Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
134s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
02/08/2023, 03:31
Static task
static1
Behavioral task
behavioral1
Sample
19dc9be08a7b629452aa21d2b67abbdf200a94d663c06132c61ca8c0e4344306.exe
Resource
win10-20230703-en
General
-
Target
19dc9be08a7b629452aa21d2b67abbdf200a94d663c06132c61ca8c0e4344306.exe
-
Size
1.4MB
-
MD5
93d6a059dcff7fe3eadc86dec89cb631
-
SHA1
a669095d0d0849d2458240ca299724ceab77aee6
-
SHA256
19dc9be08a7b629452aa21d2b67abbdf200a94d663c06132c61ca8c0e4344306
-
SHA512
ad216de17cf54b60095cdd899c457c6bce2705f3e9bad6566ab12b1f9d7c639b2702757d93679d8b2fcecb4822163317f2e03ec37fcbbd886886b144aead464b
-
SSDEEP
24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 3328 netsh.exe 2164 netsh.exe -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000800000001af9b-256.dat acprotect behavioral1/files/0x000800000001af9b-257.dat acprotect -
Executes dropped EXE 2 IoCs
pid Process 3312 7z.exe 456 ratt.exe -
Loads dropped DLL 1 IoCs
pid Process 3312 7z.exe -
resource yara_rule behavioral1/files/0x000700000001afcc-252.dat upx behavioral1/memory/3312-254-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x000700000001afcc-255.dat upx behavioral1/files/0x000800000001af9b-256.dat upx behavioral1/files/0x000800000001af9b-257.dat upx behavioral1/memory/3312-258-0x0000000010000000-0x00000000100E2000-memory.dmp upx behavioral1/memory/3312-263-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ratt = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ratt.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 3 IoCs
pid Process 2772 PING.EXE 1848 PING.EXE 4464 PING.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4496 powershell.exe 4496 powershell.exe 4496 powershell.exe 4364 powershell.exe 4364 powershell.exe 4364 powershell.exe 4600 powershell.exe 4600 powershell.exe 4600 powershell.exe 2308 powershell.exe 2308 powershell.exe 2308 powershell.exe 4668 powershell.exe 4668 powershell.exe 4668 powershell.exe 4952 powershell.exe 4952 powershell.exe 4952 powershell.exe 456 ratt.exe 456 ratt.exe 456 ratt.exe 456 ratt.exe 456 ratt.exe 456 ratt.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 168 WMIC.exe Token: SeSecurityPrivilege 168 WMIC.exe Token: SeTakeOwnershipPrivilege 168 WMIC.exe Token: SeLoadDriverPrivilege 168 WMIC.exe Token: SeSystemProfilePrivilege 168 WMIC.exe Token: SeSystemtimePrivilege 168 WMIC.exe Token: SeProfSingleProcessPrivilege 168 WMIC.exe Token: SeIncBasePriorityPrivilege 168 WMIC.exe Token: SeCreatePagefilePrivilege 168 WMIC.exe Token: SeBackupPrivilege 168 WMIC.exe Token: SeRestorePrivilege 168 WMIC.exe Token: SeShutdownPrivilege 168 WMIC.exe Token: SeDebugPrivilege 168 WMIC.exe Token: SeSystemEnvironmentPrivilege 168 WMIC.exe Token: SeRemoteShutdownPrivilege 168 WMIC.exe Token: SeUndockPrivilege 168 WMIC.exe Token: SeManageVolumePrivilege 168 WMIC.exe Token: 33 168 WMIC.exe Token: 34 168 WMIC.exe Token: 35 168 WMIC.exe Token: 36 168 WMIC.exe Token: SeIncreaseQuotaPrivilege 168 WMIC.exe Token: SeSecurityPrivilege 168 WMIC.exe Token: SeTakeOwnershipPrivilege 168 WMIC.exe Token: SeLoadDriverPrivilege 168 WMIC.exe Token: SeSystemProfilePrivilege 168 WMIC.exe Token: SeSystemtimePrivilege 168 WMIC.exe Token: SeProfSingleProcessPrivilege 168 WMIC.exe Token: SeIncBasePriorityPrivilege 168 WMIC.exe Token: SeCreatePagefilePrivilege 168 WMIC.exe Token: SeBackupPrivilege 168 WMIC.exe Token: SeRestorePrivilege 168 WMIC.exe Token: SeShutdownPrivilege 168 WMIC.exe Token: SeDebugPrivilege 168 WMIC.exe Token: SeSystemEnvironmentPrivilege 168 WMIC.exe Token: SeRemoteShutdownPrivilege 168 WMIC.exe Token: SeUndockPrivilege 168 WMIC.exe Token: SeManageVolumePrivilege 168 WMIC.exe Token: 33 168 WMIC.exe Token: 34 168 WMIC.exe Token: 35 168 WMIC.exe Token: 36 168 WMIC.exe Token: SeDebugPrivilege 4496 powershell.exe Token: SeDebugPrivilege 4364 powershell.exe Token: SeDebugPrivilege 4600 powershell.exe Token: SeDebugPrivilege 2308 powershell.exe Token: SeDebugPrivilege 4668 powershell.exe Token: SeDebugPrivilege 4952 powershell.exe Token: SeIncreaseQuotaPrivilege 2180 WMIC.exe Token: SeSecurityPrivilege 2180 WMIC.exe Token: SeTakeOwnershipPrivilege 2180 WMIC.exe Token: SeLoadDriverPrivilege 2180 WMIC.exe Token: SeSystemProfilePrivilege 2180 WMIC.exe Token: SeSystemtimePrivilege 2180 WMIC.exe Token: SeProfSingleProcessPrivilege 2180 WMIC.exe Token: SeIncBasePriorityPrivilege 2180 WMIC.exe Token: SeCreatePagefilePrivilege 2180 WMIC.exe Token: SeBackupPrivilege 2180 WMIC.exe Token: SeRestorePrivilege 2180 WMIC.exe Token: SeShutdownPrivilege 2180 WMIC.exe Token: SeDebugPrivilege 2180 WMIC.exe Token: SeSystemEnvironmentPrivilege 2180 WMIC.exe Token: SeRemoteShutdownPrivilege 2180 WMIC.exe Token: SeUndockPrivilege 2180 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4472 wrote to memory of 512 4472 19dc9be08a7b629452aa21d2b67abbdf200a94d663c06132c61ca8c0e4344306.exe 70 PID 4472 wrote to memory of 512 4472 19dc9be08a7b629452aa21d2b67abbdf200a94d663c06132c61ca8c0e4344306.exe 70 PID 4472 wrote to memory of 512 4472 19dc9be08a7b629452aa21d2b67abbdf200a94d663c06132c61ca8c0e4344306.exe 70 PID 512 wrote to memory of 4460 512 cmd.exe 73 PID 512 wrote to memory of 4460 512 cmd.exe 73 PID 512 wrote to memory of 4460 512 cmd.exe 73 PID 4460 wrote to memory of 3596 4460 cmd.exe 74 PID 4460 wrote to memory of 3596 4460 cmd.exe 74 PID 4460 wrote to memory of 3596 4460 cmd.exe 74 PID 512 wrote to memory of 4080 512 cmd.exe 75 PID 512 wrote to memory of 4080 512 cmd.exe 75 PID 512 wrote to memory of 4080 512 cmd.exe 75 PID 4080 wrote to memory of 168 4080 cmd.exe 76 PID 4080 wrote to memory of 168 4080 cmd.exe 76 PID 4080 wrote to memory of 168 4080 cmd.exe 76 PID 512 wrote to memory of 4496 512 cmd.exe 78 PID 512 wrote to memory of 4496 512 cmd.exe 78 PID 512 wrote to memory of 4496 512 cmd.exe 78 PID 512 wrote to memory of 4364 512 cmd.exe 79 PID 512 wrote to memory of 4364 512 cmd.exe 79 PID 512 wrote to memory of 4364 512 cmd.exe 79 PID 512 wrote to memory of 4600 512 cmd.exe 80 PID 512 wrote to memory of 4600 512 cmd.exe 80 PID 512 wrote to memory of 4600 512 cmd.exe 80 PID 512 wrote to memory of 2308 512 cmd.exe 81 PID 512 wrote to memory of 2308 512 cmd.exe 81 PID 512 wrote to memory of 2308 512 cmd.exe 81 PID 512 wrote to memory of 4668 512 cmd.exe 82 PID 512 wrote to memory of 4668 512 cmd.exe 82 PID 512 wrote to memory of 4668 512 cmd.exe 82 PID 512 wrote to memory of 3312 512 cmd.exe 83 PID 512 wrote to memory of 3312 512 cmd.exe 83 PID 512 wrote to memory of 3312 512 cmd.exe 83 PID 512 wrote to memory of 4952 512 cmd.exe 84 PID 512 wrote to memory of 4952 512 cmd.exe 84 PID 512 wrote to memory of 4952 512 cmd.exe 84 PID 4952 wrote to memory of 3328 4952 powershell.exe 85 PID 4952 wrote to memory of 3328 4952 powershell.exe 85 PID 4952 wrote to memory of 3328 4952 powershell.exe 85 PID 4952 wrote to memory of 2164 4952 powershell.exe 86 PID 4952 wrote to memory of 2164 4952 powershell.exe 86 PID 4952 wrote to memory of 2164 4952 powershell.exe 86 PID 4952 wrote to memory of 4228 4952 powershell.exe 87 PID 4952 wrote to memory of 4228 4952 powershell.exe 87 PID 4952 wrote to memory of 4228 4952 powershell.exe 87 PID 4228 wrote to memory of 2180 4228 cmd.exe 88 PID 4228 wrote to memory of 2180 4228 cmd.exe 88 PID 4228 wrote to memory of 2180 4228 cmd.exe 88 PID 4952 wrote to memory of 780 4952 powershell.exe 90 PID 4952 wrote to memory of 780 4952 powershell.exe 90 PID 4952 wrote to memory of 780 4952 powershell.exe 90 PID 780 wrote to memory of 4972 780 cmd.exe 91 PID 780 wrote to memory of 4972 780 cmd.exe 91 PID 780 wrote to memory of 4972 780 cmd.exe 91 PID 4952 wrote to memory of 456 4952 powershell.exe 92 PID 4952 wrote to memory of 456 4952 powershell.exe 92 PID 4952 wrote to memory of 456 4952 powershell.exe 92 PID 4952 wrote to memory of 1844 4952 powershell.exe 93 PID 4952 wrote to memory of 1844 4952 powershell.exe 93 PID 4952 wrote to memory of 1844 4952 powershell.exe 93 PID 512 wrote to memory of 996 512 cmd.exe 94 PID 512 wrote to memory of 996 512 cmd.exe 94 PID 512 wrote to memory of 996 512 cmd.exe 94 PID 456 wrote to memory of 4536 456 ratt.exe 96 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1844 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19dc9be08a7b629452aa21d2b67abbdf200a94d663c06132c61ca8c0e4344306.exe"C:\Users\Admin\AppData\Local\Temp\19dc9be08a7b629452aa21d2b67abbdf200a94d663c06132c61ca8c0e4344306.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com3⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\nslookup.exenslookup myip.opendns.com. resolver1.opendns.com4⤵PID:3596
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain3⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic ComputerSystem get Domain4⤵
- Suspicious use of AdjustPrivilegeToken
PID:168
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4668
-
-
C:\Users\Admin\AppData\Local\Temp\7z.exe7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3312
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:3328
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:2164
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic computersystem where name="GJHWXLHY" set AutomaticManagedPagefile=False5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=200005⤵PID:4972
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"5⤵PID:4536
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 86⤵
- Runs ping.exe
PID:2772
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"6⤵PID:2332
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 13 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 13 > nul && "C:\Users\Admin\Music\rot.exe"5⤵PID:2908
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 136⤵
- Runs ping.exe
PID:1848
-
-
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"4⤵
- Views/modifies file attributes
PID:1844
-
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F3⤵
- Adds Run key to start application
PID:996
-
-
C:\Users\Admin\AppData\Local\Temp\ratt.exe"ratt.exe"3⤵PID:4592
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 17 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 17 > nul && "C:\Users\Admin\Music\rot.exe"4⤵PID:2900
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 175⤵
- Runs ping.exe
PID:4464
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
485.6MB
MD58398ddd9216ecc70d29507720e6a802b
SHA111cbe8cd89e2f4abede8aa3fa6a63356d396eb6c
SHA2566fcbac77565f765a7d85ae301c4b1012d93a9f04962643767850da90ca4d3e4d
SHA5123ad2f81a43d2fe687de9cbd2167f3f9c65456bf129a3fc013ccf0b32bae35ea89d1cba0e56a5a3d226bf66740b6b3580b98516fa5222c6601a25281d789f645f
-
Filesize
379.8MB
MD51f9abdb236d6337b9a0339cb5b5eedd8
SHA17ec0fb0e38b787aafc36c221c3055abf37f99e9a
SHA25690fbea59a8d898b89031f82365278a0a5bd3c4858a906bf97003dce002cb9153
SHA512b7a187ff69b15388de11f8df4dd72a7cc456d006d35bbd44becb5c50996a6adebe69f85316983eb041838b72e853cbc2b437dc76fd39553a5b926c3e67113412
-
Filesize
1KB
MD50f5cbdca905beb13bebdcf43fb0716bd
SHA19e136131389fde83297267faf6c651d420671b3f
SHA256a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060
SHA512a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0
-
Filesize
1KB
MD59e104e9aa0cfdec0753de24cbe3f587b
SHA1f63b8d0b29c65e518be6a9412e7499c9de11be78
SHA25659a9f13de0e003ea4adcd0193477f147b0c91ae847eebc744e91a4efe167223f
SHA5128253854159ceac2d84eb371c9672730831505dea52ac3bc2cca45ee5308717ca3f11734602d0a409974b137084a8c20e6b7653640991e45708f692c65ac4933b
-
Filesize
12KB
MD54bcad39ddf96d06a0793b3a9af0e5fe2
SHA1b4f83f2a7921757c0f3f8437f2a3f58e12bd33b1
SHA2562abd6645a48e121cf799e8bf4612e0baf309ea6dcea35cfb69a017d839687886
SHA5122b4bed75ec1a98eaf34cdb73c88e229e80be2a3c42648c14119bf0db931f6c0c0faada91d84ff1bede30984b91d7d09d36b6c41f829c8a83a0ef91e16ea77234
-
Filesize
12KB
MD58a5e61214d7359d0b0e9113f6df018e4
SHA1097f464902beeb7d2496668dfbc765fd1872fdda
SHA2563b51bfa59b86fd177ab9acf38f99381723e64a798156558fddce2b51cfb455e7
SHA512c7672164e4e72bcb88b6d1dba4bd7abfa4057b74734b3590281389e52421f4c53f91f9a562dbae690b4de386251cc19095791cdfba468d86e325f9c09193342e
-
Filesize
12KB
MD503033e3789dc4a3c0b8b7b880435bc90
SHA1b5fd97692f75d137847315caf30044d2cedf4976
SHA2561916f12c8276629fe52e63d1f5a51aaca8c8313daa007ff58ddbef5c77459422
SHA512818363eac51a057140d60129b6213a3b540ce42d0ee4486e30fec665c42480d5f23e4abae9166e8a7ffb1a516fafb3f050d68a684b28e21e312781eef781934d
-
Filesize
12KB
MD5aa889ae68abb34b34a1c730bbc34a988
SHA1c506636147638b22c9c15f19460da8b80ba19281
SHA256d274a5870287701bd5c2588e2f053bfe8f1c03bfec361e557ff5821bad38e35c
SHA512414ab63fd4330a31f35854e4710dc4ffb19466f171b50dad84c931fb37ca49320456c35170df21eb9b77850a28b3ddc4a3185835559c9b57ddb618daef093ab6
-
Filesize
12KB
MD539fb2cfb744469f05107ce4531cb182a
SHA1f86304678a4fe88cda84d4098436220bdcbcb243
SHA256d8d7d5fdd01a2608c5abf673e7fd26a4e92a5b2e6284149de24ff1586d1cdaac
SHA512ad94e8b07d8bebbd6cd7eb5cec513f010855aa4a2b63139564569d9f5a61b25a0707ca0504da7700f9e4c3c5af952176119b0249e724a8bf2eb99d8b60d546ac
-
Filesize
328KB
MD515bbbe562f9be3e5dcbb834e635cc231
SHA17c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a
SHA256ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde
SHA512769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287
-
Filesize
71KB
MD58ba2e41b330ae9356e62eb63514cf82e
SHA18dc266467a5a0d587ed0181d4344581ef4ff30b2
SHA256ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea
SHA5122fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d
-
Filesize
71KB
MD58ba2e41b330ae9356e62eb63514cf82e
SHA18dc266467a5a0d587ed0181d4344581ef4ff30b2
SHA256ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea
SHA5122fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d
-
Filesize
1KB
MD50df43097e0f0acd04d9e17fb43d618b9
SHA169b3ade12cb228393a93624e65f41604a17c83b6
SHA256c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873
SHA51201ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
693KB
MD57de6fdf3629c73bf0c29a96fa23ae055
SHA1dcb37f6d43977601c6460b17387a89b9e4c0609a
SHA256069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff
SHA512d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8
-
Filesize
1KB
MD57ea1fec84d76294d9256ae3dca7676b2
SHA11e335451d1cbb6951bc77bf75430f4d983491342
SHA2569a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940
SHA512ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317
-
Filesize
745.1MB
MD5be788bb3680cf3809d9678ee6f7ba321
SHA1499f01d5f654f83e172004dcc03f99abdd251734
SHA25603a17a2b669f72df082569ea477977d824796da3b6b7a8d0e6f91f2629ef406b
SHA51283c0b885740a57b84b2c909d0d6bb25baaa49d62499773030b59058325f37a5fcf39a1cd59ef9c229ca7289af7250034f6652e449625b67c2d260b285ddb9a8e
-
Filesize
255.1MB
MD5438585dab353c1c9a58b84f2ebb6edda
SHA1dcb63ac357ba8be41f24b86a9563d845127d0a58
SHA256ce8977c04c7636b542ca119c06ac20385626ba64b7a5e189cc5d77a0d475781e
SHA512a631898be34bbac31d0c86086c4a45e53b18b12d1a465a1b1db3907e0c971e455366af7380b1c60e2d2047a12a415437f3aad42ea234466fb4abe1e245ef4651
-
Filesize
328KB
MD515bbbe562f9be3e5dcbb834e635cc231
SHA17c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a
SHA256ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde
SHA512769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287