA2562b9d2e9e8207036d5e9aa8820e1121a1ba32377d38f231b5c09866124d2931a0
SHA51211c188025433908fc992922c9f78d7c3dba95d7c0299bc7d40975e449d1b081eb356aa560552820b5c81d67765f8a9b2968a5ac6b6f92d6499e31d6d219d794d
-
Filesize
1.5MB
MD542a6560703acdd8a1918dbaf3225668e
SHA187648f39403fb1027935e14ba3a5b948ac889784
SHA256fee52c7786c70f0a2654a2e862e55d9e36837490d0dc3000e41eb28cd756b017
SHA512f3430af00f8cfde35b30cafaecbc7247f191831705d1a21a9e15c2a24a62870decba7cf6069682ed0b0eefd85f2bd640eaf26ad6c5e39f577840924de19605a3
-
Filesize
701KB
MD5897f4642c9e3204ffb1d3ce8da44e6a5
SHA1a1479e7d2f756ef3ee00aa5611513606bfab6eb9
SHA2563d4573c40b013ff39d8e61cc7a7ede20a50f51b4ec00edb854a36a7e128fc6d0
SHA512a2ba2e8408d037e577fed13fa7f3bb4b5e77ed35fddbac8b23f467573ca5dc6a1021199219478502997a339943210db4196066dac692f1428527e9423cff99d7
-
Filesize
588KB
MD577630b2dfb58b16859d20f7d3fb11e05
SHA11e953f9aecefc61d8e1deb8d0a1d99f16a313319
SHA2564471e432d5e15922d021d3998f72bd11b9661f68167da6feb01695507ccd1108
SHA5123fb1f0678694f238f5cfbbd1371d51af63ebcc630a6073b1b0f4b5765d77bdf09d89cd7265724ab3cb13e306b251c8d69b7f22905cff6eca7e51c6f96702d302
-
Filesize
1.7MB
MD5012dd8fd7b90d0030e0cd9f7022fa616
SHA133c6a2c01be68e144cc67d315fa1f53def58c816
SHA25642dc812192e7bd0e773aca9295aeac6ff635dbbd55a498a79489f8cc07518b2e
SHA512c410f792d5ff047b37bcef0ee9fabb8b3fd97160a0239b875a7edba9a2072b4fbe64d6f84b7c3d20e342d258333cd866a3c581d341019d308e45c3aec0598fcc
-
Filesize
659KB
MD5e30f4d41d1518c153153673f8f27d7f1
SHA17364e289445689ba3892bc361a384f6e573af58a
SHA256558d50f6a53f0f542d8d47a54c7ef77e78a5bc31d0a7626b94f6aab3405f6028
SHA512eafbd9b5beb0f8801b15208bb4eb580d9e6e1d27a8de70d7ef7448b54c5a6cb48ebda8e209906f9e89168db32f41593f3479a3c9d867c8d84b6ab602b5915321
-
Filesize
1.2MB
MD5a57cba10e6f7125d2303fc6713ee2014
SHA198f868b721f1f1ee6e42c768fcf01cc5c5ef2d69
SHA2569987ef73648f1a7fa756866e8324ce9c9adc25c797a5fd89c4960697d2b7c53e
SHA51288bffbaeeaca5f21333092afb7317fd2d1c79ba9918c660a3fa28e2766e47dbd45c5cf45b334920290ac426a8a6f45799a9890af7789bef7772c411c62d8a9d0
-
Filesize
578KB
MD561f3b0e63789f4f50fab5d96d5cb6517
SHA124c5a06998c886e53b4d544119d3e1935a803f48
SHA256bd3d35ef3dc2b589c121cab51b1455c0eb087699b368ca19f068e54d8ba86afe
SHA512b6de557be68bc56724de25915d5adc3f60587989ef0acadba8b4209577e412766dd024d108b07dd29643d51f7879a06377244a32e336516521e9fed77868c43f
-
Filesize
940KB
MD50e94188eed721ac0020338e58fcdfad0
SHA106cab8a54b37a61dfb6c8c23d8ee1f60defbbb60
SHA256816dd017be531f0b85cb371c547fbe2c4dce4042e2d55cb191d99b21c513c3a9
SHA51231af9746f5cfa3eec243ee5f59e39ee554e148d78a5c15b302640c5ac20cdcbda7e85649ead3dcbb8902427081c7c89b29ad61e780ec766c0ad007e8a609c72b
-
Filesize
671KB
MD552ba187e7679d8a213ec415c6c9def16
SHA1b659fab88a3f3e21698cbcddeefb585fa91bfe78
SHA25685303a63e97941950b55f6850650ce86c5c96802442d7dd8d6f78ee68a9dffe1
SHA512602aca6b547c09cb89801cfd5482a0271405279ff972caef0c012534bc540f63df95e85ace4a963e5dc58f9b5f0a8d427aa24a86667f2f2a3b6686984c7da1de
-
Filesize
1.4MB
MD54304e188afb6826ce08dcc6769675c13
SHA1bd13decc26463310ea63897bebe1ecf93e477340
SHA2561e8d7654cb5034c861224467a31d8f7d0de260e9ef3673b04c6dcd483097bb66
SHA51285e0fb3d501955ad91843d034a4be997a11d90140e85ea46f9ebc5e1657c6c77dfbf51ab9ca87417df0be275b451ba7f181adca1dde93eb759c8725cf737f844
-
Filesize
1.8MB
MD5e2e8e908a3493de34f4fedb2d4c29fb0
SHA1184b7bbeba8c3a24af30178ee7ff09f120d9c7a9
SHA25683186f176c366727966bbc5c73d555b5482db2961b6fa9fcebfa2eb9591c5e15
SHA51223bc63255f2cb6215dfff62c44b10ce7dd6750484d6cb24b5c8ecb4e758c4fcbdb2fa3bb1d0934629540778b2a41064a5566a57a7b0a3808e99060c8e4bbcfe2
-
Filesize
1.4MB
MD52d9bb23af95eec43ad4ffe8c0ff83aca
SHA1cc106dd08f8485f9ab34c1435baa29830e7d6e5a
SHA256614ca1d57752517515473fa6a69ad9e9012b59c6891bcc0307708ad8a4ebc8c7
SHA51233607fd47ad423ecedbf0c0f20dc5cedf201b971f4a5ebf77bf3175cc042d7f89b4e6fce30c52bba8cb15079f5d97f129adf74ab84579c10f6f4adf1cd3e4217
-
Filesize
885KB
MD506173053d5b794f943ada19187d81fda
SHA18cc7b5de6863fbd6616885ba7845000014b4261e
SHA2566f703bc9f27881336c84e31d2942a38afb6ac52260da1e24b9ca5f04ed23ee3a
SHA512a91bcdd81cafe774dfe11d048b096a5bfc50117a0d7938696d403155c68bc72df7d3936d1afefd5c6d5434fde4882e7c2e0517a15263cc96250edab372ca8cbb
-
Filesize
2.0MB
MD590c32fc8d2e27441dc877ba1bde5d595
SHA12276ea65fee0d2f89b0253d2167dd0cf0cb575b5
SHA2562f8a89fa184fb78fb8c1952c6c92feaf6e0e110fa2f4b55e2333e5ccf26e8461
SHA512029a3093a9b6e72454a6345d312451769fac53ad2032889cab1ff1218c0dcb1836642029658cfa1c63fc3bbc67b334ecdf3719d706194e62d0df0943d31d6708
-
Filesize
661KB
MD5cb9929b2e51710dd35cf3880fd6b3e5d
SHA1e1f0265bfee45c57b8da483afe587f6a6abdbba8
SHA25629f3121ca37717c97fb3574b87ec86927c0d4cc608a48a16606138d53f47d696
SHA512ae278abe84fd89e8a7045b713281a7325b416f93294fc56ef9f7fde4930878141bf6f832f7c40c5f05d729527c77c63f3b488ce9780af49163806b21679838c1
-
Filesize
712KB
MD5b65e505e105008aeee5a4f12e46312d6
SHA1bdb39c27e4d82d4a6385e454e50d1222597ad293
SHA2568a2c0be4eb85ec211ff5c1b3b44b6ff30c6f1710e3147edb9efe1249ae3181af
SHA512a34457e4e019f1aeef8baa0a0b7ba3b59e019ee658f6d075b2df14f9b83048d72ae46e6e91b6766e41aee13e64fec8914c4b5ee941599fee4d2efa8a53aa37cf
-
Filesize
584KB
MD59e1eb62a291b59962ed7d1bdfe0dd9cf
SHA11fb7e769d354e7c57e79e67331167b74545cb35b
SHA25691dcdfa41dd5d0f8ac1434a048b2a6673824716851842a777c415c75204ff034
SHA512e26f5b0e95b80bb7694cb7630dfafce27c29fd16e75ffa6034217e98cd0f02d95e4f0b7bbfb707137943e142feb59790a95fe4291d835b03a85404331ac1f47c
-
Filesize
1.3MB
MD5ba0bca6c3ad13bb33fbd3ba37f212637
SHA1a2228fef06e1b0469872d5e4cfca4cc423d45a5b
SHA256e591e2573dd5dde99604a4e66dfe4380ee3c074acafe584f1f7a22f30b1954d5
SHA512332ad645a2069f334bceb1b682d2a45d212a6707ee1dae8681af7a61c1396fd60e31cd105565c2c336e2c16013ffa52b3bb183af7cabb51f3f2018fe88dd792f
-
Filesize
772KB
MD596fa9c726b40c019db0160d32c921bae
SHA10c0d66814c8e2b10adc54461ae626cc9dc1f4431
SHA2564b35357291a42af87975429cb3c3f7d4db268f03b90965b417e8fcd57a24bee7
SHA51225b02efc3e7b577272568fe9535c5c954a1cb160a1c1db686e6a0b46de61d3b80c826e777a73d737813877a5157eb6d0f3c2c8b15bd71f51788bafea692d8dc4
-
Filesize
2.1MB
MD599badcf01e9c60da4cd0f6840e669798
SHA13ee7d17373c41fc6783bc253a0e129475b3b6535
SHA25613b3dcc30567d62600900b62b79a67a4b26b3313725507f875ba47705745bdab
SHA512a4455c46201af7ed3909c8361652fdf88586a7472ff22013f759306fc49db155e95eb934e36828e2c9940e91d20ef357021fd28fac89e64aafc4aec4f2d11d6d
-
Filesize
1.3MB
MD57c3b32f90608c08341d188dd89fcbfb4
SHA1fce26f17d4e5b0475de3e2a1740a2173cf9c506a
SHA256762509827683a08b03f56cc1a7bf8417a97119f169042bcaabb60000f474cd54
SHA512514e3ed6ab3b5904c87a13aab94238bfc02fd651ff938de5492df2c72cec0c5b7ad13e6776fd4e605ff29bef65bd4cd81e94a35fb078ff5af33005f02e9541fd
-
Filesize
877KB
MD5b2834161e1e99c22c6f16d0e709812a2
SHA11d8abcf2c4c70654a553de3e4a6c326ae0e410f7
SHA2567508540d176b1f6031d61230c6158945c37767873248420fc1d941ffa043b4fa
SHA512e9a40dbec6eaefaa5aecbc0d12db76a6c15f4cb283f4830ba4e157776d9d1d47fc8c425fa11f6fad7a67475daf14eb4c842e6089af8dd77e7f0f4e02188818ab
-
Filesize
635KB
MD51f49ba9a4b748bc49415fbe1155ff5c3
SHA13e002038347addbea1c8f64d7ed3bb450762da96
SHA256aa12fbb893b3dc016ffb39d1d67d89e2304f40cda285325956ee1a8550d0ba74
SHA5128d3f17e6da466045e6db37e4f636ec69881abe3197568d50c269824f98b1f015276b9fa2f48c719ab5a5bbec07b56131d6741ba78115bc92be153bff44484e58
-
Filesize
600KB
-
Filesize
600KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
2.4MB
-
Filesize
384KB
-
Filesize
2.4MB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
384KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
412KB
-
Filesize
2.3MB
-
Filesize
412KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
412KB
-
Filesize
384KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
676KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
2.1MB
-
Filesize
2.1MB