Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
98s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2023, 02:13
Static task
static1
Behavioral task
behavioral1
Sample
58baaa3e8b61a0f0407048fd017a5cbda73412f85d8bcfe1b75c7400bcbfb46c.exe
Resource
win10v2004-20230703-en
General
-
Target
58baaa3e8b61a0f0407048fd017a5cbda73412f85d8bcfe1b75c7400bcbfb46c.exe
-
Size
1.4MB
-
MD5
876d144c062032d2b74d9664c36dbf39
-
SHA1
6541f64de2ab7b19186baed855cfabcbd4d17a1f
-
SHA256
58baaa3e8b61a0f0407048fd017a5cbda73412f85d8bcfe1b75c7400bcbfb46c
-
SHA512
83ac36adf0541566733fb8fc7ea381e0241d396d545ebeef353f68145b2e45d13afacc9dd5e9222ae982efb5d1ab2f55b71938686a571012d7a67677bf800305
-
SSDEEP
24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 3100 netsh.exe 1740 netsh.exe -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0008000000023088-236.dat acprotect behavioral1/files/0x0008000000023088-235.dat acprotect -
Executes dropped EXE 3 IoCs
pid Process 1788 7z.exe 752 ratt.exe 3796 ratt.exe -
Loads dropped DLL 1 IoCs
pid Process 1788 7z.exe -
resource yara_rule behavioral1/files/0x00070000000230b2-232.dat upx behavioral1/memory/1788-233-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x00070000000230b2-234.dat upx behavioral1/files/0x0008000000023088-236.dat upx behavioral1/memory/1788-237-0x0000000010000000-0x00000000100E2000-memory.dmp upx behavioral1/files/0x0008000000023088-235.dat upx behavioral1/memory/1788-241-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ratt = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ratt.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 5 IoCs
pid Process 3380 PING.EXE 2200 PING.EXE 4764 PING.EXE 816 PING.EXE 636 PING.EXE -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 3712 powershell.exe 3712 powershell.exe 4376 powershell.exe 4376 powershell.exe 3356 powershell.exe 3356 powershell.exe 1800 powershell.exe 1800 powershell.exe 2880 powershell.exe 2880 powershell.exe 3108 powershell.exe 3108 powershell.exe 752 ratt.exe 752 ratt.exe 3796 ratt.exe 3796 ratt.exe 752 ratt.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5000 WMIC.exe Token: SeSecurityPrivilege 5000 WMIC.exe Token: SeTakeOwnershipPrivilege 5000 WMIC.exe Token: SeLoadDriverPrivilege 5000 WMIC.exe Token: SeSystemProfilePrivilege 5000 WMIC.exe Token: SeSystemtimePrivilege 5000 WMIC.exe Token: SeProfSingleProcessPrivilege 5000 WMIC.exe Token: SeIncBasePriorityPrivilege 5000 WMIC.exe Token: SeCreatePagefilePrivilege 5000 WMIC.exe Token: SeBackupPrivilege 5000 WMIC.exe Token: SeRestorePrivilege 5000 WMIC.exe Token: SeShutdownPrivilege 5000 WMIC.exe Token: SeDebugPrivilege 5000 WMIC.exe Token: SeSystemEnvironmentPrivilege 5000 WMIC.exe Token: SeRemoteShutdownPrivilege 5000 WMIC.exe Token: SeUndockPrivilege 5000 WMIC.exe Token: SeManageVolumePrivilege 5000 WMIC.exe Token: 33 5000 WMIC.exe Token: 34 5000 WMIC.exe Token: 35 5000 WMIC.exe Token: 36 5000 WMIC.exe Token: SeIncreaseQuotaPrivilege 5000 WMIC.exe Token: SeSecurityPrivilege 5000 WMIC.exe Token: SeTakeOwnershipPrivilege 5000 WMIC.exe Token: SeLoadDriverPrivilege 5000 WMIC.exe Token: SeSystemProfilePrivilege 5000 WMIC.exe Token: SeSystemtimePrivilege 5000 WMIC.exe Token: SeProfSingleProcessPrivilege 5000 WMIC.exe Token: SeIncBasePriorityPrivilege 5000 WMIC.exe Token: SeCreatePagefilePrivilege 5000 WMIC.exe Token: SeBackupPrivilege 5000 WMIC.exe Token: SeRestorePrivilege 5000 WMIC.exe Token: SeShutdownPrivilege 5000 WMIC.exe Token: SeDebugPrivilege 5000 WMIC.exe Token: SeSystemEnvironmentPrivilege 5000 WMIC.exe Token: SeRemoteShutdownPrivilege 5000 WMIC.exe Token: SeUndockPrivilege 5000 WMIC.exe Token: SeManageVolumePrivilege 5000 WMIC.exe Token: 33 5000 WMIC.exe Token: 34 5000 WMIC.exe Token: 35 5000 WMIC.exe Token: 36 5000 WMIC.exe Token: SeDebugPrivilege 3712 powershell.exe Token: SeDebugPrivilege 4376 powershell.exe Token: SeDebugPrivilege 3356 powershell.exe Token: SeDebugPrivilege 1800 powershell.exe Token: SeDebugPrivilege 2880 powershell.exe Token: SeDebugPrivilege 3108 powershell.exe Token: SeIncreaseQuotaPrivilege 1520 WMIC.exe Token: SeSecurityPrivilege 1520 WMIC.exe Token: SeTakeOwnershipPrivilege 1520 WMIC.exe Token: SeLoadDriverPrivilege 1520 WMIC.exe Token: SeSystemProfilePrivilege 1520 WMIC.exe Token: SeSystemtimePrivilege 1520 WMIC.exe Token: SeProfSingleProcessPrivilege 1520 WMIC.exe Token: SeIncBasePriorityPrivilege 1520 WMIC.exe Token: SeCreatePagefilePrivilege 1520 WMIC.exe Token: SeBackupPrivilege 1520 WMIC.exe Token: SeRestorePrivilege 1520 WMIC.exe Token: SeShutdownPrivilege 1520 WMIC.exe Token: SeDebugPrivilege 1520 WMIC.exe Token: SeSystemEnvironmentPrivilege 1520 WMIC.exe Token: SeRemoteShutdownPrivilege 1520 WMIC.exe Token: SeUndockPrivilege 1520 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4884 wrote to memory of 1632 4884 58baaa3e8b61a0f0407048fd017a5cbda73412f85d8bcfe1b75c7400bcbfb46c.exe 86 PID 4884 wrote to memory of 1632 4884 58baaa3e8b61a0f0407048fd017a5cbda73412f85d8bcfe1b75c7400bcbfb46c.exe 86 PID 4884 wrote to memory of 1632 4884 58baaa3e8b61a0f0407048fd017a5cbda73412f85d8bcfe1b75c7400bcbfb46c.exe 86 PID 1632 wrote to memory of 3276 1632 cmd.exe 89 PID 1632 wrote to memory of 3276 1632 cmd.exe 89 PID 1632 wrote to memory of 3276 1632 cmd.exe 89 PID 3276 wrote to memory of 3460 3276 cmd.exe 90 PID 3276 wrote to memory of 3460 3276 cmd.exe 90 PID 3276 wrote to memory of 3460 3276 cmd.exe 90 PID 1632 wrote to memory of 2376 1632 cmd.exe 91 PID 1632 wrote to memory of 2376 1632 cmd.exe 91 PID 1632 wrote to memory of 2376 1632 cmd.exe 91 PID 2376 wrote to memory of 5000 2376 cmd.exe 92 PID 2376 wrote to memory of 5000 2376 cmd.exe 92 PID 2376 wrote to memory of 5000 2376 cmd.exe 92 PID 1632 wrote to memory of 3712 1632 cmd.exe 94 PID 1632 wrote to memory of 3712 1632 cmd.exe 94 PID 1632 wrote to memory of 3712 1632 cmd.exe 94 PID 1632 wrote to memory of 4376 1632 cmd.exe 98 PID 1632 wrote to memory of 4376 1632 cmd.exe 98 PID 1632 wrote to memory of 4376 1632 cmd.exe 98 PID 1632 wrote to memory of 3356 1632 cmd.exe 100 PID 1632 wrote to memory of 3356 1632 cmd.exe 100 PID 1632 wrote to memory of 3356 1632 cmd.exe 100 PID 1632 wrote to memory of 1800 1632 cmd.exe 101 PID 1632 wrote to memory of 1800 1632 cmd.exe 101 PID 1632 wrote to memory of 1800 1632 cmd.exe 101 PID 1632 wrote to memory of 2880 1632 cmd.exe 104 PID 1632 wrote to memory of 2880 1632 cmd.exe 104 PID 1632 wrote to memory of 2880 1632 cmd.exe 104 PID 1632 wrote to memory of 1788 1632 cmd.exe 105 PID 1632 wrote to memory of 1788 1632 cmd.exe 105 PID 1632 wrote to memory of 1788 1632 cmd.exe 105 PID 1632 wrote to memory of 3108 1632 cmd.exe 107 PID 1632 wrote to memory of 3108 1632 cmd.exe 107 PID 1632 wrote to memory of 3108 1632 cmd.exe 107 PID 3108 wrote to memory of 3100 3108 powershell.exe 109 PID 3108 wrote to memory of 3100 3108 powershell.exe 109 PID 3108 wrote to memory of 3100 3108 powershell.exe 109 PID 3108 wrote to memory of 1740 3108 powershell.exe 110 PID 3108 wrote to memory of 1740 3108 powershell.exe 110 PID 3108 wrote to memory of 1740 3108 powershell.exe 110 PID 3108 wrote to memory of 3712 3108 powershell.exe 111 PID 3108 wrote to memory of 3712 3108 powershell.exe 111 PID 3108 wrote to memory of 3712 3108 powershell.exe 111 PID 3712 wrote to memory of 1520 3712 cmd.exe 112 PID 3712 wrote to memory of 1520 3712 cmd.exe 112 PID 3712 wrote to memory of 1520 3712 cmd.exe 112 PID 3108 wrote to memory of 60 3108 powershell.exe 113 PID 3108 wrote to memory of 60 3108 powershell.exe 113 PID 3108 wrote to memory of 60 3108 powershell.exe 113 PID 60 wrote to memory of 1292 60 cmd.exe 114 PID 60 wrote to memory of 1292 60 cmd.exe 114 PID 60 wrote to memory of 1292 60 cmd.exe 114 PID 3108 wrote to memory of 752 3108 powershell.exe 115 PID 3108 wrote to memory of 752 3108 powershell.exe 115 PID 3108 wrote to memory of 752 3108 powershell.exe 115 PID 3108 wrote to memory of 2848 3108 powershell.exe 118 PID 3108 wrote to memory of 2848 3108 powershell.exe 118 PID 3108 wrote to memory of 2848 3108 powershell.exe 118 PID 1632 wrote to memory of 1716 1632 cmd.exe 119 PID 1632 wrote to memory of 1716 1632 cmd.exe 119 PID 1632 wrote to memory of 1716 1632 cmd.exe 119 PID 1632 wrote to memory of 3796 1632 cmd.exe 120 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2848 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58baaa3e8b61a0f0407048fd017a5cbda73412f85d8bcfe1b75c7400bcbfb46c.exe"C:\Users\Admin\AppData\Local\Temp\58baaa3e8b61a0f0407048fd017a5cbda73412f85d8bcfe1b75c7400bcbfb46c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com3⤵
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\nslookup.exenslookup myip.opendns.com. resolver1.opendns.com4⤵PID:3460
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain3⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic ComputerSystem get Domain4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5000
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3712
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3356
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Users\Admin\AppData\Local\Temp\7z.exe7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:3100
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:1740
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic computersystem where name="LMMMEQUO" set AutomaticManagedPagefile=False5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=200005⤵PID:1292
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:752 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"5⤵PID:1440
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 106⤵
- Runs ping.exe
PID:4764
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"6⤵PID:2552
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 17 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 17 > nul && "C:\Users\Admin\Music\rot.exe"5⤵PID:536
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 176⤵
- Runs ping.exe
PID:816
-
-
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"4⤵
- Views/modifies file attributes
PID:2848
-
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F3⤵
- Adds Run key to start application
PID:1716
-
-
C:\Users\Admin\AppData\Local\Temp\ratt.exe"ratt.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3796 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"4⤵PID:4564
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 85⤵
- Runs ping.exe
PID:636
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"5⤵PID:3136
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 8 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 8 > nul && "C:\Users\Admin\Music\rot.exe"4⤵PID:4804
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 85⤵
- Runs ping.exe
PID:3380
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 85⤵
- Runs ping.exe
PID:2200
-
-
C:\Users\Admin\Music\rot.exe"C:\Users\Admin\Music\rot.exe"5⤵PID:4928
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256.6MB
MD5e55519ab42372c0b2a1e8f272cf66791
SHA1c4da82f84756a962cfe226e03537ce279f477928
SHA256fa33a061bb76e114643e5ebcfffe545c209cb9d62f57490b10da33c41cfa3ace
SHA51278e9365a4fb687b4211e8b893877c45cdc2d7387a759394813cd36f753a8c2a5f95427a335019a50a0b7e945aa1f6dae456491a172f5981d0ac5397a164630d8
-
Filesize
154.7MB
MD5a5c3bdc909bc91f26477ca90893898be
SHA1696727750223aaf8a69d6a89d945bf733c97aaf6
SHA256c0b4bbfbd31273ff17a893f06920a7bb7b43e7e0c04c4e6f5963ba6f272bbc47
SHA512b47aade0001f02d91fb29c4db0e115f264f58a2f72926c64f47f6ba8d2d9b46b55f8d9824dd6327e0c057e7b1af8b2218697f96ba5a19f9bb2895eded7b62ef8
-
Filesize
1KB
MD533b19d75aa77114216dbc23f43b195e3
SHA136a6c3975e619e0c5232aa4f5b7dc1fec9525535
SHA256b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2
SHA512676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821
-
Filesize
1KB
MD59a2d0ce437d2445330f2646472703087
SHA133c83e484a15f35c2caa3af62d5da6b7713a20ae
SHA25630ea2f716e85f8d14a201e3fb0897d745a01b113342dfb7a9b7ac133c4ef150c
SHA512a61d18d90bfad9ea8afdfa37537cfea3d5a3d0c161e323fa65840c283bdc87c3de85daaff5519beea2f2719eec1c68398eea8679b55ff733a61052f073162d5d
-
Filesize
11KB
MD5b0c1ab28c793eb8bfdcfcbc740d341ed
SHA1c18609e73df7c67e8eabb572c8b5d80b071a937a
SHA256faf16a6d4d622c0e4c9428f0ddd50957e3d9b5e0dd2630057d898340eba51250
SHA5123a8d75e184dabb3c2b3754c3da65955b58c5c11917a56afbe92daf98e0581fc3a4e3c98f1767de6f1938f3f068e80e9c2a2a9290f1ca6609c010f5af8ea7c392
-
Filesize
11KB
MD51c36644d4a8a93a7aec2404f8e6e8d57
SHA1dd75113875d6b61b88db092402ceddb4f36af3ec
SHA256cf27d5a28eaaf8642e9e2825e20c9b415308eaaa6b1be84daacb2b4d339c9c47
SHA512ae42b138128c97bfa2350dda4ba907448a467630d792cd92261ad1bf7ff8200f8170d3281f4149d7ebc5f516462029cac53f3ec50494712be4b08e4758e93bca
-
Filesize
11KB
MD50668c13e84033bfc89636eae9d4dd82e
SHA1dcd3b0094815ca8fd61f93fa64e2b0a152926199
SHA256e9d79eb8f692293ae4fdd730dc5357edf7956e2eeff56b5368c1219854409753
SHA512ae3fbed5b96c510f3ae2236f545456ca44f074365c8fe842238d8fe0a2d6ceaef8115b8495646b166e6bca30ebc2bd3993b0228502c86b5037043436a972af62
-
Filesize
11KB
MD53f8c878032298b359f6229385f2e45cf
SHA1d4f701217e19d90d7012762bb349ab4a2a8c83d2
SHA256da38d097ec9d0648adc2afeb4d33368a34d463dd49e09212bfa449c1cf69f731
SHA5124f19a5497b26ee238e3e7e9c21dd973676721f00c0267c3104f2c25d3cc75acb3ebe85d8874e299e114a57e986a003f105fedd97eea73a33dc41861148a966d5
-
Filesize
11KB
MD550b73daa56aa3db1322939a33e19678f
SHA1ecf6d8dc10ff05d83f4ea0585671bdfcff9523ec
SHA256de2a7bd140d8ac193437f364dd4ffa176ad0f5fa44b0a399d9e0d77f3d846512
SHA5128e754eac599023912c826b6ad447d4f91e38c8c665d816a3172807cef565694bcb187f8004f5b2f9854d3ba512d147381c81501020ca302c27c4c99ecae54b9b
-
Filesize
328KB
MD515bbbe562f9be3e5dcbb834e635cc231
SHA17c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a
SHA256ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde
SHA512769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287
-
Filesize
328KB
MD515bbbe562f9be3e5dcbb834e635cc231
SHA17c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a
SHA256ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde
SHA512769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287
-
Filesize
71KB
MD58ba2e41b330ae9356e62eb63514cf82e
SHA18dc266467a5a0d587ed0181d4344581ef4ff30b2
SHA256ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea
SHA5122fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d
-
Filesize
71KB
MD58ba2e41b330ae9356e62eb63514cf82e
SHA18dc266467a5a0d587ed0181d4344581ef4ff30b2
SHA256ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea
SHA5122fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d
-
Filesize
1KB
MD50df43097e0f0acd04d9e17fb43d618b9
SHA169b3ade12cb228393a93624e65f41604a17c83b6
SHA256c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873
SHA51201ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
693KB
MD57de6fdf3629c73bf0c29a96fa23ae055
SHA1dcb37f6d43977601c6460b17387a89b9e4c0609a
SHA256069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff
SHA512d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8
-
Filesize
1KB
MD57ea1fec84d76294d9256ae3dca7676b2
SHA11e335451d1cbb6951bc77bf75430f4d983491342
SHA2569a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940
SHA512ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317
-
Filesize
687.8MB
MD5dc9f88c84618f663260a4ae5f83359a6
SHA18252ab0864629be691093b0a5b739ccd7db360c7
SHA256d675dbc020ff2210c53822c1db6128b7b02fe9c3faed9abd93f84b1aae79b651
SHA51241120f3692448c0bccd32ee6038c3446fe37891c251db497f293c425fd4ee71cf13d9834f5c80c2bacfa1f59c0dbb8d8882dccf97a243e3e6e5a6155e6d5f664
-
Filesize
126.5MB
MD560bf086017f10a34b71980f945dbcd6a
SHA1943116cea604f604bfb8f67c84e2dc1562111940
SHA2560c1daaab6a971c6f67acffe98ccea229b676b43a66235a4158ee8711feed73df
SHA51289d8baecaea90091e3a0c34d84e93c67904679a71a04152e1f266f991819bbe499cadc67bfad780e9d7b7a7517b36c7950a4c97a7e22c87c306f2011b54c0636
-
Filesize
69.7MB
MD5ede51a6aa0a9328444f5a6353b5a4b79
SHA112f4a0edf54eb240ca1d35debe2946044cb7ba4a
SHA25617c76ae5824c3fe64953c176af7fc9d7df2d9178fb0695502350da8712957e8f
SHA5123621a11ffddd3d1506127d4870a1ff6ebefaeae987cc97679bbf0ac438af3e35a249b0e6b1204531a914851ac5eafee381681de1907c917d6eee4f55e52672fa
-
Filesize
22.5MB
MD5f5bc2aa00cc6e38a54d38ea18f54bd7c
SHA17944ce33d3c41d49ab8978525adddf68c75d7f02
SHA256bf94542841750edc6762ff50a78964474cec1ec8b0e00673a13f25f8712b93e9
SHA5121cfd3a01a891cd65b65ae1a2e380e95ebf3ef1c4e23814a9b272dbbe70942107b42442f87e8482453731781cf6819ab9a5d443530eeed05f22024f70c88e28a1
-
Filesize
21.7MB
MD5d2408c5a4fedfde4a21b6cc6ec67ba09
SHA1428ad0cc83c443f6335096301b8a70e215a32573
SHA2560f8786916858d2a43008eca624dcf0f49265baded8f73185a878d0a7eafd20c0
SHA512b65c69e9119941b78dc6a59ee7197a90de6a8b0cb0434af8bfbaa9a9e1845f92bd8bde6046a61a9cb5d03a64e90cfe08a1d80c0e156593c6d8a878adc728ee29