Analysis
-
max time kernel
990s -
max time network
991s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-01-2025 20:14
General
-
Target
2024-12-30_d24e01279e0e97c3480d2596976acf0a_wannacry.exe
-
Size
5.0MB
-
MD5
d24e01279e0e97c3480d2596976acf0a
-
SHA1
13993673bf933d5e2304e6936d7f3851844c36c7
-
SHA256
3e315a77d96b2acedda233b126f376be5e71ac43d4d5ae13d944266ac328222a
-
SHA512
aca8580987ef75f34d5f091f5e7399069c9359f7e02e793cab696ca3d10215b97604bb7cab880ede0e3f085b7e6baec97871b3f0d93cad2c5a879e571556a4df
-
SSDEEP
98304:e8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2HXD527BWG:e8qPe1Cxcxk3ZAEUadzR8yc4HXVQBWG
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (20742) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 23 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 52 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 14 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 47 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 60 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-30_d24e01279e0e97c3480d2596976acf0a_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-30_d24e01279e0e97c3480d2596976acf0a_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2024-12-30_d24e01279e0e97c3480d2596976acf0a_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-12-30_d24e01279e0e97c3480d2596976acf0a_wannacry.exe -m security1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\ApproveUnregister.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5ec9d902e514100b6882dc1c3d489c88b
SHA1af7a062154d46f18b4cac2bc569064f970a2120c
SHA256f2540f0cb3ff0e9250298c58c0373240c5466379340e80bad8f979090180e81c
SHA512882c20de947451169588c4b18a5e193bd19124fbca41378468d54864c9028c7b3aa874f5bc565cfaf7b11445f2b9a1abc05dc507ffb04af2f0708486b8c52c17
-
Filesize
1.4MB
MD549ca67a57feb6d97672f57c145a270a0
SHA1fa37ab97bd12aa525143c8242d7ccc4d3fc074af
SHA256217f82d5d2c83f7f014abc5e19505d77289391767811689350f232c4d1c360e4
SHA512cd14fc6c80b784736e52bc99ef2b97583e1a111ccc3e642b36f34263dd37752f78e8592ac65781e46bf88f58eda0512c7089c4d54dd3bd2c8626e101fa469963
-
Filesize
1.7MB
MD59a02b7a32cd59ac722c0664ab3d69bf4
SHA15394bb64aaaddc04704341b1df863a0a159bf1fd
SHA2561a73656498f0c9c48e9653cc5c654d871187930538c2ed0b46ccec40f2b9eac4
SHA512b5956018a03ed7bd5e09694d742689ba11cfbe0d57f3c56ba65e33050839508efac6a02d48ac461427781cafec8e3176345bdc9da852244fd8bf4db4d8ae5fcf
-
Filesize
1.5MB
MD599db416736299c5aeb36352f9c128b47
SHA1d293b8923528ac6436ce3ff3b277db1a1debbc70
SHA2563e18da8ff4cfe2086178c5f974a648d495cdc734491decdfcee6fb2925c2ac9d
SHA512904c57089915a8028337bc946f3e8fbb5b8833a9ee2a0bb96669f1241dc25e3b6acebb57f4036162725975d2a21793edb74d8f8855bede5d04873875861af7c5
-
Filesize
1.2MB
MD507259d46e2f94c7ef93f2a80b7d57efa
SHA15ab49944a8800038fbb9ce396bd05a12380e38ff
SHA256d3b60692ae26e00e307d1db0660e6517a3eb7304cd12323a789ab04db7529d37
SHA512e8442312c61ff36b7bafb6075a16e406ac05b289765baf4febccd4a3b3a303522e845fdea7f5506c8a3229d3dd69a866eae8a64c4e95304772fd9f07166caea5
-
Filesize
1.2MB
MD50366d1efc1d49e7d2e357494f47ded13
SHA1d65e6aad3307ca78c37ba552335960c1e9338148
SHA25688892bbb3d5d19140c1bf8fff25b4d3b094df61c02f4828bba13577f163a87f2
SHA512e0be9ca8108eaa8165bac1472fd988498da8e49484194cfbabc9aa4113fca532f08b45766e95951de3d4bccd322119f65710b76639acf66141c22c0120f9e66d
-
Filesize
1.4MB
MD5a1237a0b768dd9255c9bceb12835cdfd
SHA136eb5dc8b288abef23830d58b3d225f43a172e9e
SHA256fff176cbfe93548231b61a68db69a3fdbf20a2cd67db5a5cb06f4ab7188a34b7
SHA512195f0d30a63d967e988e09cc7acd354ccde18dd1d3ccad157ee64280e796a9025887f2fa1979c69ee4d66502c04450ef3c5e463c04f257eaf685bbe3c9d016f4
-
Filesize
4.6MB
MD5e85e68789ed88e6fb48ef9157ac542a6
SHA1d63a000d406d1daaf670d69873c98bb7836e50ef
SHA256ec4d7019ec033d83336a6c74f956c87b729268b7628d78c42efd8135db3cd57d
SHA5125f664baa3d802ceeb1db380f75674bc140ab90e31dbe3ff05a1834320367ba255ef0c2fb727403ef305baa1020a5936ddc093d93ed423fef3c470190a5472bb3
-
Filesize
1.5MB
MD5493405c3045b8c5a17a648533a7936cf
SHA1ee4da6c0d8b6a7f40ef967797e485c2a82453331
SHA256e733a522394c55bc8e7eaaebc6031d0d912bfd15a3cdaa0a918e9d1ec8aa0d7b
SHA51252289a22cd6fc47cffe2a6a978e8e8011c87de072f08692e93043f90c808714076a476612eb4396821790a248c6c74cea101b997da9d465e0ce1470cb076cbe3
-
Filesize
24.0MB
MD5d7b228ffc2e79b520e705bdab29d8854
SHA1eec53f9743589bfd9d531c1edff9d223cb64663d
SHA256755789a7879fe8f95305935e30ec26b6709ec520bbe65d358e6801cc3a9c130a
SHA512f0a853ff36ff6944c7c3fb3c771b5bcaf9a993617b4052cee98de7d0976b56caa2cb8a53850b0fac10d7902ef4162c8305b882cab6ac8efbd9b533e187b1bc19
-
Filesize
2.7MB
MD5d8574856999b85bf469c3468b26343ec
SHA1529588d85a8b29e4767ad33d803a794568caa4ac
SHA256519b34138f00f7a71d26b132749bfdf46a246e946813ddbab5f7b57ae2b1565f
SHA51225ad866d9872892eb53f6e56a29b692ee8ebcb77b2d09ce4f1dd9e32d54489a4e2d53207356ba102ba93554bf1cce6453c3a11bbe13b47e0ace641aff08e0e9d
-
Filesize
1.1MB
MD5cac5b7737d6f2c847b3487f4c9007d68
SHA15c66149828a40d508894f492b8a849a6539eabfb
SHA256151d4fab5142abe4243bed52f04393d86068e3cb67f9663158166f716f370990
SHA5121dd0a0ec8a93b07c8d1424ac3c616c6b465d786d95e9e940beec82f40d833388249b9c51921c735d59bf9a9d7e3c8efcdad57f0b00bc1bd2b8d9f6cfb9c21dee
-
Filesize
1.4MB
MD5f9b4dde4846fc9585178c3d16d0aa24b
SHA1500e8f2f989868e60a38ef171c61990b987aee99
SHA256a110cb990321b2eeb5c4acdd783f0f037ae2ea8deac5dee281d0c2b19e7693e2
SHA5129309e284a3130564873b4cbb3a045b24b82718a85550da5720ac13bffe86df893a5d4b3ceac60a7de893ab634be7cacade08a7a16b0f0638efa49c400a4ebaed
-
Filesize
1.3MB
MD5e330e792d1c37b9f8e5013589125f3d6
SHA17524aee0fc77733d61e776ac5a29eea7f170d08e
SHA256f32955592e00a65167b0973b2168cb7ae4e4b6646770832625320cb500f74a6a
SHA512e55a9daa9400f318e3d054350f8ecb65dd0eec7101c69cecf55d2c15f3b6979fbbaac5fba8fd5436250845bf28bee038e14c5cac0ad03111c4c52e4757e8f5d8
-
Filesize
4.6MB
MD5e33cf5c87971feff67fc1f7ceb93e77b
SHA1ef2a1258b7f9d553d6b42c3cb6d86e66f909043f
SHA25603a696e0a854602a6d113dc40677efe0e924c7210754f57aee90e1e9b29420d9
SHA512d0dd0d983a840eae6398b8e69f048dacba0edefee19fa537af023d32876e9bb2fb906de6941397ebfe41546a50bda014b7dd261661605b7b0bd34cdcaa9945e4
-
Filesize
4.6MB
MD5a282f25e4e008585209e6565f47d7734
SHA11d1bd73073b9ea151ad49a13857dba46c4d7c7f1
SHA256ef318785177503cdce259cc8d095b69967cc489d33dc5540ec7c6377c66e596f
SHA512f0d6bac9c62833b4b63cb60039b8bb6443176276e525dade017351388138f96faa26fb01951e3b92568b62f29870b0ecd07e753267ca0cec86f9b6c5b2460ce3
-
Filesize
1.9MB
MD550c27281bcf80a8e0c2280a53f2127e4
SHA1f433151ca0beaf3e2da134d84ca6b6d6499383a0
SHA256d5e0cc2ba7dc9eb90a26311c052bca07c611db6f94ba286b44de3c372a74e7d4
SHA512eed034e92922bf66d74ebe8fb18eac364f8e934683e1cdce210bb1d14b8bf170a29d63aae644ab028d5f1a0905b249af608f058de3e42bcbf744b723241d9a61
-
Filesize
2.1MB
MD5f7c0da50f325941b0c4f2194eac0c7ac
SHA10280bfeee0c671e21d0db4250263899d33d1c64e
SHA25662d03d23ab030eb303cb30093662d4527a72dc6f3433235576839a94dd92ebe5
SHA512a0c1e30e8a0a9d212a743a860defa517a49b4742c1b9e6bd19b4e75e80d65a93129634be93624d2ef31df291e2eac43e9db45c8f70db188cf8bf069246f8425a
-
Filesize
1.8MB
MD5ce2cbe6c947701525b8a8537945c9dc3
SHA184a24095df9bda6d37f8ec9a7d4532bda19df705
SHA256f205ee1f90299b4faf4f6ba11df677e2d94656b5e69505b82d437032f089f7dd
SHA512244f3401832b308126e64fb05e81008337398cc5c0c0ee177c01933f210e5d4e8a32ed288e3cb9c99adcefdc8992ea29c09d3cb518647bab5797483abc191190
-
Filesize
1.6MB
MD5f704453910fccaa1c91dbef04dab865c
SHA1974b3288ea61b823fd42a464467d6b7053b7821d
SHA256d3f65b1c56634a08f89ffa7845c196f8bdf7d327cb88dbb1ca6ed2ff3fd5ca19
SHA51277a15b1e98ed4a6428ed2aba79e5b0e85d48c0c8412ecec9120f3aa9fdd366a1b11959c315765560e4d31e41f894399ad23fc8db81dcd5f332ea5073f52643c0
-
Filesize
1.2MB
MD58f0d270460e22ce0ca40d1ebbe70c456
SHA1035b95e6447eb34f63bbde88046d0ae1ed26804d
SHA2561ccc7615ef0781bd239bc3962428bd2748ab485598d456208685b3a6823008c1
SHA512947bb76341d6da7b2353e2fe1e5b2cc876cb808edad63394b70c1e1821ea41c9be2bc2c87e2997701cb896a2b387ba17c0b1c6834dd572923ccfdcfdaeb4fe52
-
Filesize
1.2MB
MD52fb073ad9fe09948d7881fb3b910a169
SHA1510841e7ba3cc77f5b99e56cd61831188b686649
SHA256f3bba1b9270ed17459a615dad50b7668878c7c972687e3c62197e405ae7ae135
SHA5126fb134be16b9b6fc21d1dd8667649619f0b6f756649856ae8a0dd1e4304c02fb3705d9ce0db9425e1b9744bd4d0e02f5db594c4ec546774939072718eea76c6e
-
Filesize
1.2MB
MD579a7d35ef3309c0005f5b59122d601e2
SHA1f3943c3c0a2638c8a0eb7561cf1a88372a4364b8
SHA2569b6af4378f04de117006e5a595902c29ef64e6cf0777cc8bc859ab4496b2dcf1
SHA5122134f5ba9e4b9462f66d5fc548e1ddb9691c4ef8275c18dd9450be5c7b23585cb31209bacfecaec26899656614c3652809584d1576a9503fda77bbc9025b9180
-
Filesize
1.2MB
MD5ef5ad21be0aac4b964e7936d17594769
SHA19a3bc0f2d3786c0f43576767b69c9957c540e29c
SHA2568df378c152491f125cd88730291caa6cf102784d34fe93b2c8dbb781bb7053df
SHA5127631992eadb523d84b4d679866e6a45804be5891bac454182b42aae08c6fc43be190de21b246a92f4c9966392b36c396ce4dbbd1145f0d0e9e0ea457b6304cdb
-
Filesize
1.2MB
MD585af324548697b61bcbbac0e031fd010
SHA1bbff93ed936aa08c4366745a10ec8af8f081fe64
SHA256326121de29840faff74409f53cb66fa96854fd50d991e8cf2db1d0caf60a9d59
SHA512766f62c0a206d6a0aa0fe97836e1176a0dcc8ac883238bad7def9ce4da567985f141d59b04eb4fe0af7764aaff3e39f231a4b5efb2a438aefdb6a13c3ccd5226
-
Filesize
1.2MB
MD5eac7538f70925cb7a5ae1060fe30dce1
SHA13ada115046c1ca22a1871e2d24a2f4d48a47a4ed
SHA2561c63510d6c948fbcf30d02d07cef4755984885ca85ce69fa992a48ff13548dd0
SHA512d938c3e906a4fdd87d2b0a0433bcc1c313d826838cbf13030e8977d4d846afddef967b0f198ec0b213e8a12814cb8ed36b273b701dceb6f0fa378a302b988e45
-
Filesize
1.2MB
MD5fdcca38148a62c287cd623cd0818b868
SHA1afb6717002bfe435a41b23beba7f3ffa7c58cd90
SHA256667436f6581d087680f2c9ad08d0c5d7b326e69564ca6c46863a782ce54c158d
SHA51236b8168f8433d77213564a5ca3aebf9862db9081717d41d5e0cf1426068c937f84af91c4ab4ad5e95555cb8d79a89d9628cd73546a15bdfe2d1c1ccf584dcf40
-
Filesize
1.4MB
MD509eec04c0c9aae79c981a4974fd8198a
SHA163416e1536899c8dc805040febd303c6c1c6c874
SHA25690909c497d0fc57e892bb051f3538a5ce9907e97fe4ca4b255654602c21b857d
SHA51265639a636bc23915198ab0403ac56ba56f2502efd8a8205d922591d8700857ff4d16a7426b63a003773dc3322caad4c1a32d901671c13b94db615a1a786f089d
-
Filesize
1.2MB
MD59922149e203e04c88c859f65f0fd8789
SHA1f1b41bbcc95ed5e527e83d0f7a3b9a722f41e2d1
SHA256e980cbb90601dfc408960f18de2b693d77218a56ec0f9fe626c0c341cf5649b4
SHA512e7390ef96afa404b502a5ebbf8c1c7e5516aa955a38ef1e11738d279aad36b16f9edcefb33c46edd83d1597618bcb86a0db9c311f898cdbe9c7745dda5e36b12
-
Filesize
1.2MB
MD53962d33825cdef26c6de1c0b1af287d7
SHA1cc53b3ec23806577f83a83f735e677e30e5d43ea
SHA256fb8d9df1955126c8dd9632fead50ae06287b9393b48f37a1f368ae786fc6edb5
SHA512a1de4390e2acd1fb8152f838d89126d8891c519cb3fd5a6b8057447fb223df2a72480ff6191c450ef3c26c1524c24141c01588d9594bdcbb83c996227bf58f59
-
Filesize
1.3MB
MD552c15d4bf46d626608b45e3fffe7aee3
SHA11ff5ddf99fb5bcaf79644b037fff4975f83acc01
SHA256e6a0004046a51917efd34ebaad7e14995e66330c97ae3eb732d4641502fa3e17
SHA512d514c622d850b88d62a74af5054e070f6b6ff970489b0f6bb0e08db0becf5bd4288b0d597b6f091a4daf75185f63cc83b625a9e6a2aca2d4ebbd33e5cd58d117
-
Filesize
1.2MB
MD596294e34bef7b99f285cfed4b1133a78
SHA1c98ac24154fae4bc1a142b0da3f64035d9415a10
SHA2560cf20e7ca7a6632b98c45d14d01d257764173aed263fb88d8af595ef05ff441f
SHA512ff66266a26d1797913c3cd5c33656cc6539b245633ac71fbd7d689540b8c251baed446418b465472fc5ae492f279f0475be4fa0d1e8076e9defcfc199391ba7f
-
Filesize
1.2MB
MD5053154e908d6fe4ae714c6c16cf0a0d8
SHA14ff0a295dd392b55f77b9ac092be298919cde2f8
SHA256d0daf63d2426d5f23439a7483f2c3d15309c635fd554ed2474ffda66a439059d
SHA512094e07c30d4346643573a043c078488bce948127fdeaf3b7f8ee1920743bcf192ee8b6744f3781bac14fab65b76db189d899795ad3ba2a95864dd2c6235ce1bb
-
Filesize
1.3MB
MD57b3241f4693c5d8e93372918efadb81d
SHA180194874e93e1136b70147729fb949e4cb3ced05
SHA256138ff5c7f71521c7e3d6ad5fe29c3af89d6d3d7900af048e8889a3c772cbde56
SHA512e8604486ceea9e745e45d2c43e2df329606dcf2718007fb6b21ba1fd5da8fd5bb382862a2ceafa790523d22de105fae43f83e7f007f5abd975898690cf640e39
-
Filesize
1.4MB
MD52262ba26fdc69608fde2f7a403ccc92b
SHA1f538cb96806ba3b3b040ddb9cf1603a13e0806fc
SHA256e2fc0136a60e2f4834a364ead8bba56be65bcf303e39a0da459830fa8d0219cb
SHA5127aba7e65878952d1637015b4447c35a977ac1fb2cfc30da4019d0f6c837a3de82959447475b63c9fadb912606ac7668f15678bcb5b650ded55a2ae4cf057af59
-
Filesize
1.6MB
MD5720a263fb9f2ee60a3838bf3e8ae9365
SHA1fc41a16e1995c68da103c8ca3781e8d049a5278f
SHA25628595e9335a35345a6953f5b0f4d347f78a692cb3321ecc6b241ed2c0affa441
SHA512a422dd490f48ab59817df8910cfb6e171b82f02b16210964a0b80916201bbab247db085195b28a134f7c792b73936c9232e805fe31a477eea4a2f9090f228fae
-
Filesize
1.2MB
MD50aefc704549bad59de75604c7420b378
SHA1981be0d44e7ee160e20cb3697c0137c0f087e04c
SHA256e0e38bffa18dc27a460e62c5409e48f634adb6e4d9619c14962df3e6257a2da9
SHA5126d999537712d23ccd51beca8c2543cc73db1e29211f23461105f65fc4beebf336f32ff5e337a196f8c8e78a945a5e407a2e04d3ca73a01482bac2dd31d52e191
-
Filesize
1.2MB
MD50cfc44bc69461962794c38728c847d08
SHA118b15457ffbf09ee9b33411b9f544a3cc7b83e84
SHA256cdee252077a8cfdfd2b167d8919970117a48406c24b593fcbe13d72a49457933
SHA512d5acf22d95c7d5ed3cd4c79acc69e36498fb10b0f9b6e12f8ba78ea41ce020ecdfb073f294400d791fa7728e03c6d97eae9f1fd0c514b804130f382c7843693e
-
Filesize
1.2MB
MD515f4c33455515d3bc5f85706d7cb1203
SHA12751044b87e9961547eeb81ad3c814e8633a3334
SHA256b8e4ebd33677e3dff91f3533d5ddd2875da3a8f1ee11113c517f1211f17f6a32
SHA51298b84a4e0ce4300065225dd6ff36228627229bd68f2f46422909e9993b8445a9e730651ea79968b6662ff7052e31606ffe3e15adafd76ff424281116599e2f62
-
Filesize
1.2MB
MD541f4d67e27cc776a5c85e94d7a69317e
SHA1de4b723e49c36169021e8643adc4819d471249b8
SHA256c733f5f426b96b854db30fa68a294d6c17b1fa48859039385b15ae4b94c83791
SHA512eb831ae1d82940f3c0bad136542e53802593536648e4e1ce1f140baa83bbb5bae69471872502f6aa32652bb31229ff4b821f5dd408cce99097397fc958f106cd
-
Filesize
1.2MB
MD5e4e67cc3a1ee7a99fa72191c35ebea26
SHA1c49b0abf366321508ea09768526432a2978ed127
SHA256d4107995712e0a85fd02eecc22a9989cc494a68a04ae4f6928210950fb17cc74
SHA512885e6d095a235b30a0f8ae0e724c88a0e192b9875f013d6370cb2b956061f94154ae49041d737cdbb87fe38345cbe75966f808bbddf15cf6538db09284328123
-
Filesize
1.3MB
MD508a9f7112bd0b42f293b3b76b8af1fd2
SHA1da6d72ae293a79f45d6049e118db832cbde00880
SHA256290412ed9f8366aa6154000ece38debc1b16c3ecbbcedee3b8f9e88065819f8f
SHA5123b89ab82f0c9f6c17fbc7b4279455f771f8431fce19473ef0af333803795d20832d8bc690fe70415224ffbc85a91a50c5da7c3b071ba793479c390716cb9783b
-
Filesize
1.2MB
MD5bfa798264575afff2f06f1bdd23aa9ed
SHA1fe3ce0dc7d10b21266472a940206fe3ef311866d
SHA25601483863270222fad0f570f27d49c1110501b04d3f5d307b43c51840140e9433
SHA512803e5ed61de050caac930225a8e15e51c34ea0ba9f78e5d1eb25fef194c3b19599e8145693e1defcb0d68c345dacaa92a4867c79f0df5e9f037447875f070bc0
-
Filesize
1.7MB
MD586f3732a9e108769702cb11aae8ad8a8
SHA1f4a585e97859a300d3c57404d3cb952d35f75541
SHA2563282974e94a1f4c8ed32a6f5a125d5c7523e535068fd86782271ae30699b5d19
SHA51227825ac742fbd9d677dd7c3312505e8d715daf358888bd69a350580a48ea0cdbb9814df66560a05607da566567c5caf42844d18bc28cb7c86b680fd6746ff49a
-
Filesize
1.3MB
MD52fd9dea4020b2a047e90ae39e133c0d3
SHA10f6ba3a2e730b08ee2de55e390dfc9408affe1e6
SHA2563905847557dad2b535995c165b741a34a1bca7a3d10c6e60b27d562111c2ed3c
SHA512b6f901324ba51f13920a4e3dcba10a49c5cfe2d2e7f2c6884f403b2765c9665f0ca0256728083afe4ca860b1b2764c86c2ac090d292e7dad99f98abbdbe4f83b
-
Filesize
1.2MB
MD58f3737c0400d803093c845242d8306b2
SHA1c75bc9db993bc116aae21b5fd0cd5c2c0c9ac7a5
SHA256971c134e008136c2ba0e80c266adc06dc2420bf2d0f6ffa9eea36b75f43328ce
SHA512720f59b98d6961d80a37d1c60f13337c609b0b5702cc224352fe8e1c642b8d1541252751aa98119c80622e21bb0f75a44ae8175338c5598ce33ebf4fd9a7e005
-
Filesize
1.2MB
MD59c88f3af571055001122fef52c4200c3
SHA1f80f0e423100c54e96539fde9ba3e17f6c2f0b42
SHA25698e24bedd5a5eb26412c631cf24194b24327272b50f4801bb19ab0253384927f
SHA512b0e9f735dfbb252efa42cef9198950f193ae083ca36f1922be248b726fb73144f5353bec804aa3f276ccb4991ff4f013a7f4616db005cafa9338ffca8f4e1757
-
Filesize
1.5MB
MD55e37e8268fd11b36e4585c7f7a9674a0
SHA1e4be5d0a2d2e13200f26acd3100c9439919ad21f
SHA25698c3a6372b9632c013bc069d89667f76fd9a228c598560a5f97b8e1c551ee14d
SHA51294c1c6c305c63791eb5be48b0e9af93a109ada6e2c20e0c92fd739c40121f7d55802e3523138288aedbd2c7287c5d90ebc9c68e8af20eac34ab49dee9c20b363
-
Filesize
1.3MB
MD5ee1b40a39dc46c214708180a8da22214
SHA1be76a1359124a4e32d7b9add830d936a169d72b2
SHA256c2df13c5be1821901236fdbe112d84136fda27f0218fa03af9049f48e65e7ee2
SHA512e416b4c39ebdf1df137c968c10d5458a811236893df1c5a138a9bb1f8430a94f30a44c6a64c6d2c9d052013c74ed7e374e6e0bd36a59b45d38972f32c7814252
-
Filesize
1.4MB
MD54f318bf19e2d5c32cf94daa5e762b071
SHA10ec4c966b5e916f2d9667e85212007738ddcca72
SHA256e659756c79bd49ba9b462c4e7f21ba9269f510d7fd0f08918c308dddcf0df118
SHA5126d43999c65d09993137a901e3b7f3f9e24771054d77060dc40587b616e471c7ce4259b254e62601d758795138b781a55b5139bdde433c8d931cedfa8e6ff7407
-
Filesize
1.8MB
MD52c9bf24cafb355e1a3f8252ecc678e9a
SHA1652036d42e691af3d47c7b99cba21a84e93a7a83
SHA256c21040925bf2565bf6660e4545976023fa383cd8c77a0d95aa99dc0410fe0974
SHA51203e5a87e99a255c1b5e74f48e90fa430e27e5b7f0cc2c9f8317bc59c0ab714bc6bdaa693a063bcd7c6db5de2d7427432228f19cdf35db4810a871522da8bd7b1
-
Filesize
1.4MB
MD53ceba0a0c3a8eab288b11fa1fccdf51c
SHA14cdb0b7a7657c58ad880bc39fea5f0afab44c075
SHA256f777063b0aac0385b5b0fdf99fac2b016632c0ccc14593d053c64b6c5e3e455c
SHA512d9e625f7af12b042cd9d8c3aa71a44a1e81dbc31a8cc7cc49f042c09de23509b558b5fa4dfdde707767312f68336f7bcd19f67d92d888ab0789222e8f6a084b1
-
Filesize
1.5MB
MD5b334452bfbca8e59305affb4ba7ad1b5
SHA137d83128c614a943717e82ce2d5cedf614394302
SHA2569a9f4b024bfd5187d325b9ff775821ec64b43b824f8ed9be059b14282c170a7b
SHA51264e799d5a5c52c355d1977083841a193b886dc909ac5c29e396f9488d029c00db6988273b81505763bd5a00b9ac842c4958e011ebd3c1eecb58db5a82fe5df6e
-
Filesize
2.0MB
MD5c42076cbe161064b3d951eeb971654dc
SHA10401f933a1e4dba9a99147501f977c6cd482da72
SHA2561b9dd976da385b45e0d257b4dc731026cb696a37b4e9a632f1b91998ecdffe58
SHA5129d0b004396bab73730295189a549947edb10e0c4b159c52cfd9e740b0fee92df40e81e6e397ba5a309c3922bac2de5da85f0ea270762412edfe3fdd2ce2e65b4
-
Filesize
1.3MB
MD57fcf836828e1ee71b4599883893ea102
SHA15d842d3ed7bc8270fbfe7de2344eeb30b1424550
SHA2561c488ce6555363b01dd7db130c02d4cfd6ad4667afaf1212a71e7b8ac7f4f943
SHA512246ff2c9077755d4b5cee1b0d103254da36e75da7e9604ff711425972608f237a8bbbd19ae5195924f534db3c494e66eb19446d2d0866ba04364d87b3f842887
-
Filesize
1.3MB
MD5c646bdaff4f5f6f211ab0340c5b1a98b
SHA10dcf8826c4e1ffdf35949875f02cdbf3ae1ee87b
SHA2563fabe85d29296b4baaeb6c92571605cf339b1fa3acd70fe6c4eb29de7a3516e2
SHA51216fcaddf58db9e53248daee30c7385d595feda73512fc8b6c5ed9e5b210e464445c2f8f9fd0e983b63fc71749f0a16968e1f5e36598d620d9a89f2ecbcde4cd7
-
Filesize
1.2MB
MD52b565ebc90d45d1ad9ff9251ba104148
SHA18d5147224b4ec3ce47f984334002935ad0817e35
SHA25649e84d4ef8c50c0543ecd2c255177edba0e4db0d2765159d69af6afab7ee1d93
SHA512011251ad837a7897a1996e5b6a9dce0f95e6444ba6bcb439fa8fcb1945d673271e2abf78dfca7c24bbea45aacc62f50320d58c6f44e7c9b7e4844e3baa636abe
-
Filesize
1.3MB
MD535b7b1cc324fb8fefa6648e9c5773f4b
SHA1490491e30f3cb45365ddedb1add427aee220d636
SHA2564efaebc74575b992a9bb437f30ea8829df710fb6e5ebdbfe753950dae103a89f
SHA5120fb750079c05f3e28283b03e6d255468265a0bc0dad403896f1bc16f83b3d9cdb3702fd798da8d26d006a2d75d287cead05f99bcd0604448c39954bba6a6eb32
-
Filesize
1.4MB
MD5be14b98092e1db32394a6a7a0db10acf
SHA19960bc7ab5ec05850290d66b74d3a1db89a06ef1
SHA256ab180518fa0dd48daa1f88d06bb4a95e2ae4adf0a6a70a3eaf5efe6cf6fa0ed9
SHA5120ced3656c35c5685327a4d9dfda0f5bf460a7e35e4f7abeada203eca6fb1166d38203bbb384d75b6d12378869c9a49240eb6e75f02d5a8c2286fe0050792782d
-
Filesize
2.1MB
MD5bb778821c9a276796eb4cace5f13ff52
SHA180dceb03fceacae60bf64061f1ab18c1efcc1a73
SHA256a3f6f698901bc5c6d923e149e0b86d88b3526c8a4d1df60eb2b305f81f55588f
SHA5122255417153f0c97becfe7a2dba8daca52630b3726b4afae961dd24937949cea96558b1739198825d8e294e30c8e4a31e9948be4f186aad6b215fb8aa255d4be1
-
Filesize
1.3MB
MD5e25fed48a48d856bb5bd3e024fb8a62d
SHA16f1de5ec85d4f5e26e2610bbe7a12d111b9539e9
SHA2567da632f35978c57dc1f5ce491b972aac66312962c292cf0773c77d1b9ca5f907
SHA5125014cc4391a9508566c50513bdf32f89091dd330d536b50539374d34fcce1c4abae7dbdce98f0c3e8dc3c98a1c7ff8951b27b51ed81b4f27a10d637d0d3c0829
-
Filesize
3.4MB
MD57f7ccaa16fb15eb1c7399d422f8363e8
SHA1bd44d0ab543bf814d93b719c24e90d8dd7111234
SHA2562584e1521065e45ec3c17767c065429038fc6291c091097ea8b22c8a502c41dd
SHA51283e334b80de08903cfa9891a3fa349c1ece7e19f8e62b74a017512fa9a7989a0fd31929bf1fc13847bee04f2da3dacf6bc3f5ee58f0e4b9d495f4b9af12ed2b7
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.9MB
-
Filesize
384KB
-
Filesize
7.0MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
7.0MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
7.0MB
-
Filesize
412KB
-
Filesize
7.0MB
-
Filesize
7.0MB
-
Filesize
412KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
2.1MB