Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21-08-2024 07:55
General
-
Target
2024-08-21_80ed1851cd74e854ca554991308ebbb4_wannacry.exe
-
Size
5.0MB
-
MD5
80ed1851cd74e854ca554991308ebbb4
-
SHA1
d1464dfc870190f848db78984d86adc26aa99434
-
SHA256
b90b51a580357d7c603573151f0b3989fe61eb1067588e6e915bdabe83c07e70
-
SHA512
bc3ed8cb1d32cd2f4d6aba437b764607949365c565710bc81c260d307465c5823d8a2656f860677c592938558600c2b4c9dc847d60ba7f3f0bd7e3c1d24c434d
-
SSDEEP
98304:08qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HvD527BWG:08qPe1Cxcxk3ZAEUadzR8yc4HvVQBWG
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3177) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 23 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 30 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-21_80ed1851cd74e854ca554991308ebbb4_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-21_80ed1851cd74e854ca554991308ebbb4_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2024-08-21_80ed1851cd74e854ca554991308ebbb4_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-08-21_80ed1851cd74e854ca554991308ebbb4_wannacry.exe -m security1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD554837137645fe105d2dbcec4dfa20730
SHA17bf9cf687baa7bc09aaea21c8dfd1e0663b377e3
SHA256b4638dd0841a01cb72f2b043a02613b91e56b2b5b4a7b3d34390f278165f08b1
SHA5124c469dfb685ea6680d8843b3f8110f954f9698c8edac0813d7aaf1c425fc71ab17bafbc858eeae63713e9b3db0a141f62cc9cb023f34c0695d356905b157f835
-
Filesize
1.4MB
MD543eab8ec717832259da88821631725e8
SHA1c43ab129a11e68cd201466c0e52d242e59acb8b8
SHA256c555040d69f0a06a43ce0f853c0be4900a5313f29ec2aded4cb59b7b6a66bd16
SHA512eb51e9ba52bbf7465807f3bd20e1cbf962f98d0b1b42dfc0c5974b9f9d6ff6f68c68946eda025fa01208f28dd3dd5d8df8199900be95ead97145c756eacfa913
-
Filesize
1.7MB
MD5e3d5537335c2336930679eeeddfce7a7
SHA1ca4784c51298068f36f64a7d5fbc863de9e7c806
SHA25632288177506ed511a36fcd53a39d671bc55a6d7c8b606a3dfb9113186bfabeb3
SHA512051755e0653c811933eb5d81ef1cd6395f129b07e672d146f4718d1aecb44ccf445bba91cfce3118b59c9d961831d178a4a2d900a9e3773024a2c27494fad817
-
Filesize
1.5MB
MD5b1392838d78f78da5c40118678511ac1
SHA1de0f53289770a684513029ce804315f33f3f720e
SHA256c46d4104010ff5868effe04f52e3bd0d717b575d634a99cdf2efc8b998c4fdc7
SHA512a3b118d7d2367a344f8e0bbf4dfe57ac3c3eefb90da0d533988b0a4c3e5b1f3e63bf40213d71e002a53de711742476e1a10e444ff6805f4616ad6b1540ec30a9
-
Filesize
1.2MB
MD5d48738df5f4876f6db488b2ee2392658
SHA1d2a699965ffdd28ac0075324f0dcb53dc37702fd
SHA2564b1ad70cca7f26ccbf541419a9432de59fa857ff5cbe7101374a36aaee5ef9ea
SHA512aaddf17bdcbd73500e67629483769f812335114f6f9649ae56901bff81c65833e18447237ed6097b1cce6c23caae1f52a4d646f0e78e22a47464e592f0cb6181
-
Filesize
1.2MB
MD5f6d2ae9017bda7a085f75a4f75dfce9f
SHA1e0fb3d25d0a5eb772296f80275c19acf9d459b76
SHA25696618b28ad0e14f3f89fb8386fb16b5450aefcb2d2813e2a87f945dafee1b4f6
SHA512cbe1278b3b3a8986bcc6255d6b1f666fc704fa94b86f09b657c84f074f09f70e45f45b369d8b906dfad77b8f7cef031c8fafe89a74f678f7e7c2826445963275
-
Filesize
1.4MB
MD5edf90a9795da4ddbf34ba2b00f1afd43
SHA10489e1272ca489dd2e31137b6223c3e3a234a7d0
SHA2561bca829ddeee52ce6082ba01cb830f79f453b6a9a481eeb6a35ba59d689919fd
SHA51250cf5410345aed752effb35af5016b2440be58b256c2b593bd657f6006a1f75246afd7e38dfec65d3b92e32c6ad8ba37d27ed29e579d2883399449df3a2e9811
-
Filesize
4.6MB
MD50d6c3739bffd053646ba7f47b22f2674
SHA1a7a44660296a708af2ba22158caf766e2595810e
SHA25666ca5a3abe1f56ad10d4810d2e74aab71ba577e0522c808407cfc86565500688
SHA5121690b1071a652c2120a274d10bb4f6246d45830e349ad21c01bcefb483afcd29432688cc42072bfcfcfb82234a80d3722721bb3e71e640d0bd84636409e834d2
-
Filesize
1.5MB
MD56a56fc67182a82faf933c4ea6714eafb
SHA19e661c402ec0a54d5ae67ec4998f638e7cee545e
SHA2560354a4f06d46464c7005165a5b8caa21440a5671e5e876c60b61012f8a6f8067
SHA5126008b9605c3619eb9cb56ae8e5c5bbe1a3e3f030cd51d7c5020c8f4ee52eaf730e2b56337bdac0a709e0979b89720fdd15863b59752865758a86aa0c77db20fe
-
Filesize
24.0MB
MD5677a44ac112e46d79c2b9b5570ee1091
SHA1d69d13a9b339aa3520829f4d7b317c2ecca55e4f
SHA256af3c07b1f62942a2291f1692de2ab2897fe113919d51c5921fffa95d29502719
SHA512756e2f9e233a527a17b53af23e21288d64651b601459a1c1b4f6a4445fc21a3cb76dce717cacc4e51b828da94cd55e1a121ee0bcfcc00511c6532ae862b05c33
-
Filesize
2.7MB
MD516a975e6d5a008ca1a201d7f15070dd1
SHA1f077ba43f341f2a20311d15ea0dfcd075c8eec13
SHA2566d1b0bcc7c2099668fa52afd3ac05135659e08b3f891a19c2ff09db160faf092
SHA5121577b18e7e93bfda003cda3202eb5bd0c5643e14786593ff6fd05877b7a81735bdec84ec7f19ea064a2d780a9506c7a321a6edcd6caf7048c0a1af3cbfa59517
-
Filesize
1.1MB
MD5845125d9f32ff1bfdf89e08eea8f2038
SHA188c4a01afa00b70ec6f9d1baba4f0b9098b405af
SHA256c24d65f811b009035f11c8dd82afd7d24c7cb00cec7ba17fd9243c62154de0e6
SHA5122603f4a08ff528e269c946c10d8d5f252e4444c01b15f1698e311b58a5f0d0335d8fc7fff65a8b28545e79f5367c7fbd04f749d21db7383667fc78b4e2bb9000
-
Filesize
1.4MB
MD523ed5d420d642149ca0474a7142e7386
SHA157dcb08f2dc07ed96721e12d489536f4ad544ff4
SHA2567406c74c030042db73b86790f48a1f2d1826da59305e2fa3ddb64f9a44bb501a
SHA512fea80e2e08d63cd983b40f0d36b9d47c65b34a2452913530fa20859981d7c45c8ae5b4af845dd97ff9120824ab58f9cbbdf004d9f704f0094dfa15692ada4a4c
-
Filesize
1.3MB
MD5d5aae1dcbb17cc626623f4ba21a3b689
SHA1329e9988b948f01f9c7d60e6f8b96572f248cd91
SHA256d370fa1d6db9d3557fc58d02fab9c7916c597f74c119ff0c21cc146f4d02903b
SHA512bb172a144138c0f280408cfd61ec3609fc211f042c06ac0367034b225425cfb31a1b07445525d3bc2e7766ccc5da00e98455d42f7447e2df7d63d8d6b36f49f5
-
Filesize
4.6MB
MD5a9267196bed024a2b222baface4278b3
SHA11a1dee830a030cbb1528da1773ecd2ea3adfdffd
SHA256ed5af4a02783982ea0d4636d111541e0934d489fc005e2d023a1b436c5dd360a
SHA512c23137f2ddd12f8d6f3f2ffe426a84ff031ba32b2b1da59ccfbd78b9ea16eb3ebf2df56600a8c66646d4b7409dea8d43cc664e3b302ebc80db7756d8729172fb
-
Filesize
4.6MB
MD5a226885e0adea31177ec2a9f1b3f8274
SHA1196b3eeb455f25a825f20a4af81e234639577953
SHA256d29c8c1552ace63312aaac9fb6de8a17fc7a4e5ef77851afb5919fe6ef4e58fc
SHA512a9cc7492ba79351431ee6fa4d28d552d7748733c110c7cb8f605c12067be2913d75c403c6ec27c7ede54780f999334a196373945a39adb8a7a7e04f361317797
-
Filesize
1.9MB
MD5fa138d8daf3b2ef278d5e50e017ba5cf
SHA13dd91698b6e0955a3148b9a76a1a3c4c3c64b321
SHA256454dce469f7917d62eca6f151936a24e812705bca28c1f1658f0049e0604c1ad
SHA5127b4ab7ebbd625ae019687101447ec6f7f418794e731d7aee131269097adc3f41be232d5df26bcbeffde69d04f5bfacc4f8481ccd4003dd7c55a13605db089960
-
Filesize
2.1MB
MD5471303917b1c51ac53b59a3c28d322e4
SHA12568f14aacf1edb6bfdf69d118722ec3592de98d
SHA2561635a24592f493f917a77312981ff8c9202a624a129d65a49fb97c0976816d34
SHA5129d21b5f5801bf832cb90945d3cd0e3ff0608727513a08640213dfe6cfc7fbed2c34889084a15f08418f15adfec2ebb0dcc482a9669d1322fa3aade2489fadc99
-
Filesize
1.8MB
MD59b6e75212327cf752c1f437f0efd019c
SHA1aa553c9f9b06e914278c552f373013175ea6d8fd
SHA2566798382d498668f9075c5d0f1c8215aee717ba09dbc009d517a9dd5e6f436c9a
SHA512d25048ff1517818bdb5afefad6052ee4f84edeb03ca1d3a775f06b981b6006179819ff27103e730d7b4f471626ccd7ce9e3de26658bb6182c3e7de96a78a811e
-
Filesize
1.6MB
MD5864aa386d52f6329b2c49f0ac9229853
SHA1d9cddd35fa05b886457f3555ef9069defb50df30
SHA256f68c2774aa719652089d586e67d97474033e817ab80aad2f6e838441dcc52faa
SHA512be60cbcb4d8b5a68c7e73c8742cc99a4cb8cc9fcc1eddc0f2136bd7d071bffc6f00368b2b524c418c7b42cb9d757f887a668e31d1392b4a6ad04a8e854f955e9
-
Filesize
1.2MB
MD553e962476f76d9e76d54232373a47704
SHA1cb6b4b1fccd304d0e7aaffb65954893d34b40394
SHA25656340950cdbdad6bbdbce7c994ed85a989cec2a4bb64a59635d20f741f0c06b8
SHA512458f1558c3dc0678285ae127757a0e9b6d76edcffa946ae504d1262d9897b8911dd6ecc389b4b75476385c4cc9be6bca68d04125e2896d056e1456ddb309338a
-
Filesize
1.2MB
MD5806640368f668f4340f21dae1b8470ce
SHA18844596f8479aec2306d73130513cd7f02fbf07d
SHA256d492627d735b4ff0fcf51b53a495a99c0025b9d202c2f9f9e73b97f33704992e
SHA5128e45386dcf0dda653a61f65ddb4b77ae7870474bad71437e4896037cbedc799a4a82410a02868134b2d4100e607a533eb88bf153a08bd0b11d149a7927f45713
-
Filesize
1.2MB
MD5d53df3ffa1685b3ddb5f240a8af74947
SHA1e2d025a745f7946369aec6bb3bb1b0c844f94c90
SHA2565f0c6b40e5800fb0c6b240e6de0c09f5271ea3ed6d49ad122ae6cd37a7051330
SHA5126159074b88dd8afcbc48fef08de9329e53997e0a15ac231efeb338dd76557638903de416f5a0df3ff9cc52a8eddb7d3d0e0b2a295a9b5926026781c251372837
-
Filesize
1.2MB
MD5c022c4c87a35d795bfa4d73efc729179
SHA107870790a369e3af14063f0ee496625a089418d3
SHA2564e8341cc509c1d37cf4178000818b04950d233c0f277cadb5710decf2ce34da6
SHA512fa5cab9d0e50e16897f8c5786e141bc15d343b9fc577fb87b78a0902495f27bf9830a426ef4c3c9b541f77ac5953d2a97b5e94938474c029596fb6ed8bca9cca
-
Filesize
1.2MB
MD5108162282cca65bf97ab4f05502b18f3
SHA140d4e9d8e3848eff9b94800345c5b4e7482b27da
SHA256899b5186b43a3b4210242e8fc8f7e3bb69a01b51c6297d82ae794d93a6be30f2
SHA512dc5e8b5370d4ac8c963917cb7af99060b1388a7c1b9736dfb981010343cf899fc465dd038f5cd0ff8e3723613763baeaff4585d2a58954bfd9579d30ddd600fb
-
Filesize
1.2MB
MD50215e899f30e790edc2824e6d4cb4ab9
SHA14ec0e9de30cbbeff4974bf913789ec08f17c2bf8
SHA256bd76fe11fbbbca185365231855004a9463894456f55e38b74775802f95de49ec
SHA5122db51f36c90c12af892909a59849cf6ce6638d16a864f364e19b5a19c38e14056f09d29fbc31aeab6c911d0ba61fd5ea7f6a68ad681992b37864b97b6937d166
-
Filesize
1.2MB
MD533e3c5c8bd47d6c200a4c553c867eb9f
SHA19e5d19f4c5c7105010e53b69d587af6c8bb585c9
SHA256d7981df4d0f8c9ad7d9a62c7da36f6edc946576dcd8b59a41af3432d43bf98b3
SHA512977e2062c16eb0dcbd5d6c7b38543af45d5f7ad27ddd27db6119c93acf40d8df46dd07e8292f9f94cdb7bd45b028c9a3605c2f70844bfd55ad6d5824a4054f69
-
Filesize
1.4MB
MD5d7f60a3876c3ea80e2663c3c2ba028f6
SHA104e0dc0005a7f5657d72c244c4211878d62a0d9d
SHA25679a840ab2a3ec0fe521b60b4f881cfdfa6d1e847347519189225084c00df35d9
SHA51255530f0787d1afda2bcc126cd600e02f80a80ef987b63d857face88580c4b6f66f44661b617bde7a12ed21811d4b2380eb056faeb097d9f1d81e860d9056f315
-
Filesize
1.2MB
MD56eaed262bfd13cc0648cda22992e3042
SHA1d62ea9e0123bf30e6298425e7bc4c902a19aae24
SHA256372ce5747774172a6ecf1e3b771746a1c8ef5564b525ad5a843d1e8899ee3013
SHA512b68832197d19f20c9c6c3a7d391bce68ee28bbf609d239fb0ce71d1771024fd6e5ddc85925f87eedd6a5740a2432fe63a14c35f84109195c75ba272c9834a3bd
-
Filesize
1.2MB
MD51eccc3fe011c07f646cb5217f2efce50
SHA15d4ed595a9922c2f0eea0b1e06946fdce728f4bb
SHA25654356205b7a24967703c07298aae6a844b2b6f344c3f4a72fd9e553108d5a850
SHA512ddeb5e99bffec3427ad6d0de51b1911af4eecac6771425c3c4cadd104f4e47481079ef633618bb4772106175da88d6008b56982c76c0beab5d8ef4b564399825
-
Filesize
1.3MB
MD53c4a34dbb0b4e7807291dcafbb61ec72
SHA16c3f60da44057c0226981ae70c513d9a5c952ba7
SHA256f310cb58517ff3cb6fc6aab4d64744405941456354ed2bf17915ca3159d5edc7
SHA5120f50379433250b0b21b4d88ea83af92a57627da49c4ca7e639574a3bb94fba8e134c32d414b95121938c0a7d575cfd970035d7506be6013eb748bf7510410b68
-
Filesize
1.2MB
MD546f5170c661212831370467650934a04
SHA14cbebb3591e7ea2cc2d206edcfbb987737204176
SHA25649fc5b0d7e74a2ecd12a6f789067391df17e3bf9752d9db5e1e935850a0daff2
SHA512ea1924afc37522852773971ece9a9213f831bbbfcec212fdab34545bf4dadecc85b6d7680758c3a655b6a4b52132552df5fe1f4de71107af3d263e6b9e97281e
-
Filesize
1.2MB
MD539faa1f714a6b19239472dfbdd4e4546
SHA19fbc05d6651159e2e678a297ad54596236c238e1
SHA256db4e297ad23afe05a21811285df6eb2b74e475f3868c209299271350f2af64f1
SHA512f49f327953b877b401e9801cfaa66f87a617145c87803b84c7c10aca5c07406a8a59124d8be826a85eeedacbb853f4851154c021538fa7828129cf87dccd7772
-
Filesize
1.3MB
MD53701ee72ebbf25a7b079e7c916915a16
SHA133a5c710df2780707a279a2ee21b8b41de66387f
SHA2563513e9459a1fa9bd5c636a4cc08ef2229ea0cf0333e884e76931e4779824518b
SHA512a031ef996e23c1d703f62f1c2aa1263d652dca10d33d7bbeb673b149018e054505f9fddff342181f2a546045f0989c7e93f00ce8f5c21422682cb3c46bb4431f
-
Filesize
1.4MB
MD502bee7ced5916c6620fd43591e25367e
SHA19331320ae1ab0115be7d8ba7ca5e1998a7ab702d
SHA256310a4d0e86c3dab003bada577ed093a729495e210fa7e6699af864d258f8dd82
SHA512449f3668892763a5ed57009777a6b09426de783f8e101535fce8cced63b65f9019045d1537e9d62f2ba122da557a8e09153a82a8db84f68313c316e56ad53ba9
-
Filesize
1.6MB
MD5a6cfc3db6936a67127e69608ebbca5bd
SHA1db78de67a5b79b2dad9c4fff4ba08bc2d9c4098f
SHA256ae730e3421b65af2f607e35190d955e40d6ce0b85a18c3edee148d4e47e33648
SHA512b12ad2343a08fe53239f5cdbd5548bbf3c6b7f8fd7f31f9d98a249e58b18415e8a90ca43105fab617037c946b30f41e67c1c77421e9196e4f2441c28e9320e91
-
Filesize
1.2MB
MD53bb09121f5083703bcba42201f0ea076
SHA160256480aacc7c39669d2f0c692c5663fe7a5279
SHA256b6eeaabfba62b315b5130a94d00b1cf41f8b714610c6a5e1bb0c1a5eb9f35f7d
SHA512217f20aaa7f8c7985a720b93d6134e00b02fa87b67f7908dfa69bdf14f43090567e5f1e364439a19eae6ede74c87fc4c74b45b936dbaeb7197914c796fb07689
-
Filesize
1.2MB
MD5647753d2289401e2804340243cc54e9e
SHA1c1f09e9e40794d695d8f1fae6e0e7ac5576501cb
SHA256c0373add258e6054f87e50f118b6a527b61d93745017a1c0d7aed0293f2b6f53
SHA512ccf7fe8f11b751c14867b08a8fcc4228e2262c35c4fe311c7cee59399908e931159dcfe2a0ae4d96dced0460988761fc5e78d77799bd52dc72cb80997b6b4a56
-
Filesize
1.2MB
MD5feec3ea17fa2719d32726d41cd0e83df
SHA16fed5d5b3958c1480417b478c4f275b4ce91fd68
SHA2569c7d63dfb32ba0b739eec8275f220f3aba2c37842a34e0c081d1bda14cccd187
SHA51247342850b63f32250f5ed300bbc9b0ddb01e54de8c7c14236cd292f0f06c4cdac4cc76a1cf422a46e0172f1c40ecb953562807a26fcafa39de1bf040906c24d6
-
Filesize
1.2MB
MD52a6c51fd968bc4f4603de4d0634c477c
SHA1dceea677d386cda42309d88cf6c10702eac6c6b4
SHA256a9a98bb03e6f790ee4d6bcc1f5fdaa4e4d3ed5fad8e24a7ac50be3c4af7fc26c
SHA51237bb825d40566f5da03b41866aa696eef3791e987b5958d1a0e3cf73472ff9b873625d888e52355b41ec753954955c963be85016d5ec42fb2d59c1388283b393
-
Filesize
1.3MB
MD5fb84de768e5fecb417dc29f7ecf9b593
SHA13687c1326db078732d72fd2bb8472abb7018bd36
SHA25682ea2d57db0b6e62e6d7b32ddab26f889995bcd9165a67ab6398e244c1db98e0
SHA5122d5c16cea526cbd8455fe061db8056f5a5b877116aa8c91d69997eddf63852e9c239fabdcf6d31b2ada3533eaa7b007c87243dea04d9e070131b5acb210d4e5a
-
Filesize
1.2MB
MD53634026680854d37a0e051b5d22e38c9
SHA11d0d282abfa8d500e8d3c67bb3a6729f6be97b9c
SHA25681ca46a63f6ca8d27d9d6a527a57a63681da093f0b3c80915a9c0a62b0205941
SHA512ab4fbe883ff149cc8329deffe11446b772978fe58016f1468156c21f9b06cc1edb77e3c40bd2e4540b0a72e78a14cb5b9e141df5c13447c53e4767c93f6438cb
-
Filesize
1.7MB
MD556c50a720ea7aa5b95e1fa006f8b1bec
SHA119f47da941dc1f1e713c12fbfb979e0a305ad1bc
SHA256c84d2c95a1e0d9fbb6c70097fb34141bde2e4b7c07c21a02ce3598e4f0bcdeaf
SHA512b735a4d9c264bd8cfd2d921a869a1624757f21566f0bd25cf35d0825d58f1fa2328baf94ea2f7a1405ca5b58e13914c6bbf0461d01d62836ba8eced5f4061770
-
Filesize
1.3MB
MD5d5e337d16f8e81105d1d3f8ec5eeca97
SHA1ef175e1e82bda1e5018f57f1b9412f985d404983
SHA25672b7d8b5e69f547f2311a89cb1525bd5f76f5e63d0e805c1515b737ffbfc9c55
SHA5125ad0a3982fbd540cf4ebc1815599a22306ef121b4de42a49e127eeafb301f4696c0775eaf3bdede95ae048cf23c00bc3275978b29a7e1e9699d06e553470c975
-
Filesize
1.2MB
MD504ae99bf259b830b5a2bf7cdc4e06884
SHA1b04b117d9a27df20fcabf2dc5838dbb502c921ef
SHA2567181f651dc66d8f5129b496c16841cea5df232ee47cff2d3ce28a3e7a2eddadc
SHA5124a99c736a44a42904cae1bb188aee0635c28007aac134db4e85ab64e4c92137d65cddf9cad297190faecdec098fa797ccd8188b917d34cfd06af68dd37e24422
-
Filesize
1.5MB
MD53c4bf84f648941ca123108a566c1ead5
SHA150581fb94cda04e026fd382e940db5a086ab26d6
SHA2561045cc7b41cd2e4cb6c7fa639ca3277872457bcf8f6ac6547db943008b4e5de8
SHA512f463008d3032ad820afe588bdd9f450b1a68874f5abcb2195c603ad2f231cc6b5dbe1b6bd1766b254691254e77c18b70a645c011039078fb85fc14d88c538b87
-
Filesize
1.3MB
MD5490b3e779c94f522c6a93070b1d067bb
SHA129bb0974d6bf3650fe937080444656e104f5c571
SHA256cb0a413ebdd8a6f56d07c5547c2d36fb5f8f94998273e703a8c4793567bffc1c
SHA512423fa61c0bac0093059b2bb284559766f90eca3bcec3e9067700e3502c75897fa21321396147d46daaa86ec5c43677a79b2e05c1253431adf9e2da717492ac95
-
Filesize
1.4MB
MD56e42416b52f7dc0eb7c14818c78d2cf1
SHA163bdc0771c4b3e5231ae075c2a22748ccc4e9dc8
SHA256230b7942a7f72bdbd50bf30088cef2eebadaa80649711e72bbfae57c8d4f881c
SHA5128bfbb1c71cf8ffc9e222c250d032cbd63fae3f6b5b5c79606af686dd407da8d3c6969e064ae18a8449fb64128fa7b0ceb8ac6b10341d31c52de35095945ac2e5
-
Filesize
1.8MB
MD5a3cffcfd5eff80bea9ed2e9894fae1d1
SHA13407e2efc7e3b0afb6d35936f2e05bba8ddb2225
SHA2562ed65353e903300ef061e4dedb027617f6a6da02f87746ff44fb8c898dd7aa59
SHA5123ba1c7c94e3202f5bb581234ef140d25fbff35f5bfd668ee157046994c4cc0f3faf4e74be4a6a38b553164757d744681619611f2f12f37c5b8cce2ada0abf79f
-
Filesize
1.4MB
MD5bcf8d02711efab59fc97ad5e70f44f2b
SHA193d088d925bd66cd286f4501965884c4c0263b69
SHA25633f8e553b730812a0939176b146a4313335b4226fd9b7ee9695494c669b7212d
SHA512d79a57ff26e125e488620b14ca08d8453a5d4f60d61367123ba29bf7446b7db95cc3bbb78adaa4f6a42fa19efefe26a71a2a1393119bb46fbff717e3972a5e11
-
Filesize
1.5MB
MD5c29bc41827ae86b6461e4fe03c2fcb26
SHA1a417515512dfaf8d237fd050602b8307f7cad1ca
SHA256ff474117311c7cf4296bd32dd49a796884d82c6b78f940bddecd00a071e57ace
SHA512682ee1fef911dd570770cdcb02b38761cbeefae9930e057deb25f43b500882fe265e3aa91547e6894c4d6655572f4e83828d606165ac318598cd7d7e878a7f73
-
Filesize
2.0MB
MD57ed668052f27105523b4decbd38fcdd8
SHA10ded32ae03b83ff28b42e1ea250b89685ae0787c
SHA256499a5dbd2356124d8ee60cab83b05519c9e03f1c49bf8a7ff239a388e8316456
SHA51279d77144f2e86171b1c4354c28fa5a732f62061771e98466b95aadc1b24aa4fd628035293b6e5364d3814e118922e984522d441f89a148b27c5a5b32305c4d08
-
Filesize
1.3MB
MD5e4e8a8ffe8302ae52335e330268389f9
SHA191ba02a89319f4ad01dbebe7bc0914730514e8cb
SHA256a2c985e89069a44fbf8cebb58208fdbc29372779d29981c14322f62d198da70f
SHA512dc8b400e46515df6f60a472268c5fa2f7845aae7121adf746dbeb0e9bebb163f17ee16b555d8a11116505ba1333ae2206c80c557b35002374228a755eff64713
-
Filesize
1.3MB
MD505583ea6367c36dd69c6ad163e3b9d59
SHA1dd1b555a1664a58b561a34d6b5769e2acb613151
SHA2569780d9f1ae80dcd8b9ef5d088df264588560deda99b36e7c292996dc1ef4a09c
SHA51237f115f9a62a21b6f775771caa06f8896a69ad7008bde55732fef45d1fc176dc843d88905f5a152d48cac1962f41dd0a4057853ce0e25aad90821fce85b5ecd4
-
Filesize
1.2MB
MD5452a4ea3c0bf46d90792576dd13ffc26
SHA14ce10bb1570a90103988585bd70b5730b542bfa0
SHA256ffee1afc3e22c948a422a26463774eec59c9b6cf55560b8e6798d5372e72960f
SHA5127e02bddbc3027cf1f886fa33389caba9a0f9d82b1ab4a969f133c546b668f2f36e55ac9fb0ab17dc78558fc41251c4390b4de70fbf75ab1d67268ebf9ed4ba23
-
Filesize
1.3MB
MD5bb87845a4d9488eecd629acbb92d118c
SHA1886121a42029ba46c44a76101cc1830a567fa09e
SHA256ad7fbdba68f4d42a676373ee60f7737e5b543aea83dee497d061e3dc80d5372c
SHA5121e1c2840bffa1cc5499c4c7ea769685ecff8a13d726eae26ecde05c3c7d023973d72ba94c28de556f7a68ce8f1d23c4cb827e215587a6295c3608610b7759e3c
-
Filesize
1.4MB
MD553c99e9c947ed0b947b7d964eb0f7455
SHA1dccaa7425db8ed95202966315f646e62d61b7c7c
SHA25630b72f91ceaf158006946f04676df22e3394c29f0e21f616ca979931c2c9f83f
SHA512517fb95041bf044a03cba7fb603824406a928de942e3ebc6d96ff98b04a5b2a7c45db35823961dd7f557b474e7f17b73e60ce72ddbc78d775a3038c4a1dc1639
-
Filesize
2.1MB
MD59867f4303b879598baac43688f5e1c4b
SHA14b3e55818d6d705eabb21bd130eb64580eb07117
SHA2564ca58f69bbaa3f40a14fe69ebe952c0358eab13cf0f8fda8bc358b5e165b8fcb
SHA512db6f9bc1e90c59282712578d1702a61a8d8945a751d539bf4b931911ac4f63fa90c00d2cf2489b2a5f99801374a510113bc125b853b506ee1b62f1dca930679a
-
Filesize
1.3MB
MD565a5c1d1e3bde47e8fb9f72f8c2bbe90
SHA13adbb5db2b6d98133189a2608ec62bd0a2161ea3
SHA256bd8f66996d7a8c1837eabefb14c87f8529559ecab87e9563c51f640787950aa1
SHA51278967852afceac7242e14458482890d9f3c7a310a6e38c18219334bf3f282c8585466d1810dec5a7199e999aa020996a3a9c0a3a98fdd88b2d6a7767918cb792
-
Filesize
1.2MB
MD58892ecc88f0ff98d257be4da69bc4e8b
SHA161e6895701b25d100f96297ed4e3c92c4bace92a
SHA256a4112267d663d5b2b17fed015d49f02dc4f40eb89caa9d820480d4531117db07
SHA512e26bf1733335d92545d00476c2870b9b11f1ad16e3feef51e4ee1f00e66d8a51807af3e26d729577a32df602b635b6301931528f28903bfe2f456beca84a66ba
-
Filesize
3.4MB
MD57f7ccaa16fb15eb1c7399d422f8363e8
SHA1bd44d0ab543bf814d93b719c24e90d8dd7111234
SHA2562584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd
SHA51283e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
7.0MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
7.0MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
412KB
-
Filesize
7.0MB
-
Filesize
412KB
-
Filesize
7.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
2.1MB