Analysis
-
max time kernel
39s -
max time network
155s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
01/08/2023, 07:53
Static task
static1
General
-
Target
231a7780f0f4272deb756c57250382671a1a8f723730a3ad5ceb7f7fd1e600cd.exe
-
Size
1.4MB
-
MD5
5508e10623b574a73b8654d223fa9718
-
SHA1
30092da28b32e08cfa72d5b579fb34aeff90020e
-
SHA256
231a7780f0f4272deb756c57250382671a1a8f723730a3ad5ceb7f7fd1e600cd
-
SHA512
9daeea07f673543a95d9939381998a5aaf24f6934353edc27e008cd938e5a56f49702aa186d64a3c2bad5fe47496361b17e72e79bb70cedcb1616335df07ae5e
-
SSDEEP
24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk
Malware Config
Extracted
quasar
1.3.0.0
-
94.131.105.161:12344
QSR_MUTEX_UEgITWnMKnRP3EZFzK
-
encryption_key
5Q0JQBQQfAUHRJTcAIOF
-
install_name
lient.exe
-
log_directory
Lugs
-
reconnect_delay
3000
-
startup_key
itartup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
resource yara_rule behavioral1/memory/2192-617-0x0000000000400000-0x000000000045E000-memory.dmp family_quasar -
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 164 netsh.exe 2400 netsh.exe -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000700000001b017-257.dat acprotect behavioral1/files/0x000700000001b017-258.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 4348 7z.exe -
Loads dropped DLL 1 IoCs
pid Process 4348 7z.exe -
resource yara_rule behavioral1/memory/4348-255-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x000700000001b01b-256.dat upx behavioral1/files/0x000700000001b01b-254.dat upx behavioral1/files/0x000700000001b017-257.dat upx behavioral1/files/0x000700000001b017-258.dat upx behavioral1/memory/4348-259-0x0000000010000000-0x00000000100E2000-memory.dmp upx behavioral1/memory/4348-263-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 4 IoCs
pid Process 4928 PING.EXE 716 PING.EXE 920 PING.EXE 3176 PING.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4732 powershell.exe 4732 powershell.exe 4732 powershell.exe 3368 powershell.exe 3368 powershell.exe 3368 powershell.exe 164 powershell.exe 164 powershell.exe 164 powershell.exe 3224 powershell.exe 3224 powershell.exe 3224 powershell.exe 2996 powershell.exe 2996 powershell.exe 2996 powershell.exe 3184 powershell.exe 3184 powershell.exe 3184 powershell.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 332 WMIC.exe Token: SeSecurityPrivilege 332 WMIC.exe Token: SeTakeOwnershipPrivilege 332 WMIC.exe Token: SeLoadDriverPrivilege 332 WMIC.exe Token: SeSystemProfilePrivilege 332 WMIC.exe Token: SeSystemtimePrivilege 332 WMIC.exe Token: SeProfSingleProcessPrivilege 332 WMIC.exe Token: SeIncBasePriorityPrivilege 332 WMIC.exe Token: SeCreatePagefilePrivilege 332 WMIC.exe Token: SeBackupPrivilege 332 WMIC.exe Token: SeRestorePrivilege 332 WMIC.exe Token: SeShutdownPrivilege 332 WMIC.exe Token: SeDebugPrivilege 332 WMIC.exe Token: SeSystemEnvironmentPrivilege 332 WMIC.exe Token: SeRemoteShutdownPrivilege 332 WMIC.exe Token: SeUndockPrivilege 332 WMIC.exe Token: SeManageVolumePrivilege 332 WMIC.exe Token: 33 332 WMIC.exe Token: 34 332 WMIC.exe Token: 35 332 WMIC.exe Token: 36 332 WMIC.exe Token: SeIncreaseQuotaPrivilege 332 WMIC.exe Token: SeSecurityPrivilege 332 WMIC.exe Token: SeTakeOwnershipPrivilege 332 WMIC.exe Token: SeLoadDriverPrivilege 332 WMIC.exe Token: SeSystemProfilePrivilege 332 WMIC.exe Token: SeSystemtimePrivilege 332 WMIC.exe Token: SeProfSingleProcessPrivilege 332 WMIC.exe Token: SeIncBasePriorityPrivilege 332 WMIC.exe Token: SeCreatePagefilePrivilege 332 WMIC.exe Token: SeBackupPrivilege 332 WMIC.exe Token: SeRestorePrivilege 332 WMIC.exe Token: SeShutdownPrivilege 332 WMIC.exe Token: SeDebugPrivilege 332 WMIC.exe Token: SeSystemEnvironmentPrivilege 332 WMIC.exe Token: SeRemoteShutdownPrivilege 332 WMIC.exe Token: SeUndockPrivilege 332 WMIC.exe Token: SeManageVolumePrivilege 332 WMIC.exe Token: 33 332 WMIC.exe Token: 34 332 WMIC.exe Token: 35 332 WMIC.exe Token: 36 332 WMIC.exe Token: SeDebugPrivilege 4732 powershell.exe Token: SeDebugPrivilege 3368 powershell.exe Token: SeDebugPrivilege 164 powershell.exe Token: SeDebugPrivilege 3224 powershell.exe Token: SeDebugPrivilege 2996 powershell.exe Token: SeDebugPrivilege 3184 powershell.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 3996 wrote to memory of 2960 3996 231a7780f0f4272deb756c57250382671a1a8f723730a3ad5ceb7f7fd1e600cd.exe 70 PID 3996 wrote to memory of 2960 3996 231a7780f0f4272deb756c57250382671a1a8f723730a3ad5ceb7f7fd1e600cd.exe 70 PID 3996 wrote to memory of 2960 3996 231a7780f0f4272deb756c57250382671a1a8f723730a3ad5ceb7f7fd1e600cd.exe 70 PID 2960 wrote to memory of 1220 2960 cmd.exe 73 PID 2960 wrote to memory of 1220 2960 cmd.exe 73 PID 2960 wrote to memory of 1220 2960 cmd.exe 73 PID 1220 wrote to memory of 928 1220 cmd.exe 74 PID 1220 wrote to memory of 928 1220 cmd.exe 74 PID 1220 wrote to memory of 928 1220 cmd.exe 74 PID 2960 wrote to memory of 2284 2960 cmd.exe 75 PID 2960 wrote to memory of 2284 2960 cmd.exe 75 PID 2960 wrote to memory of 2284 2960 cmd.exe 75 PID 2284 wrote to memory of 332 2284 cmd.exe 76 PID 2284 wrote to memory of 332 2284 cmd.exe 76 PID 2284 wrote to memory of 332 2284 cmd.exe 76 PID 2960 wrote to memory of 4732 2960 cmd.exe 78 PID 2960 wrote to memory of 4732 2960 cmd.exe 78 PID 2960 wrote to memory of 4732 2960 cmd.exe 78 PID 2960 wrote to memory of 3368 2960 cmd.exe 79 PID 2960 wrote to memory of 3368 2960 cmd.exe 79 PID 2960 wrote to memory of 3368 2960 cmd.exe 79 PID 2960 wrote to memory of 164 2960 cmd.exe 80 PID 2960 wrote to memory of 164 2960 cmd.exe 80 PID 2960 wrote to memory of 164 2960 cmd.exe 80 PID 2960 wrote to memory of 3224 2960 cmd.exe 81 PID 2960 wrote to memory of 3224 2960 cmd.exe 81 PID 2960 wrote to memory of 3224 2960 cmd.exe 81 PID 2960 wrote to memory of 2996 2960 cmd.exe 82 PID 2960 wrote to memory of 2996 2960 cmd.exe 82 PID 2960 wrote to memory of 2996 2960 cmd.exe 82 PID 2960 wrote to memory of 4348 2960 cmd.exe 83 PID 2960 wrote to memory of 4348 2960 cmd.exe 83 PID 2960 wrote to memory of 4348 2960 cmd.exe 83 PID 2960 wrote to memory of 3184 2960 cmd.exe 84 PID 2960 wrote to memory of 3184 2960 cmd.exe 84 PID 2960 wrote to memory of 3184 2960 cmd.exe 84 PID 3184 wrote to memory of 164 3184 powershell.exe 85 PID 3184 wrote to memory of 164 3184 powershell.exe 85 PID 3184 wrote to memory of 164 3184 powershell.exe 85 PID 3184 wrote to memory of 2400 3184 powershell.exe 86 PID 3184 wrote to memory of 2400 3184 powershell.exe 86 PID 3184 wrote to memory of 2400 3184 powershell.exe 86 PID 3184 wrote to memory of 3896 3184 powershell.exe 87 PID 3184 wrote to memory of 3896 3184 powershell.exe 87 PID 3184 wrote to memory of 3896 3184 powershell.exe 87 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1412 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\231a7780f0f4272deb756c57250382671a1a8f723730a3ad5ceb7f7fd1e600cd.exe"C:\Users\Admin\AppData\Local\Temp\231a7780f0f4272deb756c57250382671a1a8f723730a3ad5ceb7f7fd1e600cd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com3⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\nslookup.exenslookup myip.opendns.com. resolver1.opendns.com4⤵PID:928
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain3⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic ComputerSystem get Domain4⤵
- Suspicious use of AdjustPrivilegeToken
PID:332
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4732
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3368
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:164
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3224
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
-
C:\Users\Admin\AppData\Local\Temp\7z.exe7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4348
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:164
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:2400
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:3896
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic computersystem where name="CXVLSGIX" set AutomaticManagedPagefile=False5⤵PID:212
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:924
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=200005⤵PID:3864
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"4⤵PID:2980
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"5⤵PID:3488
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 76⤵
- Runs ping.exe
PID:716
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"6⤵PID:4072
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 13 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 13 > nul && "C:\Users\Admin\Music\rot.exe"5⤵PID:3796
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 136⤵
- Runs ping.exe
PID:920
-
-
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"4⤵
- Views/modifies file attributes
PID:1412
-
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F3⤵PID:4764
-
-
C:\Users\Admin\AppData\Local\Temp\ratt.exe"ratt.exe"3⤵PID:1088
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 10 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 10 > nul && "C:\Users\Admin\Music\rot.exe"4⤵PID:2624
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 105⤵
- Runs ping.exe
PID:3176
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 105⤵
- Runs ping.exe
PID:4928
-
-
C:\Users\Admin\Music\rot.exe"C:\Users\Admin\Music\rot.exe"5⤵PID:2948
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"6⤵PID:2192
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231.6MB
MD569d3b004b17f53fcf6c7bdec1ba205b4
SHA19ff86401704c40db5c2f420a836fda94fd58fb33
SHA256c8143283ff7c01d2660550f1b9db1b2c0b739abda8d7e0ca52cc17ffdd4a67e1
SHA51290fa78e6a7ad37a1d02ccc74655c772997d91c1f315d58c9134b60c2baacb11c5c5bd2d7ac03e3135abf30575223a1ace30f7432fcc075675d999f27a2abe247
-
Filesize
163.4MB
MD50c8fb1b6e6ad1b3584dc37055ed61714
SHA1d02394d2602126807a8c65796e78bc1f3fb5934d
SHA2566a7d4a057b43728adfc4a1f48f0569fca03dc435af1d6358f9312371b78618a5
SHA5129ebf1ab639a78a363cf3bf5b22c6a016ec11acd6ec05954a5673aeec48e8e9ee45b0157677dbbb42baf70caaea59070785083644065e6e88909a85d1e0008642
-
Filesize
1KB
MD50f5cbdca905beb13bebdcf43fb0716bd
SHA19e136131389fde83297267faf6c651d420671b3f
SHA256a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060
SHA512a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0
-
Filesize
1KB
MD59e104e9aa0cfdec0753de24cbe3f587b
SHA1f63b8d0b29c65e518be6a9412e7499c9de11be78
SHA25659a9f13de0e003ea4adcd0193477f147b0c91ae847eebc744e91a4efe167223f
SHA5128253854159ceac2d84eb371c9672730831505dea52ac3bc2cca45ee5308717ca3f11734602d0a409974b137084a8c20e6b7653640991e45708f692c65ac4933b
-
Filesize
12KB
MD58eb4b5fe8ece688db99d9a2054fdd4e4
SHA104f747cf6d7e6b217bafc5d9d31d17acc17db338
SHA256705482878f52a44038f01f1c749d78a9dda820d4e777f51f24ec7b1b98847e1d
SHA512eac888713a1fd5af628ab1b32fc6bb923556e5e7aa60abfd81a5f9d65d4f483c19cb6637daa996eb1d25079fa13edf65a247e017d87bb1c63ff31f71c47f69d1
-
Filesize
12KB
MD529f4d502620669d407e900b85bf3a712
SHA1cb349cf1b89d46e7469ba6d382330495a568de14
SHA2564ff3b122b0ff6f104b788e9b3306cbb7b75bdfc2d6d02de913851d9baac37964
SHA512da68c95e14cbacde6cb9da13179d74213a609b8b007cfd73e31f70458d9b2f58ea751af6ad0e1ff477fe0ca62a358c28e0f1469e5136c2394c8412021bff6c36
-
Filesize
12KB
MD586333d64abc358a57f4f84e6c33987ad
SHA15c54cfbf251581a7b463bd376739706614252cf5
SHA256a63850416bd62726b5e6fb1b2d13d9a231a2d4249b2021644fb663b3082abd7b
SHA512707fc374ec1f1920ea0be4b1883b85c9a621985252d9040d6f6ed19fae9eca410ccc7de44dc098d53bfc2135d755d6d7ebb3270893496d50aa1e96a24a9f6065
-
Filesize
12KB
MD5b6a1ec0d626f652a291ec62b3ea3dc08
SHA1e896e7b7523c80d6fcd97274449fbf2b8ae23da2
SHA256ed225ad4a6fdb507a3463513741ca325088f89f3f8fdfa394fe1679cbaeb56f3
SHA512e2cbed9fb8b9598205e5b248c3721f548b22084f9a831553a089fd0a9257b65ee41dbc13e2605dbe2d48384402a7ebcdc1151f31f4900f62ec744c8c54105bd0
-
Filesize
12KB
MD599994b78ff6554cc641133ddc99ea3b7
SHA147ef8cdcf30438d0202f5b0d22fe6579e6c32ccb
SHA2567424305f5007f7d45da44079d39a654f180f566946b8786598caa631fb8f9deb
SHA512ea4f45c238931cce030858f9d72e053ee0eaf3549ea5e6b0dbff037bdaced3df79562913f098c32846303890784fee9925c30df3db7f1eaca53ff36114a56f28
-
Filesize
328KB
MD515bbbe562f9be3e5dcbb834e635cc231
SHA17c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a
SHA256ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde
SHA512769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287
-
Filesize
71KB
MD58ba2e41b330ae9356e62eb63514cf82e
SHA18dc266467a5a0d587ed0181d4344581ef4ff30b2
SHA256ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea
SHA5122fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d
-
Filesize
71KB
MD58ba2e41b330ae9356e62eb63514cf82e
SHA18dc266467a5a0d587ed0181d4344581ef4ff30b2
SHA256ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea
SHA5122fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d
-
Filesize
1KB
MD50df43097e0f0acd04d9e17fb43d618b9
SHA169b3ade12cb228393a93624e65f41604a17c83b6
SHA256c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873
SHA51201ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
693KB
MD57de6fdf3629c73bf0c29a96fa23ae055
SHA1dcb37f6d43977601c6460b17387a89b9e4c0609a
SHA256069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff
SHA512d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8
-
Filesize
1KB
MD57ea1fec84d76294d9256ae3dca7676b2
SHA11e335451d1cbb6951bc77bf75430f4d983491342
SHA2569a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940
SHA512ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317
-
Filesize
397.9MB
MD5de0b5ab575ece81f5783b326a5bd4d14
SHA16c76b4fab946d26ac0bdf4442015e2767a5cb7d6
SHA256bd0a33c8b5478b4c8b75738018f25d76cbe3e7e81747454c38d8681f47ba2ac5
SHA512147267776f00284d733fd03f6037459b7f9b955754681d2c0cdba3c4c4ec857fb11f024731c1a24961d4e487149c58b8292439aa3c78360d1907b0197d654e88
-
Filesize
123.1MB
MD552c44527220c480a60afa4868c7a1f3a
SHA1d7cf76fbcc72748ad1ecb7018859a1766b9e6853
SHA256a36bda0ca72032e6d105cea26cb877ef3a1deb3275d5cb86cad249e544508711
SHA51230c801f73e2deb4910911fcf2fb2d0fd6d6bc8b8504499bb4c61603c7974ae722782be53d5eb9e36adc86881b245d2e6e1a8c98176de8bceca13e29ebddf2751
-
Filesize
71.9MB
MD5ef4cebe5c1b9c6a442ce9eb8a4eec768
SHA1d68b82c4f397e0e9d4d6d1841b0eb1b7e121de04
SHA256cbba13cc9e5b83f005ac76bb1d323bf203ec0127ae9f3a4f9236731542a88f17
SHA51205779e0f129f7bf29f1bdedffdc90428091c2ae4d45202a3ea05c2b6506bf2d9ca7f728d68900e84385eeeb6548872078972ddac2cdaae6fe59a14165489b577
-
Filesize
33.7MB
MD5bdcba88782a4742768d5ab4d60547bab
SHA13f7c30a403c125e1273a2c6e192bedcb926f8381
SHA256a3ea0b8c4f098acdbd91f000c5cc14da7ef3ce1fbe309e67ff075b77717a721b
SHA512c88166f2fb11e6658518f523654f1064f506e7e527f1d4696dfb94a927b199f96e37ad684c353a746fe76416733d9837fb48e362ce62f1d899c30fa51e3d05e0
-
Filesize
35.1MB
MD5473cc1b1447348238ba0fd113985428b
SHA1d6ff35f73959812faa85ec413fee34ad784d6498
SHA25677447c86996900f6c62381e05c84f3c80152cbad9d83fc2c26e2b44d3035c98e
SHA512b25de688f3dc1a86b9a2b68a289369e6c5b008ce4efdb7fad43d0822ce9fb8412a33839260fef2c61dabcaaffbe2dbf1eb50f4b37c6f9f8f90f3c41079fdd43d
-
Filesize
328KB
MD515bbbe562f9be3e5dcbb834e635cc231
SHA17c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a
SHA256ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde
SHA512769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287