Analysis
-
max time kernel
72s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2023 19:33
Static task
static1
General
-
Target
Install_Auto.bat
-
Size
492B
-
MD5
e811b616f7c5dcbbd9d48d91c605a11e
-
SHA1
9a4b0fe213a789b54f559bd0dda3649738f72716
-
SHA256
7d4f17d9c4809e6a6874e11c484f6c6b3b966dd5a33f9f09d9d3a3d600b4e355
-
SHA512
57f9c415fe3f3cf35075c3c768175258719a2ea4345391c30a35bbc088fa856494079bf8cbaeea18f93f0b8ee39e7f4da4d68e59540a3d5e9e98f024181addc3
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 2 3376 powershell.exe 16 3376 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
SpotifySetup.exeSpotify.exeSpotify.exeSpotify.exeSpotify.exepid process 4948 SpotifySetup.exe 656 Spotify.exe 2120 Spotify.exe 2804 Spotify.exe 4632 Spotify.exe -
Loads dropped DLL 6 IoCs
Processes:
Spotify.exeSpotify.exeSpotify.exepid process 2120 Spotify.exe 2120 Spotify.exe 2804 Spotify.exe 2804 Spotify.exe 4632 Spotify.exe 4632 Spotify.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepid process 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe 3376 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3376 powershell.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
cmd.exepowershell.exeexplorer.exeSpotifySetup.exeSpotify.exedescription pid process target process PID 3924 wrote to memory of 3376 3924 cmd.exe powershell.exe PID 3924 wrote to memory of 3376 3924 cmd.exe powershell.exe PID 3376 wrote to memory of 1960 3376 powershell.exe curl.exe PID 3376 wrote to memory of 1960 3376 powershell.exe curl.exe PID 3376 wrote to memory of 240 3376 powershell.exe curl.exe PID 3376 wrote to memory of 240 3376 powershell.exe curl.exe PID 3376 wrote to memory of 100 3376 powershell.exe curl.exe PID 3376 wrote to memory of 100 3376 powershell.exe curl.exe PID 3376 wrote to memory of 3680 3376 powershell.exe explorer.exe PID 3376 wrote to memory of 3680 3376 powershell.exe explorer.exe PID 828 wrote to memory of 4948 828 explorer.exe SpotifySetup.exe PID 828 wrote to memory of 4948 828 explorer.exe SpotifySetup.exe PID 828 wrote to memory of 4948 828 explorer.exe SpotifySetup.exe PID 4948 wrote to memory of 656 4948 SpotifySetup.exe Spotify.exe PID 4948 wrote to memory of 656 4948 SpotifySetup.exe Spotify.exe PID 4948 wrote to memory of 656 4948 SpotifySetup.exe Spotify.exe PID 3376 wrote to memory of 2120 3376 powershell.exe Spotify.exe PID 3376 wrote to memory of 2120 3376 powershell.exe Spotify.exe PID 3376 wrote to memory of 2120 3376 powershell.exe Spotify.exe PID 2120 wrote to memory of 2804 2120 Spotify.exe Spotify.exe PID 2120 wrote to memory of 2804 2120 Spotify.exe Spotify.exe PID 2120 wrote to memory of 2804 2120 Spotify.exe Spotify.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Install_Auto.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "&{[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12}; """"& { $((Invoke-WebRequest -UseBasicParsing 'https://raw.githubusercontent.com/amd64fox/SpotX/main/Install.ps1').Content)} -confirm_uninstall_ms_spoti -confirm_spoti_recomended_over -podcasts_off -cache_off -block_update_on -start_spoti -new_theme -adsections_off -lyrics_stat spotify """" | Invoke-Expression"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -V3⤵PID:1960
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -s -w %{http_code} -o /dev/null https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.7.1277.g2b3ce637-219.exe --retry 2 --ssl-no-revoke3⤵PID:240
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.7.1277.g2b3ce637-219.exe -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-03-19_20-33-41\SpotifySetup.exe --progress-bar --retry 3 --ssl-no-revoke3⤵PID:100
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-03-19_20-33-41\SpotifySetup.exe3⤵PID:3680
-
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exeC:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.2.7.1277 --initial-client-data=0x468,0x46c,0x470,0x444,0x474,0x69843a38,0x69843a48,0x69843a544⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --disable-d3d11 --log-severity=disable --user-agent-product="Chrome/110.0.5481.104 Spotify/1.2.7.1277" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=1748 --field-trial-handle=1920,i,9754624063766736174,5471095146787014278,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:24⤵PID:3464
-
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/110.0.5481.104 Spotify/1.2.7.1277" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=3064 --field-trial-handle=1920,i,9754624063766736174,5471095146787014278,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:84⤵PID:3428
-
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/110.0.5481.104 Spotify/1.2.7.1277" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --mojo-platform-channel-handle=3080 --field-trial-handle=1920,i,9754624063766736174,5471095146787014278,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:84⤵PID:1788
-
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/110.0.5481.104 Spotify/1.2.7.1277" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify\User Data" --first-renderer-process --log-file="C:\Users\Admin\AppData\Roaming\Spotify\debug.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3824 --field-trial-handle=1920,i,9754624063766736174,5471095146787014278,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:14⤵PID:1120
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-03-19_20-33-41\SpotifySetup.exe"C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2023-03-19_20-33-41\SpotifySetup.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exeSpotify.exe3⤵
- Executes dropped EXE
PID:656
-
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4632
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:3652
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\3f4a13ec926b4a5cb22051025df59635 /t 3832 /p 37401⤵PID:1644
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4792
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133237317557762941.txt
Filesize76KB
MD540a3bfdbe8f5f9ce2ccb1b9e5bc64eef
SHA1118d18bdd5f9e99dba89867f5aa9f1dfd5e63632
SHA256ade8bb612d2fc4e155b67dbb2bf018ff24b41044ce7d5788e82f251286869f0c
SHA5120f3f27c76ed7c429a49b9da12920cd55d24f55befcc9f7efccd94a64bfd9bbff13d6bd1b51e8ba41017f2b8cc47ddd91d72c159d828b75c385d7b1ce1ccab52f
-
Filesize
96B
MD556ba0ad7a5a3423613460adf8adc7e20
SHA1cc5235a33c4389e36357c80bc56ea2169ec80038
SHA256556ffd8227fb32e0e732395b0e8bf2f01b506792a4d1181d2ebfc66a0af6f34c
SHA51281dd54fe4a355185997d0871d8299a88a2a9b409a53021e933642ffabf515b985959d17d615822cf2038d396f9fa03049c5c24880ca0bce687a0d1020d026b63
-
Filesize
48B
MD558ede6900e89164cd1d613648cd3f185
SHA10156436cf49010ac5ef23d23b332d568a5da422e
SHA25638554a11ec59b268e9185dc1d8dd024195e3e4d15d5604a3b0fd8e8a876462d3
SHA512c25c2949455ad89aafb7deb076a40836ec1af4047497efb05d56a99a05f6856fc8b634667b0d0b35b5346e57dae8d1181267560d6d027460c608d03f91ce4b69
-
Filesize
692B
MD5bece213e6d73bd21649f6b7a8a1b45c5
SHA14872ba4d2d810442dfe431056495eb567426036d
SHA2567878e644ad63dd9a8e242b42553cfd17c1c8bda673bbff091d06d8311c42516d
SHA51215c9805b3ff11c8b41adf1967f8a91cbcfbf8b9a8b15652d9ea6dc86689b69e1e7b372d08168dc45d8b4bdebcf817435c8045f751619c53be6cf39afa1d40643
-
Filesize
692B
MD5a38326ecfca030045c9432ee31044099
SHA1cafbbda17aad435d0e639276919dc8b20d42e7ed
SHA256a706faef41a3e71c1cbdcf60e75e138b072c6ffac919383156bc8d3adc873cfe
SHA512a5d9cf41e25bc737d4c6e95e37ff39bdbcff8e529984af8fb57ceef99bf6253ea2e632c97b569e325e1b6a5667090d39a28d8137a0b005e66adb1d1c948b9006
-
Filesize
524B
MD5d779ebba052a8ac91fc37c372e9ae1f3
SHA1f02f51810e73f291c58a6310c3ea0a6c940d1303
SHA25657d4dc9654780a0c210b2ffbfe76c820998ed14faf8b2764d1ff9d80a8d85aad
SHA5129c749c7a9bc9a8afe5cdfaf10eea822286ccaca6193957cb10bada843156935bd84806e429fa8b6112e748394c9900916c643a438eb440da51c47eaff625a1b8
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
687B
MD5d9315b34d9535365fa704b441b0642e9
SHA1e9fe3eef53351e10bf62dbf369fce433654347e5
SHA256ba3ebedf326ab1afcb82709a5b42517b6b53de8951cf9d1923d1acdee3b8a778
SHA512374929e24eef6443466e0729bc5519e582ca6d71cf03b0061d4f1fbeb1a2cd566efe2541ce6bd88b748d58b967d8e086d9cf1e49a2ff214e40e1b7ab2fa2c25c
-
Filesize
484B
MD52b6b0c17ad243f85cc7a9408bcbcc982
SHA10caac47a19f68ab3fb3b84149ca0c156ec631a11
SHA2565f39bbb7dd7c45177876184aa140f45ecb30993085927cf73b4de7f73336c0b7
SHA51200637b2a0dab0e5d8293392b23828ff2834bac628f1f4baffc09668491928997a3dd4213b04962945f71aee619dbe095a711015e742b4d8792cdfa12f8df0f93
-
Filesize
56B
MD5d9c5eeffd8505ce9b102123dc0cfb17c
SHA1a4af4b041348254b4748f416864718fdbfbbd01c
SHA256564ba534643f86c70cef10247ba7495d7dac0b26a40913933c1d6e2880ef297a
SHA5126f25cdb5a3d46a1d77b463abe40b385f3188f9f8f2e3af23d7e88d138805bbf1f9c60434e6c644b7b20c5323875ea1fb0b34074a5630322185677cd720aa6d5f
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
83.5MB
MD55e307b5182474dd37d18cd8ada1a0285
SHA14d70faf2e6e3b0b5a91ecf0470a42bb9afff44cf
SHA2565f38b643d1adddd70ae034cb4dd6f567b267c04d7a77e51c6869718630cfee92
SHA512e6e249218c46bce48c4e807ef88a81149d456f01e1234d9081525a5f8cb8c0689502315be2ee8c0f5b56572fa696a6474917f34e896f14b9b367feecd44f04da
-
Filesize
83.5MB
MD55e307b5182474dd37d18cd8ada1a0285
SHA14d70faf2e6e3b0b5a91ecf0470a42bb9afff44cf
SHA2565f38b643d1adddd70ae034cb4dd6f567b267c04d7a77e51c6869718630cfee92
SHA512e6e249218c46bce48c4e807ef88a81149d456f01e1234d9081525a5f8cb8c0689502315be2ee8c0f5b56572fa696a6474917f34e896f14b9b367feecd44f04da
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.5MB
MD5649488d28c18f3626f1f3dc9d51f64e8
SHA162972f8387d9f9ae9a3cf1ad92807915345d4828
SHA256bd1c6f44ea8032a2fb5aae336d6b636e84aa46ed2103259f490eb15287b4a3a1
SHA512af7f568956388410d8567254d508c8bf50e5a2044a590d85bfc03dffa8e98199bb604c66febd7f8d6a7903ee5e4429ef6cfffe8a297438c82d50f2b62cf514c0
-
Filesize
1.4MB
MD522788257f6e1fd3b50ab6d72752af278
SHA101af69d03bfd15104432ca3ff8502825d0af8aaf
SHA2562d909edb23fdd4049bdfa8ec4da9d58c3eeb8191a5f8c0f56aba0266a2422119
SHA512f8816d1f5dbd8094512ec036a4bc1ef5f25973127a3a54bb3bf1dbb9362c17e21c19d60f5f9f4466f91a37a0d1893568091c6e1e76e0cc8b08adc7f8f70951c5
-
Filesize
5.9MB
MD50c983ed94f5ca4c740a6cfec5c441c16
SHA1b649a7c0b9e52a097e48dedb3fae189caf9ac735
SHA2562f1e192d2542d1e1062a536d1c0179b846498b35f8ad9db0ec08f377720eb9d7
SHA512ef37d15de454331b0b2954308e06e734ab9b59e2ee5e0cd4e0a9c66ad277c64298ce75e0acc7831cb8874bf126e2ff2ef28683d719b6047c81397ffb5758f8f7
-
Filesize
3.9MB
MD5497dca87043d7c5d5bf8a81c61435642
SHA1ec0b37632af422e18f507ca1188433efe629035c
SHA2560fed010750b6eec9ed7f2d07551bd53a355d07dd10b5a6d90cd4b00cc4229329
SHA51271f61c26dd9a54afd48aac109ef9e6bb986ffbee5d7dd8a5c83ca5eef60dffb033ef63ba740914d8a38ca1642e3b19976d7f4103d68206adfbc28d1ad2f1dd83
-
Filesize
18.4MB
MD513dc9f455543556daaeed3b918992789
SHA15c3d8aea2499fa402bc5951dada102ebb776df68
SHA2561fb2753dccaff558db3150b3bc87b9adf91cec85bb9001d7ca0ce1f7145437ba
SHA5128ac3f52ffb36580564ab6a33d7dc639b367ca0b1ffd5f0c9162b146081527defa55826d758f8e0eb6898f2bb2d13f76fc6faa042c704cf1d0e9c5e1ca6036d42
-
Filesize
18.4MB
MD513dc9f455543556daaeed3b918992789
SHA15c3d8aea2499fa402bc5951dada102ebb776df68
SHA2561fb2753dccaff558db3150b3bc87b9adf91cec85bb9001d7ca0ce1f7145437ba
SHA5128ac3f52ffb36580564ab6a33d7dc639b367ca0b1ffd5f0c9162b146081527defa55826d758f8e0eb6898f2bb2d13f76fc6faa042c704cf1d0e9c5e1ca6036d42
-
Filesize
18.4MB
MD56b913160fbaba012204142aa1ab74fd4
SHA1cf7878b2dac38f3c686a87ea9b3d99e9ed317162
SHA25614ca88c3be66c7c693b0f3959a226578ff695c7c7d0dc47d4f161480b1a1d752
SHA51285588ce6eba5a05eec652c5489842b6d3ca608e05e4dbb529551da8f064894992eedc0c7628d4a081d11a9f66132d5d3da25cb8ff09ccd3ac7d43968527bf7fe
-
Filesize
18.4MB
MD5dae697d738a75dcb1631523879967634
SHA17335edc473f11f160c1b139af6ed3ce8146a44f3
SHA256efe3997693d8d2a83eab82bd1842c032e129951a37a620c8678c46c59c62275d
SHA512404227e984a8cc52a195d14b4d46f212af40e406c8a0319c49a4177f451cd107dd1d8fcf033bdf0a1767c12cc5f1f31b343a89ef2e1226256dfdff6a819e7293
-
Filesize
18.4MB
MD5dae697d738a75dcb1631523879967634
SHA17335edc473f11f160c1b139af6ed3ce8146a44f3
SHA256efe3997693d8d2a83eab82bd1842c032e129951a37a620c8678c46c59c62275d
SHA512404227e984a8cc52a195d14b4d46f212af40e406c8a0319c49a4177f451cd107dd1d8fcf033bdf0a1767c12cc5f1f31b343a89ef2e1226256dfdff6a819e7293
-
Filesize
18.4MB
MD5dae697d738a75dcb1631523879967634
SHA17335edc473f11f160c1b139af6ed3ce8146a44f3
SHA256efe3997693d8d2a83eab82bd1842c032e129951a37a620c8678c46c59c62275d
SHA512404227e984a8cc52a195d14b4d46f212af40e406c8a0319c49a4177f451cd107dd1d8fcf033bdf0a1767c12cc5f1f31b343a89ef2e1226256dfdff6a819e7293
-
Filesize
18.4MB
MD5dae697d738a75dcb1631523879967634
SHA17335edc473f11f160c1b139af6ed3ce8146a44f3
SHA256efe3997693d8d2a83eab82bd1842c032e129951a37a620c8678c46c59c62275d
SHA512404227e984a8cc52a195d14b4d46f212af40e406c8a0319c49a4177f451cd107dd1d8fcf033bdf0a1767c12cc5f1f31b343a89ef2e1226256dfdff6a819e7293
-
Filesize
18.4MB
MD5dae697d738a75dcb1631523879967634
SHA17335edc473f11f160c1b139af6ed3ce8146a44f3
SHA256efe3997693d8d2a83eab82bd1842c032e129951a37a620c8678c46c59c62275d
SHA512404227e984a8cc52a195d14b4d46f212af40e406c8a0319c49a4177f451cd107dd1d8fcf033bdf0a1767c12cc5f1f31b343a89ef2e1226256dfdff6a819e7293
-
Filesize
18.4MB
MD5dae697d738a75dcb1631523879967634
SHA17335edc473f11f160c1b139af6ed3ce8146a44f3
SHA256efe3997693d8d2a83eab82bd1842c032e129951a37a620c8678c46c59c62275d
SHA512404227e984a8cc52a195d14b4d46f212af40e406c8a0319c49a4177f451cd107dd1d8fcf033bdf0a1767c12cc5f1f31b343a89ef2e1226256dfdff6a819e7293
-
Filesize
18.4MB
MD5dae697d738a75dcb1631523879967634
SHA17335edc473f11f160c1b139af6ed3ce8146a44f3
SHA256efe3997693d8d2a83eab82bd1842c032e129951a37a620c8678c46c59c62275d
SHA512404227e984a8cc52a195d14b4d46f212af40e406c8a0319c49a4177f451cd107dd1d8fcf033bdf0a1767c12cc5f1f31b343a89ef2e1226256dfdff6a819e7293
-
Filesize
18.4MB
MD5dae697d738a75dcb1631523879967634
SHA17335edc473f11f160c1b139af6ed3ce8146a44f3
SHA256efe3997693d8d2a83eab82bd1842c032e129951a37a620c8678c46c59c62275d
SHA512404227e984a8cc52a195d14b4d46f212af40e406c8a0319c49a4177f451cd107dd1d8fcf033bdf0a1767c12cc5f1f31b343a89ef2e1226256dfdff6a819e7293
-
Filesize
599KB
MD5d03d4c5ddcdbabe4666bc7a548d20ec6
SHA15055542c06e611e813de5c8ee98fde40b45e8fe7
SHA256eb133cd63e7566b3314312704c194d61afcb1c642868f534d0c6a326f524cb0f
SHA512163155b2ab0a6b9aeea5155f26467bc3660d13da3693592af3688cbe576ca49afdc655fb1fa372f8e2bff641e1c7c30a777dd344b393c552432104fea8578b75
-
Filesize
896KB
MD57e0df0c11087dbd96d7e3211b27db0c4
SHA1adf7da811387b31c6a9ef01aba792c696dcd7838
SHA2564ee1cfae48ed47a7ca5315c64659385283a57accc1bc9ae24c5fe3d2d28c2603
SHA512e357f6aa9a2ab1f09ceed4dcad9c62a252ae31c5797ff135aa8907221465f3d3709aa950b6ea995d66f238b2539661554e8a76ad931de18f4c8e7f67bc44f469
-
Filesize
1.1MB
MD57b49c99fe56efafc81f9b1cf64671a78
SHA193f33c050541258777804da7446ce431b1601adc
SHA256f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c
SHA5129ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f
-
Filesize
1.1MB
MD57b49c99fe56efafc81f9b1cf64671a78
SHA193f33c050541258777804da7446ce431b1601adc
SHA256f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c
SHA5129ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f
-
Filesize
1.1MB
MD57b49c99fe56efafc81f9b1cf64671a78
SHA193f33c050541258777804da7446ce431b1601adc
SHA256f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c
SHA5129ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f
-
Filesize
1.1MB
MD57b49c99fe56efafc81f9b1cf64671a78
SHA193f33c050541258777804da7446ce431b1601adc
SHA256f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c
SHA5129ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f
-
Filesize
1.1MB
MD57b49c99fe56efafc81f9b1cf64671a78
SHA193f33c050541258777804da7446ce431b1601adc
SHA256f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c
SHA5129ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f
-
Filesize
1.1MB
MD57b49c99fe56efafc81f9b1cf64671a78
SHA193f33c050541258777804da7446ce431b1601adc
SHA256f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c
SHA5129ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f
-
Filesize
1.1MB
MD57b49c99fe56efafc81f9b1cf64671a78
SHA193f33c050541258777804da7446ce431b1601adc
SHA256f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c
SHA5129ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f
-
Filesize
1.1MB
MD57b49c99fe56efafc81f9b1cf64671a78
SHA193f33c050541258777804da7446ce431b1601adc
SHA256f3602b4f12c9bb2ef69c475c85d29138794f92e89149eba2bf1265d29e68fe3c
SHA5129ccb36a165d86ed746425303a94de511d53ee878f4cb489f9d72c49d8d1dc48605444aeffb52a60b21eb11cfdf04c1fd919328259b7b48ac2d22b2a02c90bc2f
-
Filesize
655B
MD5e77e36c159d1f61e434f060683728c58
SHA13937b77f65640880a9c9a96c73a254f1dc04b3f2
SHA2567a56aa4b4ff4d8a5084dee026a2fb8704fb259d9ce215542bf3b3fc2506fea60
SHA5126ac5a648eedd2f81f2fa12f940b018e44dc440d002fff6307b2eaff904be15bb9b08bfe148c4d90376b1f9347ed182611ee8a58eae27444cda43a5aad3655009
-
Filesize
3.9MB
MD5497dca87043d7c5d5bf8a81c61435642
SHA1ec0b37632af422e18f507ca1188433efe629035c
SHA2560fed010750b6eec9ed7f2d07551bd53a355d07dd10b5a6d90cd4b00cc4229329
SHA51271f61c26dd9a54afd48aac109ef9e6bb986ffbee5d7dd8a5c83ca5eef60dffb033ef63ba740914d8a38ca1642e3b19976d7f4103d68206adfbc28d1ad2f1dd83
-
Filesize
10.1MB
MD52c367970ac87a9275eeec5629bb6fc3d
SHA1399324d1aeee5e74747a6873501a1ee5aac005ee
SHA25617d57b17d12dc5cfbf06413d68a06f45ccf245f4abdf5429f30256977c4ed6de
SHA512f788a0d35f9e4bebe641ee67fff14968b62891f52d05bf638cd2c845df87f2e107c42a32bbe62f389f05e5673fe55cbdb85258571e698325400705cd7b16db01
-
Filesize
372KB
MD52b1132fc8f12d4fa3ec68a3293f22d0a
SHA1ac25afab91399f79e8e6138a0290f1513020571a
SHA256b424b7ad12aee02a9de5b6b740ee962df760de6f0d1f04e353ce1269dbf7403a
SHA512fef1c6b0ae2829b4aafd12d046aa9506c4df6d4be6165167cb13aaadd3682ef72746ee9aeda40b8acc56691888f36f1005b6b85d161a6b32c9a0fa7730753029
-
Filesize
6.2MB
MD59933cb0b99c9651de7832d8fd05b1de0
SHA10e5ddbfbc1f0788a9fbc57e751c8b9ce7e8ec18b
SHA256262e337d30ba6c9a64d357ac6511856dab4b546ed47114f509de6f37451134a0
SHA512b6f061133a8f7b6edb3287a08e300fcae0b8cee41cee25facb81a4a297e8e3c0e17aa9348c35a6a5cfffaeeb2d8f2205fc7a1ff25a376c699769221cd4505de2
-
Filesize
158.4MB
MD515529475ac91826af75d06b6c1ba1ecc
SHA13d8bc5e0e800e90ccfba6c6195843e0803b9fab4
SHA256cd8602d1ce348d5ae2c301060992d1f12030101d820cfcca7c61a7b540ad4b91
SHA512f43aca2adf5c3227867cac35493af60a31d9a00722f15a99e35bf3889ec74f6bc9451f1f60e1a0e52e85c04f0015ab3d8c0598ef9d33d3043f04636d8d054c9a
-
Filesize
158.4MB
MD515529475ac91826af75d06b6c1ba1ecc
SHA13d8bc5e0e800e90ccfba6c6195843e0803b9fab4
SHA256cd8602d1ce348d5ae2c301060992d1f12030101d820cfcca7c61a7b540ad4b91
SHA512f43aca2adf5c3227867cac35493af60a31d9a00722f15a99e35bf3889ec74f6bc9451f1f60e1a0e52e85c04f0015ab3d8c0598ef9d33d3043f04636d8d054c9a
-
Filesize
149.3MB
MD53193b0b2bc864fd5f8d4829823f6e121
SHA17bf48811cab3a95f92cf598ca34545cc818ea0d4
SHA256766974654634a53acf8a470835f7fc23c2438a1df65d1cea1671a4fd98e68fbc
SHA512c9325517abf50f4518f0dc11d0401b29cafc30c4a0d8e644032ced392cd7bcb617133320594138f3b73ccd9552ef5f1a742541f0b54879f5af1680f305121aed
-
Filesize
141.4MB
MD59f6f98441f33c88a6e4d97fa107d0135
SHA12e34d00bf28a2129daf3e6f17720d9b6c7b1e43e
SHA2567124877dde0124308e7f94adb738deac9f463fcdfae9d7859ad54923aeddaeb4
SHA5124fda285aabf5b3be4dd36f5675016c272097d16f2b7e45580040a8faa97912f46673f189d64109f2a57210eaffa77f250d162195cccd36f6d156f5930d6bcdd9
-
Filesize
116.6MB
MD540a6f3871ccda8b842f548ef59c4473b
SHA10a781f19ffdc1ad6cb7003eb4262ba6152bcc386
SHA2565ecf1a712ec2e5ef9525964d93ae37bebd6c4122e1a352a53ef8d6450a8856a2
SHA51277d2c2cde4e95f552d0e6161d31f8e0e1268fb406ae5c1db8997cc2cd1f4fa2c755250d3adb96a0b1fa7671dcfc68596096864e63e699b378a184c85ce513857
-
Filesize
116.2MB
MD543d90e6cdbf3d617fead5958daed1010
SHA1c3c83a5a792feb3f2ea7a6a37952d349daaa6209
SHA2561edc7f0ea207bea0ecee71b6565aa9b3cf1fd7904cce904bed6275402081b0de
SHA5128b533da09281acd2ae1a853e538d4fb65e751590d7c22a0eff74a6d9da89248b7448297a410187022f70b1b22a2d0c9ed8a46f7b848477e66faeb9871933e5e1
-
Filesize
87.6MB
MD5efbc2714d7173a3b9d586b7915952903
SHA129f33605aa8f60ae59f2a2627f7ecf8664a77a0b
SHA2565ee436bc67b264453fc765c5afae7201b49e12f59a64e93ed34eee3f091ee6ac
SHA512b2a270de43943f03b3644e1cfa1cc9110bb90089cd655a1b530a9e2edcbedbd367d67eaf9790383825db2e456c14eb5c0cca39734d620b009d8ea1a60122cc9a
-
Filesize
115.2MB
MD519e510379b35b1c60cff44b245bfc6f2
SHA1a25999ee06b0edf23cdf34093590f2ccdf71edb7
SHA2568e5ed02d5536a0f7c23ae74a34acb7e43b075e224a7442dff22650409866721d
SHA512a4c88e6fc72b7882c70f63f90d629d0089a144034dcd81b2abaebb2572f3e1d4a06bea9dcea7407b9f4ca83d19542190e95e776552fd26ec116e0f4e00e7030c
-
Filesize
372KB
MD52b1132fc8f12d4fa3ec68a3293f22d0a
SHA1ac25afab91399f79e8e6138a0290f1513020571a
SHA256b424b7ad12aee02a9de5b6b740ee962df760de6f0d1f04e353ce1269dbf7403a
SHA512fef1c6b0ae2829b4aafd12d046aa9506c4df6d4be6165167cb13aaadd3682ef72746ee9aeda40b8acc56691888f36f1005b6b85d161a6b32c9a0fa7730753029
-
Filesize
6.2MB
MD59933cb0b99c9651de7832d8fd05b1de0
SHA10e5ddbfbc1f0788a9fbc57e751c8b9ce7e8ec18b
SHA256262e337d30ba6c9a64d357ac6511856dab4b546ed47114f509de6f37451134a0
SHA512b6f061133a8f7b6edb3287a08e300fcae0b8cee41cee25facb81a4a297e8e3c0e17aa9348c35a6a5cfffaeeb2d8f2205fc7a1ff25a376c699769221cd4505de2
-
Filesize
364KB
MD5d3368f2e6b469fda055af7a24f4fdb02
SHA1841573fc67ca72cd2f37a89d5c8007fa8de0c6f1
SHA25681140417f3299086fc358f946c49b96d24bcaff0c09baa3292e24a8b361c0813
SHA51296811790b03ed2044241aa9d62069bdfde1bdaa94457c2cb86befc4c29f4db966fb27a45d94349c0110d19d9060fbb916a48fcfe5a517052a4d4fb384cf5922c
-
Filesize
13KB
MD5159d3901f386388df374566fb6fcd622
SHA17ef0b2b651a7bdcba44efafb5e67b922d447f198
SHA256e531925d86eb4f14ff09675bebce21a5ab6301ab139052f0514752e8ea346a19
SHA512c951416ccfca17a533719e00d244844469a35dd7c6b1b21ad24daa400881b265750d97039c7e7f37e5d058b92402b1a016ca57315adb89627e0692330bc3282f
-
Filesize
7.3MB
MD5d74731ce9b252737721129bb55970598
SHA118d25adbe1c2c808d71ead465281bfe3a1d637d0
SHA256d9bc680a02d25144c143ff6825ae8f149c9abf85f3894e975de6befed28bea0c
SHA512c64bc65632fa523c63bf3843374779d004626c7f121115234b48bcddd56fc731fd11b62c2934f3b6174e6a1df7feace46f9db5335c9add46e3fbc3bad5e72f09
-
Filesize
590KB
MD510409a90206eb4859d27095aebf4c392
SHA12a9aa6951c923ccb5ca25348e161ee8799985e7b
SHA2562de3925cba036e1eec21eccd40c35e501958938cf9f96bd125e145ba12c446a2
SHA51296d7d065ab39d9a1e7850eeb6d23df9da5b0f6e91ea5c6258a06cef3d39c5eeded3117e83cbc1d0a7b0ed73dc656ef0d2b50651bb99800902186b4f1fb1cfd8e
-
Filesize
4.3MB
MD54fed87a14384c86689d69875d0c6f9a6
SHA1d315cc38b3703bc9935cd5d9604e6ff775243d2e
SHA256203b35ef27ca4bdeb8e241b1b58318234460e5ffaeb030f598eacccf542b2552
SHA51228614b9516c633a52391ebbb848994d6f23b2720d2e168351648a9625f581b2ae9274be892f1c891d982222ecbcfeb34f3c2d596f63231541eb4dd57bf14c9d7
-
Filesize
4.3MB
MD54fed87a14384c86689d69875d0c6f9a6
SHA1d315cc38b3703bc9935cd5d9604e6ff775243d2e
SHA256203b35ef27ca4bdeb8e241b1b58318234460e5ffaeb030f598eacccf542b2552
SHA51228614b9516c633a52391ebbb848994d6f23b2720d2e168351648a9625f581b2ae9274be892f1c891d982222ecbcfeb34f3c2d596f63231541eb4dd57bf14c9d7
-
Filesize
106B
MD58642dd3a87e2de6e991fae08458e302b
SHA19c06735c31cec00600fd763a92f8112d085bd12a
SHA25632d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
-
Filesize
782KB
MD5a7d7a64dd61f1b7772d4f3f2fa0e51ea
SHA155076ac2dbdae4677cac689af29a9ec0277aa2fe
SHA256bf77cd8a299afdb7a259626423b31f4c4ee7674de5d57e1ba858f79d3ac8af15
SHA5121940243ecda51d47aa69b0ae453d36a16d5ae1e22acc2dabce58058c5d0af4f9f4d17b09a95b25e2fc81f3b329dbb4d781c647d731c293ebd5207466dc261ec8
-
Filesize
782KB
MD5a7d7a64dd61f1b7772d4f3f2fa0e51ea
SHA155076ac2dbdae4677cac689af29a9ec0277aa2fe
SHA256bf77cd8a299afdb7a259626423b31f4c4ee7674de5d57e1ba858f79d3ac8af15
SHA5121940243ecda51d47aa69b0ae453d36a16d5ae1e22acc2dabce58058c5d0af4f9f4d17b09a95b25e2fc81f3b329dbb4d781c647d731c293ebd5207466dc261ec8
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e