Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
132s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
01/08/2023, 22:06
Static task
static1
Behavioral task
behavioral1
Sample
72af3ad87318ff45235536221dadb954c45638265dc5ba136fa2e59d00019ac4.exe
Resource
win10-20230703-en
General
-
Target
72af3ad87318ff45235536221dadb954c45638265dc5ba136fa2e59d00019ac4.exe
-
Size
1.4MB
-
MD5
3b88b26234c8843de38cff15dad46f2b
-
SHA1
1721fa057e6101e27079ef2d26d5ded076d7fbcb
-
SHA256
72af3ad87318ff45235536221dadb954c45638265dc5ba136fa2e59d00019ac4
-
SHA512
39ec55d067cf930624e56cf2824092b3e075f753e575b41feb2ab104285f5e9dfc1d0a7d493f465910545794a18ef2c9cf7fefee0a00a076c3ba65cbe7baa33b
-
SSDEEP
24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 4456 netsh.exe 744 netsh.exe -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000700000001b01f-248.dat acprotect behavioral1/files/0x000700000001b01f-249.dat acprotect -
Executes dropped EXE 3 IoCs
pid Process 2900 7z.exe 2184 ratt.exe 3000 ratt.exe -
Loads dropped DLL 1 IoCs
pid Process 2900 7z.exe -
resource yara_rule behavioral1/memory/2900-246-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x000700000001b022-245.dat upx behavioral1/files/0x000700000001b022-247.dat upx behavioral1/files/0x000700000001b01f-248.dat upx behavioral1/files/0x000700000001b01f-249.dat upx behavioral1/memory/2900-250-0x0000000010000000-0x00000000100E2000-memory.dmp upx behavioral1/memory/2900-254-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ratt = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ratt.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 2 IoCs
pid Process 2576 PING.EXE 4668 PING.EXE -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 4600 powershell.exe 4600 powershell.exe 4600 powershell.exe 5036 powershell.exe 5036 powershell.exe 5036 powershell.exe 2684 powershell.exe 2684 powershell.exe 2684 powershell.exe 1472 powershell.exe 1472 powershell.exe 1472 powershell.exe 4148 powershell.exe 4148 powershell.exe 4148 powershell.exe 2736 powershell.exe 2736 powershell.exe 2736 powershell.exe 2184 ratt.exe 2184 ratt.exe 2184 ratt.exe 2184 ratt.exe 2184 ratt.exe 2184 ratt.exe 2184 ratt.exe 2184 ratt.exe 2184 ratt.exe 2184 ratt.exe 2184 ratt.exe 2184 ratt.exe 2184 ratt.exe 2184 ratt.exe 2184 ratt.exe 2184 ratt.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 616 WMIC.exe Token: SeSecurityPrivilege 616 WMIC.exe Token: SeTakeOwnershipPrivilege 616 WMIC.exe Token: SeLoadDriverPrivilege 616 WMIC.exe Token: SeSystemProfilePrivilege 616 WMIC.exe Token: SeSystemtimePrivilege 616 WMIC.exe Token: SeProfSingleProcessPrivilege 616 WMIC.exe Token: SeIncBasePriorityPrivilege 616 WMIC.exe Token: SeCreatePagefilePrivilege 616 WMIC.exe Token: SeBackupPrivilege 616 WMIC.exe Token: SeRestorePrivilege 616 WMIC.exe Token: SeShutdownPrivilege 616 WMIC.exe Token: SeDebugPrivilege 616 WMIC.exe Token: SeSystemEnvironmentPrivilege 616 WMIC.exe Token: SeRemoteShutdownPrivilege 616 WMIC.exe Token: SeUndockPrivilege 616 WMIC.exe Token: SeManageVolumePrivilege 616 WMIC.exe Token: 33 616 WMIC.exe Token: 34 616 WMIC.exe Token: 35 616 WMIC.exe Token: 36 616 WMIC.exe Token: SeIncreaseQuotaPrivilege 616 WMIC.exe Token: SeSecurityPrivilege 616 WMIC.exe Token: SeTakeOwnershipPrivilege 616 WMIC.exe Token: SeLoadDriverPrivilege 616 WMIC.exe Token: SeSystemProfilePrivilege 616 WMIC.exe Token: SeSystemtimePrivilege 616 WMIC.exe Token: SeProfSingleProcessPrivilege 616 WMIC.exe Token: SeIncBasePriorityPrivilege 616 WMIC.exe Token: SeCreatePagefilePrivilege 616 WMIC.exe Token: SeBackupPrivilege 616 WMIC.exe Token: SeRestorePrivilege 616 WMIC.exe Token: SeShutdownPrivilege 616 WMIC.exe Token: SeDebugPrivilege 616 WMIC.exe Token: SeSystemEnvironmentPrivilege 616 WMIC.exe Token: SeRemoteShutdownPrivilege 616 WMIC.exe Token: SeUndockPrivilege 616 WMIC.exe Token: SeManageVolumePrivilege 616 WMIC.exe Token: 33 616 WMIC.exe Token: 34 616 WMIC.exe Token: 35 616 WMIC.exe Token: 36 616 WMIC.exe Token: SeDebugPrivilege 4600 powershell.exe Token: SeDebugPrivilege 5036 powershell.exe Token: SeDebugPrivilege 2684 powershell.exe Token: SeDebugPrivilege 1472 powershell.exe Token: SeDebugPrivilege 4148 powershell.exe Token: SeDebugPrivilege 2736 powershell.exe Token: SeIncreaseQuotaPrivilege 1560 WMIC.exe Token: SeSecurityPrivilege 1560 WMIC.exe Token: SeTakeOwnershipPrivilege 1560 WMIC.exe Token: SeLoadDriverPrivilege 1560 WMIC.exe Token: SeSystemProfilePrivilege 1560 WMIC.exe Token: SeSystemtimePrivilege 1560 WMIC.exe Token: SeProfSingleProcessPrivilege 1560 WMIC.exe Token: SeIncBasePriorityPrivilege 1560 WMIC.exe Token: SeCreatePagefilePrivilege 1560 WMIC.exe Token: SeBackupPrivilege 1560 WMIC.exe Token: SeRestorePrivilege 1560 WMIC.exe Token: SeShutdownPrivilege 1560 WMIC.exe Token: SeDebugPrivilege 1560 WMIC.exe Token: SeSystemEnvironmentPrivilege 1560 WMIC.exe Token: SeRemoteShutdownPrivilege 1560 WMIC.exe Token: SeUndockPrivilege 1560 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4144 wrote to memory of 2092 4144 72af3ad87318ff45235536221dadb954c45638265dc5ba136fa2e59d00019ac4.exe 70 PID 4144 wrote to memory of 2092 4144 72af3ad87318ff45235536221dadb954c45638265dc5ba136fa2e59d00019ac4.exe 70 PID 4144 wrote to memory of 2092 4144 72af3ad87318ff45235536221dadb954c45638265dc5ba136fa2e59d00019ac4.exe 70 PID 2092 wrote to memory of 1496 2092 cmd.exe 73 PID 2092 wrote to memory of 1496 2092 cmd.exe 73 PID 2092 wrote to memory of 1496 2092 cmd.exe 73 PID 1496 wrote to memory of 368 1496 cmd.exe 74 PID 1496 wrote to memory of 368 1496 cmd.exe 74 PID 1496 wrote to memory of 368 1496 cmd.exe 74 PID 2092 wrote to memory of 3040 2092 cmd.exe 75 PID 2092 wrote to memory of 3040 2092 cmd.exe 75 PID 2092 wrote to memory of 3040 2092 cmd.exe 75 PID 3040 wrote to memory of 616 3040 cmd.exe 76 PID 3040 wrote to memory of 616 3040 cmd.exe 76 PID 3040 wrote to memory of 616 3040 cmd.exe 76 PID 2092 wrote to memory of 4600 2092 cmd.exe 78 PID 2092 wrote to memory of 4600 2092 cmd.exe 78 PID 2092 wrote to memory of 4600 2092 cmd.exe 78 PID 2092 wrote to memory of 5036 2092 cmd.exe 79 PID 2092 wrote to memory of 5036 2092 cmd.exe 79 PID 2092 wrote to memory of 5036 2092 cmd.exe 79 PID 2092 wrote to memory of 2684 2092 cmd.exe 80 PID 2092 wrote to memory of 2684 2092 cmd.exe 80 PID 2092 wrote to memory of 2684 2092 cmd.exe 80 PID 2092 wrote to memory of 1472 2092 cmd.exe 81 PID 2092 wrote to memory of 1472 2092 cmd.exe 81 PID 2092 wrote to memory of 1472 2092 cmd.exe 81 PID 2092 wrote to memory of 4148 2092 cmd.exe 82 PID 2092 wrote to memory of 4148 2092 cmd.exe 82 PID 2092 wrote to memory of 4148 2092 cmd.exe 82 PID 2092 wrote to memory of 2900 2092 cmd.exe 83 PID 2092 wrote to memory of 2900 2092 cmd.exe 83 PID 2092 wrote to memory of 2900 2092 cmd.exe 83 PID 2092 wrote to memory of 2736 2092 cmd.exe 84 PID 2092 wrote to memory of 2736 2092 cmd.exe 84 PID 2092 wrote to memory of 2736 2092 cmd.exe 84 PID 2736 wrote to memory of 4456 2736 powershell.exe 85 PID 2736 wrote to memory of 4456 2736 powershell.exe 85 PID 2736 wrote to memory of 4456 2736 powershell.exe 85 PID 2736 wrote to memory of 744 2736 powershell.exe 86 PID 2736 wrote to memory of 744 2736 powershell.exe 86 PID 2736 wrote to memory of 744 2736 powershell.exe 86 PID 2736 wrote to memory of 624 2736 powershell.exe 87 PID 2736 wrote to memory of 624 2736 powershell.exe 87 PID 2736 wrote to memory of 624 2736 powershell.exe 87 PID 624 wrote to memory of 1560 624 cmd.exe 88 PID 624 wrote to memory of 1560 624 cmd.exe 88 PID 624 wrote to memory of 1560 624 cmd.exe 88 PID 2736 wrote to memory of 4104 2736 powershell.exe 89 PID 2736 wrote to memory of 4104 2736 powershell.exe 89 PID 2736 wrote to memory of 4104 2736 powershell.exe 89 PID 4104 wrote to memory of 536 4104 cmd.exe 90 PID 4104 wrote to memory of 536 4104 cmd.exe 90 PID 4104 wrote to memory of 536 4104 cmd.exe 90 PID 2736 wrote to memory of 2184 2736 powershell.exe 91 PID 2736 wrote to memory of 2184 2736 powershell.exe 91 PID 2736 wrote to memory of 2184 2736 powershell.exe 91 PID 2736 wrote to memory of 2268 2736 powershell.exe 92 PID 2736 wrote to memory of 2268 2736 powershell.exe 92 PID 2736 wrote to memory of 2268 2736 powershell.exe 92 PID 2092 wrote to memory of 2600 2092 cmd.exe 94 PID 2092 wrote to memory of 2600 2092 cmd.exe 94 PID 2092 wrote to memory of 2600 2092 cmd.exe 94 PID 2184 wrote to memory of 4368 2184 ratt.exe 96 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2268 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\72af3ad87318ff45235536221dadb954c45638265dc5ba136fa2e59d00019ac4.exe"C:\Users\Admin\AppData\Local\Temp\72af3ad87318ff45235536221dadb954c45638265dc5ba136fa2e59d00019ac4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com3⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\nslookup.exenslookup myip.opendns.com. resolver1.opendns.com4⤵PID:368
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain3⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic ComputerSystem get Domain4⤵
- Suspicious use of AdjustPrivilegeToken
PID:616
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5036
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148
-
-
C:\Users\Admin\AppData\Local\Temp\7z.exe7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4456
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:744
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic computersystem where name="GGEPMLAP" set AutomaticManagedPagefile=False5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=200005⤵PID:536
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"5⤵PID:4368
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 106⤵
- Runs ping.exe
PID:2576
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 13 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 13 > nul && "C:\Users\Admin\Music\rot.exe"5⤵PID:4152
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 136⤵
- Runs ping.exe
PID:4668
-
-
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"4⤵
- Views/modifies file attributes
PID:2268
-
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F3⤵
- Adds Run key to start application
PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\ratt.exe"ratt.exe"3⤵
- Executes dropped EXE
PID:3000
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
629.5MB
MD575494eb6e11d07034cd6cb4d3df981b2
SHA17d88e98edacde25c59b9f9ef7d2850712b73781f
SHA25646a4c431cddc5a074dbef92474307429832b62f492c76078799f129bd662ee06
SHA5124bd0fc7a7a5e51b6cbb8f630c9016d3400a8badb260333b8cf6f5a5ac352f324e77123362e2cca214004f6e2c9b376f93af06de560ed7787caf5f7e2813e9736
-
Filesize
376.6MB
MD53615beac38d30e6a2fb393f81924f7a6
SHA14c2fcc807ed7a1fda0e1d5ddc01e520189f18f5a
SHA2563631c3b01601f1e12cfe2dca7a94013de4ade49bf9b763a64553f9f08c8beea7
SHA51215a82e03d2a659249c3482d6b27358c38caf409e8f07be6bb44ec84e99a080b37f30de665c16797cc4066eb28f09cb64a74b70fbdac920ecae9cb7bd2119d574
-
Filesize
1KB
MD50f5cbdca905beb13bebdcf43fb0716bd
SHA19e136131389fde83297267faf6c651d420671b3f
SHA256a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060
SHA512a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0
-
Filesize
1KB
MD59e104e9aa0cfdec0753de24cbe3f587b
SHA1f63b8d0b29c65e518be6a9412e7499c9de11be78
SHA25659a9f13de0e003ea4adcd0193477f147b0c91ae847eebc744e91a4efe167223f
SHA5128253854159ceac2d84eb371c9672730831505dea52ac3bc2cca45ee5308717ca3f11734602d0a409974b137084a8c20e6b7653640991e45708f692c65ac4933b
-
Filesize
12KB
MD58b5605285209e6dab7b151696f4d1142
SHA10d66ecdf4949e836e43a28562c75883e37428034
SHA25646bbae7856b46c1195306cc98107d854bbc30ee2d7e008e41ab44184daf2f234
SHA512c5086e6bb9cc40b2d6103946b7eef51edb5a3fb947c21c83a36e24bae9ddd64c0707bdf7f92e6c7723dcb8d8d651b2f87bdedf89e7b637469b03ab948371f77c
-
Filesize
12KB
MD57e200997430ddc33f645c4c8a369b280
SHA1f422c8b483445cbd4689465746986cd48660c2a9
SHA25641c37dfa2750256853c95f5dbe3e2ff7d42139978c0771e1ec365f271756de06
SHA51269f2e78953d2a1c1b76eda79c18ec53e0ee23e6d2b19eadd462964435fa195ac852c506c7583f7a0eb75a4500ecb41801f69b25dbaafd8289733fe34e127ffc3
-
Filesize
12KB
MD55ecce2129e7563297349cdf41e1eadae
SHA1529f1f7bf49d9a88f6d2d380dffb9ec73f4eeb90
SHA256f6807f3fb3c5559e004897d931ccd5fcb20fe5404f189c500689ece85205c0b0
SHA51249c1d62f3120872e0bb3b8678a4e319b709354b2e171c76018a925820ae2da270cedc1ce46df8cff17bd0f4cf450bd592f250b1a2eb21e9932b74a1e20b30d7a
-
Filesize
12KB
MD5df6e55e61d5414158126b344edf7aec7
SHA10f5ddd3a921f67fe0c84dc864af017ef2aeeec17
SHA256a783e8c6c8afce2ffeedbbd8f5d1e64e9bb759bbe166236d4ce939548e7a81fb
SHA512f145ff4f40d0261ccdb0e8d2edc129b1648f6cf1a5775e33d09f2b17aa6cacb104ac51fd93bbe71b562a5aee05e42fd76211fd93cf725ae90934dbbcea085386
-
Filesize
12KB
MD51f0b8ee5c7f16fe0469190915062eb84
SHA19d42fdb47d38d6b7b1af22996c0a6c04d45d9f1e
SHA256fb195f4246e1651e7bb36f8714873ff5ce3ea7aa624c55f4eafdc2c9a14e1554
SHA5127eab404b954b38e96b11c94092ab5637a7daff7ff19b6a86c3bed52053f191791400d745c1fe5ada21299f970cfa32d47d7202498889d5a9f657c39ff9ef5372
-
Filesize
328KB
MD515bbbe562f9be3e5dcbb834e635cc231
SHA17c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a
SHA256ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde
SHA512769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287
-
Filesize
71KB
MD58ba2e41b330ae9356e62eb63514cf82e
SHA18dc266467a5a0d587ed0181d4344581ef4ff30b2
SHA256ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea
SHA5122fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d
-
Filesize
71KB
MD58ba2e41b330ae9356e62eb63514cf82e
SHA18dc266467a5a0d587ed0181d4344581ef4ff30b2
SHA256ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea
SHA5122fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d
-
Filesize
1KB
MD50df43097e0f0acd04d9e17fb43d618b9
SHA169b3ade12cb228393a93624e65f41604a17c83b6
SHA256c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873
SHA51201ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
693KB
MD57de6fdf3629c73bf0c29a96fa23ae055
SHA1dcb37f6d43977601c6460b17387a89b9e4c0609a
SHA256069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff
SHA512d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8
-
Filesize
1KB
MD57ea1fec84d76294d9256ae3dca7676b2
SHA11e335451d1cbb6951bc77bf75430f4d983491342
SHA2569a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940
SHA512ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317
-
Filesize
745.1MB
MD5be788bb3680cf3809d9678ee6f7ba321
SHA1499f01d5f654f83e172004dcc03f99abdd251734
SHA25603a17a2b669f72df082569ea477977d824796da3b6b7a8d0e6f91f2629ef406b
SHA51283c0b885740a57b84b2c909d0d6bb25baaa49d62499773030b59058325f37a5fcf39a1cd59ef9c229ca7289af7250034f6652e449625b67c2d260b285ddb9a8e
-
Filesize
125.1MB
MD5658758021a28a82763a68cfcd8d66717
SHA143a5c3af27b960288b00a48579a125aab554dd6b
SHA256f4b8f2a10e47d9761a511962fbf21f6212a302f533b9bea957943d96902fbf9d
SHA5124a38f4903d04a3918c0e9120d0c7de5dd76e924d3af92a3c87ad2a5c0841ee823a48f78f9b865571cd4440b104d71deea3ac46eeb3faaf66c3028851f65ecf51
-
Filesize
328KB
MD515bbbe562f9be3e5dcbb834e635cc231
SHA17c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a
SHA256ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde
SHA512769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287