Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2024 12:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe
Resource
win7-20240903-en
General
-
Target
2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe
-
Size
5.0MB
-
MD5
a682153626acdb4af25d9e8bb7603dfa
-
SHA1
39d03991372e0657a54fb589f52d68cd1769c765
-
SHA256
d7751d786e37e75082356edcb79f1b2d5c3927580cfed8cfee51ed64c368b517
-
SHA512
79ea03c6e67474424499db62e9ba6b522c6c3b9c82f021dea9566c995ca1187f7867e1aeabb2e08cc53ef0860d324c75ee6908534fbf297e3cd2f8524f2abaa3
-
SSDEEP
98304:I8qPoBhz1aRxcSUDk36SAEdhvxWa9P59Hni:I8qPe1Cxcxk3ZAEUadf
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3237) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 8 IoCs
pid Process 2192 alg.exe 2448 DiagnosticsHub.StandardCollector.Service.exe 4692 tasksche.exe 2160 elevation_service.exe 1352 fxssvc.exe 4256 elevation_service.exe 700 maintenanceservice.exe 2660 OSE.EXE -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe 2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\20dc35d894857919.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_80171\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_80171\java.exe alg.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\tasksche.exe 2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2448 DiagnosticsHub.StandardCollector.Service.exe 2448 DiagnosticsHub.StandardCollector.Service.exe 2448 DiagnosticsHub.StandardCollector.Service.exe 2448 DiagnosticsHub.StandardCollector.Service.exe 2448 DiagnosticsHub.StandardCollector.Service.exe 2448 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2368 2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe Token: SeAuditPrivilege 1352 fxssvc.exe Token: SeDebugPrivilege 2192 alg.exe Token: SeDebugPrivilege 2192 alg.exe Token: SeDebugPrivilege 2192 alg.exe Token: SeDebugPrivilege 2448 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2368 -
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
PID:4692
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2192
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
C:\Users\Admin\AppData\Local\Temp\2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-11-28_a682153626acdb4af25d9e8bb7603dfa_wannacry.exe -m security1⤵
- System Location Discovery: System Language Discovery
PID:1228
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4996
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2160
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1352
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4256
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:700
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5320d44d5366cf0a592f9cbd303c8a3da
SHA167d2052439976fd4c6fb515884551bbf6100a648
SHA2563fb7ad83415da36773c3fbb0a077e716adbc3a2beccb9cb6198fe81c2dfe390a
SHA512c7bab93164b4a7bfd186757a4bd38c0a554dea88f0587874aed746bcc66dce568b2c0155a5e30448f467a58cf9fdc29de4a7750c89570db0319f17cf445cf05e
-
Filesize
789KB
MD5e51ed40ef2c47b4bfa3c035b448e0c0a
SHA1f08fc57da91869a70a2edbabc2d621562906279f
SHA256015b39af1ea4d6cc045df00d92147166a43e1ad09bc13112d93d50f1cb22f8d2
SHA5126c932fc6aeaf8c7384c0f78bec4af2a71e4917693d7257d2ffda0e2f8463652d657ba17ea2f6852ed66acfc8fb87b74707c8936f935d01104f4f1801819d0fbb
-
Filesize
1.1MB
MD5dd66ae9c87e9e5368f179c81c653f241
SHA1e1bfef5a66ae136e48c88f87b3ba721fb4ed9d8e
SHA256ffb1f0b836f32e87fb6eff97d9430f838e82f498bc3ae728b0166bb33383063c
SHA5123f4587352fc2bcd9ec67b8cba64e17e8225dfbd252a9aa4c17b4f5715b43cabe14e288084f9a8a6e6deb0599068392bbac721f5da6e437abdf37c86615c66db7
-
Filesize
1.5MB
MD504169070cdc5e98a71872e4cff04c5ad
SHA10df5675f50de35775289b4b4c9060c5b3e630b73
SHA2562f9dd9218a26a173955a896a2327846ff1987e8b00a39b356a12d3ad7b3d31c0
SHA51238d9c2f65ab6000edceab4081abbf2f80c21d8aaa103962813481df348b97b525d75871fa139f66aab74ce82941b4c41b797d8afc98a0097af8675e5020b5aba
-
Filesize
1.2MB
MD5bb022023bdcad8ce0fd8e4e30083853f
SHA1eb32138b0b0842a82cf90df7e9731ae81cd53fd7
SHA2565b8d64ed2f90f6ed5d39850a7e2927a961d6cdb3b1e2360ba39ed03a5cf27899
SHA512bd3357fe155ec52cc00de3a8b900c7f6023d8bbe4307581e0acd54392dddff24c375d30f30edd862a0bc31ab652ef4de5da49e77b6ad0689b091275e17309b11
-
Filesize
582KB
MD5feb294c89eb9b330abfa2ae6e8a7346d
SHA17eab277d641a547be114d9bcce8eed3da9fe89d8
SHA2566186ddaf1fb091cda4e96c5be47c01e4692727d5c05e6382a12a20e3779dcdbc
SHA5126533adc513097f8bfef96fe327c058273b71d53dc2e2a544b57879581bbc0ffa7eb99d95e07cab9ee766821f5ca91fc6392e6526af65e8b816d680b7ef02404f
-
Filesize
840KB
MD554dc88258589f4b6bad8ebf223ea8d84
SHA1bd1f76b74a6587cc81e5be313a299af842e85569
SHA2565fa9d8fcfbbd251343ec7e019230c1de084f665c1b0ad87ab00819754e400efa
SHA5120a15971ff574dd687c4bbeb36c1a683de61cf1cd56dbc20c3bcec728e15107cac1f1393070592ae2bec87f0fc1b5841fd3e48c3c524daaa211f5497b6b088d00
-
Filesize
4.6MB
MD58ea342dac1b020dd69df4f7514d1481b
SHA1b09156715bbb9eda1cb779c925cfa20acbd4da26
SHA25624d099bbb4ddec1068c19c51f9cc265762e30ba1ec6b4838cbc9b3f20632e82d
SHA5129a35a633c55e6f5bb050de4efc2b12362b80c87365d382010405b29ce7f7319c2def452c461e2b947f6d169e7b67fac4cb606d36112a4c8acb13a4e1a8198c96
-
Filesize
910KB
MD558552d7312608485d5a5ce94828a3ab6
SHA1b2dcb8c0823391eba4a5f166f5466305aaa90ffd
SHA256dd3d7f2293c72c22675ca2965b35a8a97085661ee26f6a9ba82f856447f394e1
SHA512844377a1f450771e89213ff3f18b3e1d7ba3cf25cee902d8ec9350a5498ad060d2d1de4dadb06aea26101cd0ce040b20e828dd71c29cef19d5528bf1ea548054
-
Filesize
24.0MB
MD56e0d1fcced79fcb6c50151c39b7b463d
SHA1a0a1dce8f98438b1831f87c8eaaf5d5e0a5a6387
SHA256d1fbaf96fad86fd52136a57c399f9f4bab4393fa5743a8d02ae2e54e15c2cf3a
SHA512dd3c40ba3c86a933c35f44a5175e8f3599ab01787aade6ede97bbcac2a91354d5f8bf036eade71ca1973276039aff072dd3fad605f1b76f105493172954f0293
-
Filesize
2.7MB
MD5e33affd4a8af0ed120d2e1c5190f631f
SHA1a024a3d894d20e1bd5099d1bb07826afa9b6a2cc
SHA25641f1fecfd86e28a219a0e3d181c4b63933621636453e8484677f978f11dc4f9e
SHA51271aa435478ce6992c8238446a821999bba18acfb067b838bc19aadb0800325a883543f146be7a3daac20645baf87758949e09f101790b3936ab37b45e8c6d802
-
Filesize
1.1MB
MD5739bdaee84b76e8a3818f1c448b6de2d
SHA149a7ba84eee26e800487cbd8231997e6c766287c
SHA2568996442d75d516c23cef09d505ae73dae514b86872dc4eadea60a75be7fa9db3
SHA5125f73360303e1b4d95a9888237f291439322856b0e9c41de5d1e7732b68a79e14993573ddcb19488ea2f92db144644ae29da1caf888401acab35bb75972290739
-
Filesize
805KB
MD5e2fd88bc3b2782400589c49e948944ba
SHA19c438e8c9be37dc24a87f8eeeda683216d6b73df
SHA2561152e845c821839bb1cb78149f8d2ef32ea4527b5948517af63dd1ca5eb7258b
SHA512a20cacc9c3c3ad4e1947e9cde4aee696423227146f54590b32c172e8715dabfca52daafde1692da88ba3622fb57196964a3a5f293e525f304efbee65eed7e782
-
Filesize
656KB
MD58bd9c91b15042dc52dfac87aab8940d9
SHA14444e721066cf3efc4e89c04b1f506feadcf1da6
SHA256eafab907064a95a9a019cada74b3444ae69d8b12e93de2bae8c93eb7c0aa5418
SHA512fec9bea303d360167f0991cdc6e9f8e04c4dafb100bd5239c1daa45885e244901b054f5b62bea7a001ce23acfd5bcaab05c960e53bec748ce761e566e679f64d
-
Filesize
4.6MB
MD5ab613cddaaf2c87dfa33c37134c7f6ff
SHA1e4588964d5a5c4a256058c9662a6b8d9613d6e6b
SHA2565af59809f63cdf6dfabeb78270720c83c2d57e8c55ff47d2cb595d9a47c4abee
SHA5127546a3ddcbaeee992781882363dbd49671d02ae88ac43a75eaab61e8f62a55a6cc5d5407d33f8e9af5e64c58d49e7fd9437a450cfd9ee3d2a58e448b74e3d1de
-
Filesize
4.6MB
MD59ac33e46a689212033bb92f792d12b67
SHA15ea0aeebcae976c10f0c02b7cbd8489497829e25
SHA25640eba9bb7a1d2bdb78eb6f8f95fbcbf4b9e27166ac6ba18e87ffd697c3b9ee7b
SHA512d0ca54ba0965b3cc157dc85647064039e7df6105f60732ab2f829da2aeabb80ad6f2253cfcd784df3cf10b5413e8fdf974a736270611cdea582b43027fd2cfa0
-
Filesize
1.9MB
MD59ce91af1b823f066f134a79435ed7208
SHA1e73e94ddda79c278c2cf0e609b03c6eb8dd60920
SHA256fb2da7273bd7d3c38e139f577da1d8bb62d5e550994ca96a8db619237dbc6e38
SHA512b7e0a78a461e518d1c78e7c3f7ebe44be73b377a6d953b2e5ca87cc76a833e4cb3e3543e59c566b7232e3e4d189228399e203d67416d90870ae23602cc9ce8c1
-
Filesize
2.1MB
MD5a6bd9f138976f3c9bd9feca37c5a94c7
SHA1aaa73c48bfe0b751cbe81bf33419d03cbee9ed14
SHA256f8fae813db92dd706225ca6507c6e0227b0dce765294b57cf3f3e9ee4465b633
SHA512bac61e604099ef82df2a860c23469794552f098f18a3b609b77424b6080e1606420ad48a8bf287e2f4ac219bc511688819e46a93e41edf9da167ffca8432e2c7
-
Filesize
1.8MB
MD5d6ddc4e7c83831da87580722b1912c12
SHA11015bd51c48d0574435b040698cee138c69e76ba
SHA2561feedd8e1d5c25557b1bd8ac8139d17c01b6e25a249d167943ffae1bded356fd
SHA5120c0044b78a224fb3a669a6d64f2bc2a794e3c18d6e92ccf08cb42593a47a05abdb6bd56d12902abfac91c96f3b31f7046b2338673f93ba6b99e8eba85896f45c
-
Filesize
1.6MB
MD53cf2a20b0c7fc67e22102c8fc0832d9d
SHA1692f4471a3f1074eb2303209e2fd180f5073d76e
SHA2561541184d3305e7a0b8db0036155621171a3e3b2158a2be09e1b47f97ed8a2536
SHA5129257f0d9d44bec5a8fd69a4450a19354f775ae68acbfda63e018fbebd3e0305d652ad50c5c525ccd75e3f8b7a34a3388e63cf3fe9d8f8de85608118f9eedb212
-
Filesize
581KB
MD5145e891f59074f41ad08a6625ad010e7
SHA103798c0f73d23fb3bf6ba5e7631fbe4d53941508
SHA2568e1199ddb49a0956733d3fd221686b3dc53356c27756d28c4173bd1278d7191c
SHA512d76f48773434555553676a21b405a41e65d0fdf8ccde09bf4647f0fe73194fdb4d8dd5a621b0eb81ec0bc78a8a2a8328c360849851f0e2aaa8c7caf414d9307c
-
Filesize
581KB
MD5dc4cb237ace70e388ad57f9c4d152a0e
SHA110aab671ecbfbbc5bff9087edd9518e2824ab107
SHA25646887fc9483ade9134bd28e145f9031b92972160213abb32dd6134b70035cac1
SHA5123a14b54537b931305f47a16830fcc708e806f6849c7f7df45f9c71993e09dedb855aca7094b61433574547d4ca0eddd2411de2c6c2c55651a36c0da3973a4c10
-
Filesize
581KB
MD554a49bdbb20f037045804c6b0c203cbc
SHA17d14cf073b9f2d5f13336c43a91bd21fdf153895
SHA256342f0a4d93ebd8bfd17f8d67a6881af0fd4893ee7f8dec2d1495ff6ebfcacefa
SHA512edeab0ddb3409b0b4c37f52572019a3daec9e3a93cb781c4232b954550cfc11fe69af948e5551808694304cb26151568f49092053f64cd151921bc0aa53a9f2e
-
Filesize
601KB
MD59ed154eb047f4edaa32152c3b58963de
SHA11edc6f3cb8846c749dee7d2679b61e14222301c2
SHA2566d5e3af82f9031b154818a1e10999fcf52cba8911f0456a9b9d0732022ff9584
SHA512616c7e5a11f0a1c36d762940fba6878647a4d9630890bedf4c9368ab962155052e6a39e6ca3784281729cf5fec14bf4b2f5d0f770b01cba88accef6e7ffe4c60
-
Filesize
581KB
MD5f1bfc6a6ace84c2e38a9e05ad402336d
SHA1eb68252d2bb8accf251ed6ab5c54d0d357b7fbd9
SHA2569ff6404573c06f2653b01837d307a485047a1b24f10bd512dfbba46026e913bd
SHA5124be575d9e35c752ce816247730ca2ef4245544349e42a78d71de391206581cd1abf46c85396264b043af4d185357175caf70528f24b9e8c638b33d41239fa1af
-
Filesize
581KB
MD5fe0e71c248afd0adce6de153d8a9f0bb
SHA18215f082618dc246fc7adb4c025b48f16d0be3c3
SHA256f42931b9324ef13ff13177751e82f185b1f6c98d6a9cdeb6bdef09208df46b42
SHA5127821bc195eed1db98bf5ef46660bb0cd04888697bcfe9eba9c15f8537f02fcb1f0bb66f3fce54b940eef26843fa8de66d0c815438a876fc0a487590c07335074
-
Filesize
581KB
MD51d33d1c143343a4bd475276dd553a733
SHA1228e06997e40da0420c71a7339441b86d3a6f1c9
SHA25615d889fae5334b1a9f296935cba4cce95ee371d1db1ad843f018c6a7e19f16bd
SHA51204d8f4be99bae5fafd81f20c4eaf5345ad75bd6a389130045bc2c988019f7d3820d9be35075bba968d2fc54bc03c1c4f11574d92a89f46b2e8617468a44fefe7
-
Filesize
841KB
MD5bf356a0995ae24e06ff4f5a68fdb9b95
SHA13d49008ca7cb6cc8d803b8c6ccc4e6cc933d471b
SHA256a97fbf545c871105f4ac8384a7a74bf1e035087881787df26d53f95695785043
SHA512c439261a98ed281352aa1cff2366017ff053031993dcbcb9c2b108827ce2f23aa2f4bb581cc76070fbe8208de90e7b69eb9b15fad793e197f371cb348b9c685b
-
Filesize
581KB
MD559c85a051cb3b88c3df5100388bfb1ab
SHA13a44728b1695672bbf0299ee56c01596939f9b80
SHA2567cf198b245ffa5b8604a9690ba99859307e831cef8302b2301859c823533687b
SHA5121dec186a6026f1d4e8ca1a1f8935db45ef6a887c8806e751f204ac2451ff3cf1635835327ff2fb9738b71fa2cabacca220780e6b37133ebb689707bab7aa32c5
-
Filesize
581KB
MD56313de94fc4bde57e30bc566ebb99cfa
SHA11d768726fecc2814f4a20934e4d54188a2a95179
SHA2569f33a31a194f1b899f9cf93fb3b54def1e999320c158e1b4d3284eb4f021b818
SHA5128f27425aa1bf47024e6c7abf874b658a506fa51591bec16b05d8e301773c659a4e1e5b65946a55a5fb7500e055ffd7cc4dd2563b9cc864969dff73931c7400d6
-
Filesize
717KB
MD5b8334f3105ee778a7443b562f377684e
SHA11e7bbdd30c80ff2e55123a66911803fa826fc68e
SHA2565c99ea0f36e31d105fa90d6584c3eb21c5a60bce20912474d3b70ca81b0b1034
SHA5128d7ee5bed54d1fa625e0b243fcebd161673a6db09605b9e1787a974627090f70bfb31253a0e6da7d026370e88a1bd6207cd198d8aa78666d3f82cf2587b7e449
-
Filesize
581KB
MD5b1b20521dcd1c975172e949bf5d823ed
SHA165fd26c2ba60d8619f0763311eddfd2fa061a0dd
SHA25605447653854310b12a8f221b001487994390cdca6a70e3621b537a6bf57fba87
SHA51205d2b7bfd0bf60d8dcedce1df8dfc92ebe85057654317cafa90329e787cbffa92ce4747f9ac290cf560de5a1e5bb5882297ed8378858ce19a20610977f5b1785
-
Filesize
581KB
MD52dc30a5f8dbfab5cdc8f613bde247010
SHA13d763756216a0594827d45373a4d02ab0c1d42f7
SHA256e161453a9cb19e9abdb9d8086d7a9e89a53220222a2335fab22b5e0be258dfe8
SHA5121624a8fae0796d7394bbc4ecdc8cebcf4d370f346e823a0b0ad2dfac59bf236630022cf43615f7fbb03885336a597fb6c5366da299648fa8de9211ffe18b12bb
-
Filesize
717KB
MD5a3bc8b5645c04e373690461530b45204
SHA14b8f246bc6417ac60a7f3b375ea69a0bb5c3be74
SHA256044186ebc28790870656ab75c930e9a7e516b6e24b351663068681385ea1efd9
SHA51226e709de57986525b47b4e265c975610cb3e1ff2612465670f77012f96ddcfe9592ba59ee364bd6afb3ee1c98f40cb3cacdab42961b4bb7ddfeec937e3b10acb
-
Filesize
841KB
MD5277041a20ffa35b6e2262f3329315899
SHA1ebc686fba6330e46c3a84109954cdc020bc30d90
SHA256a12968b1ffed34bf4efd034e5e57342e95d7c4c0e11bca3dee7362a2c4dfcaf7
SHA512864c09a91478b023afdd6e5c2e36c190ffef9f505d837c716587602031c0c70048dc50fd61a337bde2786d593ff7d5d4df13113d7544797731c2afddb5e221b3
-
Filesize
1020KB
MD54d5f61c7cccbf73fd6010dd831d797ca
SHA1825c145f6287b4ef9ae3435b1c94f6146e2fbdc7
SHA256e829f3424fb5bd58e1112113eae5effa340867f35be910746d733f7522556517
SHA512d0793ec22264d531c4172e56b710fe4704e7e5d75eebfe832e8f22a247d98790577a39dc40b86bd65fa1dc77d14b8590a9a24ada4a9bd57dbd7dcb6cdec0eddc
-
Filesize
581KB
MD5f19852268529045d838e7207aee07c8e
SHA1bbccc0f9d27e99ba6e1af1a9a4ffd7690078bd02
SHA2566363b2fae9b5d4e1dec2a09b13e83a8cd9949d2e6d9a6d7864fc59e1e6fe89f1
SHA5125fa91ecee8a924f0908fd4ce5fb2871bab22f9e90a9da57569cf824d0e6b3364f6126604e48422cda2df9baf72463bf98f1a17baaf4b4257337aae479de6bd54
-
Filesize
581KB
MD5face645dee650441cbe81066bf82ae2e
SHA177ed90f301f4f8f607669ff7a0cd2485e925ac02
SHA25676171e228edc5fe86210cc20d6c6ba6b8d663624bc35f66c09127391ba7deb08
SHA51246fcd05bfc3852947df33dcb9138a2bd92ade713c90c867143843caddf1b40b9d31e3261ec72b301eff66783fc351778b0bf728921c027f95418ee121f409048
-
Filesize
581KB
MD56315cbe2910c977dcb2b877cd93f468a
SHA1c1fe36af7a1c8fcea4630ebe29b47c0506cac6e0
SHA2560e200b9d8b6d08a7d54f11bcf30e2fc9a01ec67f576ce47b48c8b530bb455f04
SHA512bf92e08e7bd87a3aa8070975f03a720b40f9106ab8192d2bff7bf1ab814ed14c2c1a6ea65a8ab7032e5ab1f5458a9bdf430a7284ffc0111fa466b8818d433471
-
Filesize
581KB
MD5bc02efc0b6c504bce15c812472a5ffeb
SHA1b1ded0aa162e4fe0f14a5a53d7f4f33e5a32bd3f
SHA2567a88272a0d78fa7dadee57fb23b715bb8088080facaf0bb3cb0e25ced38e6c36
SHA512e2dcf75f856bc5d73771973b900738900e30fe83a0db43f9466b76a1f1de398dc7b0385dd052d8a092f73c873346b2a5f1b46430dc6d4c7d338940ffee49c0f6
-
Filesize
581KB
MD522c9834c763842bf48596a85ae294d95
SHA11db50cf7ed982e62e7ebe25caed4a28dfb287195
SHA25625c31e463f1d46cd26fdbb104e815d3b49051ea3fd012355cca51f962fb76c05
SHA512d0661fddf39cbdcba9dbc1491047dbfd98c8bfd8487ad1597ce9d992fe72dc586643f88d844d482cf9a10cc807b6409895bd91351f38653b54c439b380f2013e
-
Filesize
581KB
MD50d24a4daa0a60c2535e2fa4df6b8430e
SHA16d13ab43f46b4859abd82bc0044607ee8a5627d3
SHA256f1bbdf985e30aaf7b6d506910edd079f108ae6cad39abc7ce4fb43ab9fd6b302
SHA5129609de44c45fdad2b1b4e0c1a4c305047f06caf517c05d7b3bee153579ad538286e89aba95e6a7acde38764ad20c6d94a2dadf01c1a199a9893ec374137cdbdd
-
Filesize
581KB
MD520f2a90960fdb1aa05fa83452204ed33
SHA144a95b0f389961abec2f76d17671846c402ade1e
SHA2568c30aa5be8c4b041356438dcc9436a7a8bd8e29bcb04eb661fe207ddffac1655
SHA51289b74f3a1a55bf8d22fdbb7321e6799a7b90291d912b9840b3856408ae2f3be4c386c74bfd40a79c79397d10ff4e5ce9024731c1c32891f8fe39e971045cdf35
-
Filesize
581KB
MD5fd5573cc4a9829ff8e5a1367f7b76b19
SHA18b3219853935722511127818019937492cd1d431
SHA2567900de2bc4ff7695e3f038f9b75bc34eb782a33e3a139a7faee5aca5ca006240
SHA512760b5dd6bc1766bdb7b833b8d0153efe9672217bff762f1027fbb25bbc47ac20d0f061f50841141b760fefdc1568ba53b489ec874732224da3cd0b149635aaa1
-
Filesize
581KB
MD506ceaec99ce59dd8e627060f1f4f512c
SHA1758bd992a9245dac99a7a547a3b9388380f57716
SHA256e681eac67c53bdd54ab3fd77ba954b38ea2887cd5a6399f940e0958a67677ad1
SHA512aff6a73aff300acfbb070a35d34fe85c7bad3e469be1f2a9d2620829d10cb9cfd1cead6e59b2cc38f6ee8e65d903223f793c0b18fc3e8399a6c760a4993295c6
-
Filesize
581KB
MD5c0ee56426ccd37645497f3b82c87d4a5
SHA1ebe6ae65c236bf626fb7d0d3bed43cea007d0d63
SHA256e36deed09a7678ecf6f94d2c161b2565e225b6f0e407c69aeb29bdea55d71a97
SHA512fc0756f200e5e566473c1b205e3f9f1e08ad8d8a8670090f5b7de1adbd73c86faf1e542320c1e710575c2a10e2c11c248e92471f5b3849f102bcde04d9cd847b
-
Filesize
581KB
MD5c622296fd90f6be470e0a86b66213730
SHA10922007e1d44401b2b1f7fc41a4cb6d1123fa501
SHA256c4f56cd3485704bc6777fa1f66afd8ecf0516238b08510303d1d5eb88c5dc8b3
SHA512d69e7b3763541d92143fbecf0a7224e358274952a591a534943cd34b92eaff3aa8b0bd483f577f19ee926ebda3cb7772a5b9a381d845d8c5c06ada07036fd022
-
Filesize
581KB
MD58bfbb2aea24212be3d84ed91be4083f0
SHA11a6dfeff9d1460c02329bad520c2ef294bbd6c13
SHA25642d87010decb87b0297f2e6aa5efbb90ea59cd22186fd563217b01798c7c3be6
SHA5129c4a936d8365c2bc72a4e33bcd917ca792cdf933fc905899e3c589239c80c694b362c10e3266bbe41ec20850f5b9a088085c058562e2098621bec8bd0d56b460
-
Filesize
581KB
MD50309b544c455d17ed1032b8e7e3ef140
SHA189aecc322eb62b7531c7e20bba968e1a2d765375
SHA25667c46ef8f1266bedd19d826952d11287de7a53799ced7016ec8c79e9f82af250
SHA51230b24433d010ce38fa934b8d9b26a8cb555b06bcb94c7a34bf4e565eed9f239cfaddfc6ce7bb81f93db7f8c695f0ab9218a9c5ddff2c207a8743a210622b2edd
-
Filesize
581KB
MD5269e4a36db46f883677621f2716827ab
SHA15f5b2f67370a6d40f7cb9d64f9a0142ef1a82573
SHA256cd6586abb0fc1a82ab77ef301bac74bc694cea755a2439f55a68320b2edbe955
SHA512963943d2b47c4727d542b87f2a698c34afe33c5a9cc1087d4b554e9adc0f4f6acdd30cc22ad13879305e2e3e46cae6d1a28eb606a6da2ddbc5b1a9054da515ec
-
Filesize
581KB
MD541658beb559ee4e9c53dad9e8e9a0bbf
SHA1674429325a84cb69776cf7874778a4078d7247ad
SHA25640b7868d03606693e4ff8fc81824efbff75df696c59a622d5df7cb2dd609f5b4
SHA512f3d89c65a8538afb7e3b79dde0303474b8cb2a3d30a11846a6f62828e38d76693cad73f29a28a944914761b44c3455ac9d6bd871a3ec97d697d6288469817e3a
-
Filesize
581KB
MD5db6a3bffd0e0d1f254b5d6abb4a7c1cb
SHA1391a1f05a2856ae08dfdccab10a9d2dfe37da818
SHA25624d1c1a0862dd8367c80772a365dfc5000d22a2ee46c0efab1050f4eef420a49
SHA512ab4e75b5bc51f76fef70d14b686ea0a39a8d86ed79b0ddf2ff8b724e4af0ea2fe75b2e18f5ec4e92f849ce0dca34b93a5f214648eb12e3dee1685948cf8b53f2
-
Filesize
581KB
MD5ed5365e503fc0f2d80a3459fb5284d3b
SHA133a499ec9b0eeb5f8399628491a655df326b0f2b
SHA25697f39baea385e977aa54c93cf4a7b3a40d85e060627f80f282529e9ef34e9418
SHA5121d7a8da3d55a40c4a93d1ec54f2bc788a6d13494714e839daa925b9d2f2960060c42995f7d56ddb6fede1d3d0aa6a74fb9c24b41117ccf1238e9837c40678d49
-
Filesize
581KB
MD5f60243e55dabf5eab93b84796bb71db2
SHA1c0f3c8182e01a72a96f5b1a8407ce3b2da10a5bf
SHA256d6bf4684b125c2675e85df85cd61cc3c23fa972d3bd9005c3d5517d46d1b8ea5
SHA5127e1872432ae57f48d8af656938e2598716385c40dd3f821d458366f15915859d2e7c4871e624e651f95e3968669aba2b117447dee0a5995a54c28de8cdd58cfe
-
Filesize
581KB
MD5938bca7a13d33f6d8677b0bd514d76df
SHA1ac92f7a78488dd0cd1b4e72d859924a465698358
SHA2560c38fd480e1ae8b700577048b2818815721932af9a5f61f9d46e4f9560485f7a
SHA5121cf6a3e2140fb5179ce9eab398075efe9f88d3d00f9de30241b28254163dede6835be291644393d8ac1b78b618e8cb8568246a8d117ff71f21178fb3d28b6ccb
-
Filesize
581KB
MD56f08595317573d66ede2ade78296b2a2
SHA14e4b12734518397707145a83314e1df44817f0e4
SHA2566726226c1131618b1522468cb42343197917a66f891c5e39df62087af063bad1
SHA512933d52790f3bb3379b3b6e25c719d76634cd3967c39bc60914553a7370913b3fb2d49d4cadc155ea4f0962f9fa1fba22dfdebb2539b3a60198defb137ce34a68
-
Filesize
701KB
MD5740bfcb3f2a5192a3341a3c50e38ca62
SHA1bc0b5dd44a0f42f790dc2c0a8646969df1a3b46a
SHA2565d3a35389290686cfb79186f904b5cd4fde151fdcd5d8380f203d9ea9cea6a17
SHA512b10d0d72369e3527355b1485cbafdfcbf2886b6a0b0172fb1d3c51c602d7c2ec21991c961c7a3fc0d8fb7d78bc22dd7d307f582fcd6f9f2ce3b698e75ee85689
-
Filesize
659KB
MD58483f544fa7d6db78c284c6f6acc34e5
SHA12f1533bd637566029f4ce998385ffaa6b44b13a0
SHA256a50bd2d91079e4d3cba90bf0240f6b56c8fda7f7179588dcaa186e331fa3f3fc
SHA512084f2a35e32f3839ef7cb565c28447ad06497e573924bfe044823910809c81a9404d5406fafff6fe9b67198f085a2fbc4a55ef785d837dd4544708a3945ff227
-
Filesize
1.2MB
MD5565cb3d31600c7ae8025c84e60db1c39
SHA19c4aeef3324d2277580321718b5a3dbdc09c2d6c
SHA2560d05fa2f3c585f5b8877beafca2b757308cade461a1c676fcffac86547ffed86
SHA512e90c16d3ff99d4e62d3682aeab6f3586c4782eafbcc3dac1f7940ad7ce03d20d9dadcb70326be65cdec9cda4311bbaddad3da81e6521240890449a09bcfb6b06
-
Filesize
661KB
MD52e224d1c8695b8a69324f6b101c9c3b3
SHA1f03605381fdb802a45a19f74a572254caea13675
SHA256d67a0295f532913355ad06ff8e41c74a2707385dd43be5e6253fc13176031ce4
SHA51269e44b970c793e53e18d81bdb5d0eca1880445463d243cdbcdbbdf34b3ba1ea3176fb8e0d5b7a3f1bac3e85777ad316cb467948f5325251740caaa28d359caaf
-
Filesize
1.3MB
MD58f3943a7e4aa3bd6fdef1905aef661e3
SHA1fab6ef4bc050f46cd96c9c3931955eab6906de6b
SHA25642c2a80f552449df908324e925b58f092fc4f0621667ae3bf3f920e021cc3752
SHA5126ca00e4047432978c5da22884f76115f21b8de1c93da118db10f6d66434a3aa63d3bf8c1041fe712d118fc203b822fc0b11049be18d2aa237e25ff41ddebc3b6
-
Filesize
3.4MB
MD5962d4291a5dfac935ca1eff9b1e21d62
SHA14f68907deb3cbfeeb5133c44f12ae58d1c20b338
SHA25682d3aabbff37889695657e40fd52e38159757b7f909426d1a4a4657f48dd3c5c
SHA5126bbf39169cead50fdb9a5ce872ce73607627c05c5f5a040545f5c733ff2d45a4c33f54a4e2d33cad36b9d083110e947ba23d979ab570fc0917436b9e87c7f627