Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2024 13:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe
-
Size
3.8MB
-
MD5
6ee589bb3792fab785966db1f902de7e
-
SHA1
f6330b32e06dbf09bff6a28b0e3aeb114686f3f0
-
SHA256
e1e3d00443ecfe5904f1f51505ecd747f215c3f7b6d4443019317b7a9f1770e4
-
SHA512
3e56c705031347fa1f8faa17c11ec1032fe7315943d16f30f8c776fb6f9238aa75f98d153cae0bf12746d87157d26d765597e17adc886965f12ab22551fb039e
-
SSDEEP
49152:unsEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxiHgYk6:asyfBhz1aRxcSUDk36SAEdhvxiHgYk
Score
10/10
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (2397) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\npf.sys 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File created C:\Windows\SysWOW64\drivers\npf.sys 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe -
resource yara_rule behavioral2/files/0x000a000000023b76-14.dat aspack_v212_v242 behavioral2/files/0x000a000000023b77-17.dat aspack_v212_v242 behavioral2/files/0x000b000000023b75-21.dat aspack_v212_v242 -
Executes dropped EXE 2 IoCs
pid Process 4656 CTFMON.EXE 2628 tasksche.exe -
Loads dropped DLL 5 IoCs
pid Process 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\@AppHelpToast.png 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\DevicePairingWizard.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\networklist 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\RMActivate.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\SndVol.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\finger.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\sv-SE 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\tzutil.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\dllhst3g.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\InputMethod 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\powercfg.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\sysmon.ocx 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\autochk.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\hh.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\msgsm32.acm 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\MUI 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\SyncHost.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\activeds.tlb 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\imaadp32.acm 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\raserver.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\mlang.dat 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\more.com 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\svchost.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\Fondue.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\rdrleakdiag.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\SearchProtocolHost.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\TapiUnattend.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\wiaacmgr.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\Com 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\eventvwr.msc 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\mmgaserver.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\msdt.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\mtstocom.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\quickassist.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\remotesp.tsp 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\srms-apr-v.dat 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\Configuration 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\F12 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\netiougc.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\mmc.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\comp.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\compmgmt.msc 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\dpnsvr.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\EhStorAuthn.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\fontdrvhost.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\Kswdmcap.ax 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\label.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\da-DK 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\Dism 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\timeout.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\clip.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\MRINFO.EXE 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\OpenWith.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\rrinstaller.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\tar.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\ja 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\Magnify.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\wevtutil.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\packet.dll 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File created C:\Windows\wpcap.dll 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File created C:\Windows\CTFMON.EXE 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File created C:\Windows\packet.dll 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File created C:\Windows\wpcap.dll 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File created C:\Windows\CTFMON.EXE 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File created C:\WINDOWS\tasksche.exe 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File created C:\Windows\pthreadvc.dll 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File created C:\Windows\__tmp_rar_sfx_access_check_240653734 tasksche.exe File created C:\Windows\pthreadvc.dll 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe File created C:\Windows\eee.exe tasksche.exe File opened for modification C:\Windows\CTFMON.EXE 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CTFMON.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasksche.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4388 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe 4388 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE 4656 CTFMON.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4656 CTFMON.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4388 wrote to memory of 4656 4388 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe 85 PID 4388 wrote to memory of 4656 4388 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe 85 PID 4388 wrote to memory of 4656 4388 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe 85 PID 4388 wrote to memory of 2628 4388 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe 94 PID 4388 wrote to memory of 2628 4388 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe 94 PID 4388 wrote to memory of 2628 4388 2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\CTFMON.EXEC:\Windows\CTFMON.EXE2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4656
-
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2628
-
-
C:\Users\Admin\AppData\Local\Temp\2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-10-11_6ee589bb3792fab785966db1f902de7e_wannacry.exe -m security1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD541414dd0cb2236b84fbaf17ea3711734
SHA1acf7e3d5861baae1f7fc1b18baf85df631b01c33
SHA2567b81ed45ae4922ae1b48b14dd27741ad326844a93a2d200f5063ed36d9cfd5bc
SHA512e6012e88eea25afc77ee1995017058e260ef57bc2aabc37d29de8432b9df32f83290b3cb05737b04b5c47b5e0941de4cce45a192f5cd3046b6b579fa340c1bec
-
Filesize
40.4MB
MD5ac023a160202acdea8facae86d432595
SHA19a103a53547abb2efa5a6e65d3963e5a698ac2a9
SHA25637d958baf86272d47af4415b2f799dfa527ae7aea3bd51d9dbfcc7eff4f2a7c3
SHA512efd76088e76ec053ed3f5c3b87fe4af3d11f7e951834136105acc548a5f0de7be9142e5fc15854873ba54bfae5a90ba073a8cf0f7e72fdf4a474778ea656f3aa
-
Filesize
255KB
MD53688113e22d0138c3d29fc9084336d6e
SHA18ed7781df22c633e2128a0a479c6bd3c49cfacdf
SHA2567844af5bc14efd821655229be731c48a962dc1f096ea88cba660e23e2e7fe56c
SHA512e4c2a7dd13eaa7710feb00855ef35f9d7ca2bf965b8f354d708a10993cf3d52a8c0884c6c2021d6f2c30b239f86a4dc8e1a97cb482b7cb27f82edd58971d4ccd
-
Filesize
29KB
MD55c14de7d04d00aac3f03b569f2ea4664
SHA1a26ae78a204791548be000824a1ad05524bdd2e8
SHA256fac5bcebde87a261b4fb5a110765e53c96f0ef27b24ca94762f2c2ddb4da4204
SHA5124bcbc4f0ab7b52f4303206fafd9d0bafea02bb25d8395a80eb6390b30ccc750379fb7fe9e0bf5a4a025cedb9e4702b7655963e360f2f983526dbc2e1efaa814f
-
Filesize
32KB
MD5f46c27d67c0ce202ebf4b771cb56ec00
SHA1f999454d0aaabccfda7a50c8cb0818e50a7a1d91
SHA256a68c877cd9c7562c66c722b4d0cd9fa366c65465d4c47ab63bf28bd5f1a69bcc
SHA5122b7c6f7e865f88625a05c85226a95319656648029ef1c1b92b3a6c2dea7a4f7cf7d157c09af32c8689c76c6247852cd5af72d4f0dbb4dbcc3fe3c24681d53dbf
-
Filesize
24KB
MD5ea20ca545a351384486cef574b7a5571
SHA1a1f01df09df62e933e4ff289361641b06ff31548
SHA2562bd8d9dd8739e17828f8a87b73d592d4fd17988bbb0ea4a4d4cbda57129e8e48
SHA51264b3dee275fb1830254fa2a95778b26864708c0b5e348cf5919ded013cda3872fe26304c846fa7968b24f60e2b6105c4813ff9e695bd6bb52897318cdecd382b
-
Filesize
2.0MB
MD5beb8a27fc024962e045c32aa58d07d0e
SHA1796d3613673f323135865c42272abef347add163
SHA256ea2ad4d3bb98673b88e18eea1bf06c371c206b64246a9193b2a64ba4fe4f4900
SHA512e84c03f6f4399b28e0d258b743831f36c621325d9b199cbbdd6982ed51280facfc5a953a2393788bbc54efb653f95c9f75ea29c93c147c9227aff3395f788179
-
Filesize
117KB
MD56d79c447d16b96e7a72b12e450b6fa8e
SHA1d2afa5eb9c9ba598f82a6025c1a07d31cb8a30bb
SHA256afe533c6990520d49a4963bb9ce6d563b02d7b299ff4a9c9e4bca31ca6920deb
SHA5126b96c6e79608256807f37a4b74b264074274642b4e4e09ef870d13246b7706582535c1e4f33f2a61281ab4c0ef59fc03c60a54faa6627aee92df52f356b8d966