Analysis
-
max time kernel
30s -
max time network
153s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
14/08/2023, 10:30
Static task
static1
General
-
Target
1888f5b6eb5f31603cb449f53f83218bf4a1f17137dade7468f3ab33715a8a3d.exe
-
Size
1.4MB
-
MD5
b3fae1d1c0926327b60ce555aa6c76d8
-
SHA1
f10cabb2b6a89febd26df9a808cdec92d77f304e
-
SHA256
1888f5b6eb5f31603cb449f53f83218bf4a1f17137dade7468f3ab33715a8a3d
-
SHA512
7bb66f68a29e5b240a100724ee1b0bd1edd43e78196ebc53948cca0edf5da8ad49dd589c0a1999cc6ea121e484d15ffb658d51c9bb7a26123b2f37115e74283a
-
SSDEEP
24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk
Malware Config
Extracted
quasar
1.3.0.0
-
94.131.105.161:12344
QSR_MUTEX_UEgITWnMKnRP3EZFzK
-
encryption_key
5Q0JQBQQfAUHRJTcAIOF
-
install_name
lient.exe
-
log_directory
Lugs
-
reconnect_delay
3000
-
startup_key
itartup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
resource yara_rule behavioral1/memory/4976-618-0x0000000000400000-0x000000000045E000-memory.dmp family_quasar -
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 3516 netsh.exe 2784 netsh.exe -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000700000001b00c-256.dat acprotect behavioral1/files/0x000700000001b00c-255.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 3660 7z.exe -
Loads dropped DLL 1 IoCs
pid Process 3660 7z.exe -
resource yara_rule behavioral1/files/0x000700000001b010-252.dat upx behavioral1/memory/3660-253-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral1/files/0x000700000001b010-254.dat upx behavioral1/files/0x000700000001b00c-256.dat upx behavioral1/memory/3660-257-0x0000000010000000-0x00000000100E2000-memory.dmp upx behavioral1/files/0x000700000001b00c-255.dat upx behavioral1/memory/3660-261-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 4 IoCs
pid Process 1340 PING.EXE 4440 PING.EXE 4460 PING.EXE 4816 PING.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 892 powershell.exe 892 powershell.exe 892 powershell.exe 1344 powershell.exe 1344 powershell.exe 1344 powershell.exe 2180 powershell.exe 2180 powershell.exe 2180 powershell.exe 2176 powershell.exe 2176 powershell.exe 2176 powershell.exe 328 powershell.exe 328 powershell.exe 328 powershell.exe 380 powershell.exe 380 powershell.exe 380 powershell.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 720 WMIC.exe Token: SeSecurityPrivilege 720 WMIC.exe Token: SeTakeOwnershipPrivilege 720 WMIC.exe Token: SeLoadDriverPrivilege 720 WMIC.exe Token: SeSystemProfilePrivilege 720 WMIC.exe Token: SeSystemtimePrivilege 720 WMIC.exe Token: SeProfSingleProcessPrivilege 720 WMIC.exe Token: SeIncBasePriorityPrivilege 720 WMIC.exe Token: SeCreatePagefilePrivilege 720 WMIC.exe Token: SeBackupPrivilege 720 WMIC.exe Token: SeRestorePrivilege 720 WMIC.exe Token: SeShutdownPrivilege 720 WMIC.exe Token: SeDebugPrivilege 720 WMIC.exe Token: SeSystemEnvironmentPrivilege 720 WMIC.exe Token: SeRemoteShutdownPrivilege 720 WMIC.exe Token: SeUndockPrivilege 720 WMIC.exe Token: SeManageVolumePrivilege 720 WMIC.exe Token: 33 720 WMIC.exe Token: 34 720 WMIC.exe Token: 35 720 WMIC.exe Token: 36 720 WMIC.exe Token: SeIncreaseQuotaPrivilege 720 WMIC.exe Token: SeSecurityPrivilege 720 WMIC.exe Token: SeTakeOwnershipPrivilege 720 WMIC.exe Token: SeLoadDriverPrivilege 720 WMIC.exe Token: SeSystemProfilePrivilege 720 WMIC.exe Token: SeSystemtimePrivilege 720 WMIC.exe Token: SeProfSingleProcessPrivilege 720 WMIC.exe Token: SeIncBasePriorityPrivilege 720 WMIC.exe Token: SeCreatePagefilePrivilege 720 WMIC.exe Token: SeBackupPrivilege 720 WMIC.exe Token: SeRestorePrivilege 720 WMIC.exe Token: SeShutdownPrivilege 720 WMIC.exe Token: SeDebugPrivilege 720 WMIC.exe Token: SeSystemEnvironmentPrivilege 720 WMIC.exe Token: SeRemoteShutdownPrivilege 720 WMIC.exe Token: SeUndockPrivilege 720 WMIC.exe Token: SeManageVolumePrivilege 720 WMIC.exe Token: 33 720 WMIC.exe Token: 34 720 WMIC.exe Token: 35 720 WMIC.exe Token: 36 720 WMIC.exe Token: SeDebugPrivilege 892 powershell.exe Token: SeDebugPrivilege 1344 powershell.exe Token: SeDebugPrivilege 2180 powershell.exe Token: SeDebugPrivilege 2176 powershell.exe Token: SeDebugPrivilege 328 powershell.exe Token: SeDebugPrivilege 380 powershell.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4816 wrote to memory of 4404 4816 1888f5b6eb5f31603cb449f53f83218bf4a1f17137dade7468f3ab33715a8a3d.exe 70 PID 4816 wrote to memory of 4404 4816 1888f5b6eb5f31603cb449f53f83218bf4a1f17137dade7468f3ab33715a8a3d.exe 70 PID 4816 wrote to memory of 4404 4816 1888f5b6eb5f31603cb449f53f83218bf4a1f17137dade7468f3ab33715a8a3d.exe 70 PID 4404 wrote to memory of 1840 4404 cmd.exe 73 PID 4404 wrote to memory of 1840 4404 cmd.exe 73 PID 4404 wrote to memory of 1840 4404 cmd.exe 73 PID 1840 wrote to memory of 4268 1840 cmd.exe 74 PID 1840 wrote to memory of 4268 1840 cmd.exe 74 PID 1840 wrote to memory of 4268 1840 cmd.exe 74 PID 4404 wrote to memory of 348 4404 cmd.exe 75 PID 4404 wrote to memory of 348 4404 cmd.exe 75 PID 4404 wrote to memory of 348 4404 cmd.exe 75 PID 348 wrote to memory of 720 348 cmd.exe 76 PID 348 wrote to memory of 720 348 cmd.exe 76 PID 348 wrote to memory of 720 348 cmd.exe 76 PID 4404 wrote to memory of 892 4404 cmd.exe 78 PID 4404 wrote to memory of 892 4404 cmd.exe 78 PID 4404 wrote to memory of 892 4404 cmd.exe 78 PID 4404 wrote to memory of 1344 4404 cmd.exe 79 PID 4404 wrote to memory of 1344 4404 cmd.exe 79 PID 4404 wrote to memory of 1344 4404 cmd.exe 79 PID 4404 wrote to memory of 2180 4404 cmd.exe 80 PID 4404 wrote to memory of 2180 4404 cmd.exe 80 PID 4404 wrote to memory of 2180 4404 cmd.exe 80 PID 4404 wrote to memory of 2176 4404 cmd.exe 81 PID 4404 wrote to memory of 2176 4404 cmd.exe 81 PID 4404 wrote to memory of 2176 4404 cmd.exe 81 PID 4404 wrote to memory of 328 4404 cmd.exe 82 PID 4404 wrote to memory of 328 4404 cmd.exe 82 PID 4404 wrote to memory of 328 4404 cmd.exe 82 PID 4404 wrote to memory of 3660 4404 cmd.exe 83 PID 4404 wrote to memory of 3660 4404 cmd.exe 83 PID 4404 wrote to memory of 3660 4404 cmd.exe 83 PID 4404 wrote to memory of 380 4404 cmd.exe 84 PID 4404 wrote to memory of 380 4404 cmd.exe 84 PID 4404 wrote to memory of 380 4404 cmd.exe 84 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4688 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1888f5b6eb5f31603cb449f53f83218bf4a1f17137dade7468f3ab33715a8a3d.exe"C:\Users\Admin\AppData\Local\Temp\1888f5b6eb5f31603cb449f53f83218bf4a1f17137dade7468f3ab33715a8a3d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com3⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\nslookup.exenslookup myip.opendns.com. resolver1.opendns.com4⤵PID:4268
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain3⤵
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic ComputerSystem get Domain4⤵
- Suspicious use of AdjustPrivilegeToken
PID:720
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:892
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:328
-
-
C:\Users\Admin\AppData\Local\Temp\7z.exe7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3660
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:380 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:3516
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:2784
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:4380
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic computersystem where name="CXVLSGIX" set AutomaticManagedPagefile=False5⤵PID:3296
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:3308
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=200005⤵PID:4252
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"4⤵PID:4768
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"5⤵PID:336
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 86⤵
- Runs ping.exe
PID:1340
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"6⤵PID:3648
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 9 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 9 > nul && "C:\Users\Admin\Music\rot.exe"5⤵PID:2680
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 96⤵
- Runs ping.exe
PID:4440
-
-
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"4⤵
- Views/modifies file attributes
PID:4688
-
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F3⤵PID:5084
-
-
C:\Users\Admin\AppData\Local\Temp\ratt.exe"ratt.exe"3⤵PID:212
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 13 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 13 > nul && "C:\Users\Admin\Music\rot.exe"4⤵PID:1484
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 135⤵
- Runs ping.exe
PID:4460
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 135⤵
- Runs ping.exe
PID:4816
-
-
C:\Users\Admin\Music\rot.exe"C:\Users\Admin\Music\rot.exe"5⤵PID:4268
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"6⤵PID:4976
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216.6MB
MD5ed6bb0d43da2d0678c3d5da8222104a2
SHA16b3d41a788436779aadace23b030abc6b7fffd38
SHA256832ac9529c53effb421959c702619297cf5a439b1d6fa4a82ebc7bf31808e37a
SHA512b19d078467801646fd1a90eebf623124cc13986d29bc07fd193470d4901dcb22651e70a957f7e45bbf0a59d430f9d4084817fb131e664a9ddeabf22f9f65c83b
-
Filesize
197.0MB
MD56d9872c8d49e9ca8ff51581cc744d752
SHA1327bd77ea67c065aca0507a3472b47263d5c7fec
SHA256a2bb0ca219176c2cd4f046ce482f6c6a1b3fcf46daae32087a5216af43c6c0fe
SHA5121f151cc02a2dcd9b46f3adc01d58f16d2c2a091910e25821f09059c6e44469e76e4591f5d1bc6f66f3883a2537729e8e63988e39ef66e1718e134b3482537f3f
-
Filesize
1KB
MD50f5cbdca905beb13bebdcf43fb0716bd
SHA19e136131389fde83297267faf6c651d420671b3f
SHA256a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060
SHA512a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0
-
Filesize
1KB
MD59e104e9aa0cfdec0753de24cbe3f587b
SHA1f63b8d0b29c65e518be6a9412e7499c9de11be78
SHA25659a9f13de0e003ea4adcd0193477f147b0c91ae847eebc744e91a4efe167223f
SHA5128253854159ceac2d84eb371c9672730831505dea52ac3bc2cca45ee5308717ca3f11734602d0a409974b137084a8c20e6b7653640991e45708f692c65ac4933b
-
Filesize
12KB
MD529a4a43df595d9885de12c93572b2b2f
SHA1ae618a5ca0ed91e133dca59fb8b9c7daad2d46ed
SHA2565d37eb48b40c6da8b341c8fa47917294f31093634b0a43cfd0eb0027788b5325
SHA512c19212375f40bcee54fc5b1932a94d7ecee00011ac5cd5bb92259ee56aa9d31fa8d6f928bb062627cd90059eecbdd37dc83f9f4ffcbe5964dcc5d84fa34cd6ab
-
Filesize
12KB
MD57ed2cedb49746b1f72af252c3d4af767
SHA1d438379700e32146155ed2567a8b7f3dd860e767
SHA25691f0e2b174c6821fa6ea4db9039c73d8d9abb7addbe8bb0403d4a1d0fb4037fa
SHA512429610f95ea2f1c1ddeed2460a18d5f036e7e5b8a42b1412beb7fab5a6be338bba581e67d65a06f5cbe096f0d2ae9dc64d13494a59841cdd80c2d99351037225
-
Filesize
12KB
MD52c0a9bbd9c5911848b57f1afe21d9119
SHA1d7b0052af5cd41b48779733507a059eb70117d8c
SHA2562f6695647a8320ca5c265c06db9d6e91174b7725356be8cac5e5635e02940039
SHA512a82c6933b61ca0da1cd455b69e8010db53a52757ca100784a8e8476a3c7329fe374ebb9639a3fc232d6ca8ecff3ec1d3d117a2b371ce13fb42e117b1421a0baa
-
Filesize
12KB
MD5d4746cd0c9f92cd9233a293a278bcda8
SHA182e01d9bce190f73a7e3459083b2bb21c0af45f2
SHA256ba11a46e24656c9115b1ed8e049f60d52aa54187c3fd9f204df0cd5498877463
SHA512b44d380048ab779b88ac3e95e8cf34155c25447922eba3799e0ccb8f6aaf3514f3d1a0ed102b3ebe79070b1191b9f0f1e1735f5b7355d4b89ff89593b4ff630b
-
Filesize
12KB
MD5e8b034d7114da4fa61992ad321b6798e
SHA18c4dffb8e4b0cb37394d9a043d0c8d3f479261f2
SHA2568678fd8c944cd54c35898c0434e7e0a7680afff005afffd117a750d90702eba7
SHA512c47599d4d3e04ed4f920aa23d4dd5aaffa9ec8ae326663218b1404e815a4376ef0ff87b85f5fe58dfad75e243d4dd85cf1e9b9467749d7e1e5f6ec588aab081a
-
Filesize
328KB
MD515bbbe562f9be3e5dcbb834e635cc231
SHA17c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a
SHA256ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde
SHA512769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287
-
Filesize
71KB
MD58ba2e41b330ae9356e62eb63514cf82e
SHA18dc266467a5a0d587ed0181d4344581ef4ff30b2
SHA256ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea
SHA5122fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d
-
Filesize
71KB
MD58ba2e41b330ae9356e62eb63514cf82e
SHA18dc266467a5a0d587ed0181d4344581ef4ff30b2
SHA256ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea
SHA5122fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d
-
Filesize
1KB
MD50df43097e0f0acd04d9e17fb43d618b9
SHA169b3ade12cb228393a93624e65f41604a17c83b6
SHA256c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873
SHA51201ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
693KB
MD57de6fdf3629c73bf0c29a96fa23ae055
SHA1dcb37f6d43977601c6460b17387a89b9e4c0609a
SHA256069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff
SHA512d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8
-
Filesize
1KB
MD57ea1fec84d76294d9256ae3dca7676b2
SHA11e335451d1cbb6951bc77bf75430f4d983491342
SHA2569a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940
SHA512ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317
-
Filesize
319.5MB
MD5112d17326334dad2fa7e9865b4735f5f
SHA1afd1844c48b7b384fdd7b0bb199be4119c9ee951
SHA256ff18c94b150f364eaf3a9d4ad13b41cb7d61b0b7fd743652d8b16215df42da91
SHA5125d31df265e8df98d630fe517394c098e6a2fa24876267137ec40494a3218c1c5b8f046e55714d14b637e7e88e23cce21423c5cbc86ea6060c63c212afc34f018
-
Filesize
179.7MB
MD54193b91d2e4ea4b836e6c003372c6594
SHA15741ab8555220a156b8dfdb1edf537d664de4577
SHA256531987985c2e73fe7abe7665b3ec4621e25d83fcb300386283f1589b9a12fe5c
SHA512528ce8a5e8348f66a84afc0fe73372e26658962adfe59569fc91b24b4c231a2a2254348b65f043298ff721b847b9c7461c19e58605bc684a2148fa90d7a323e6
-
Filesize
153.4MB
MD56a34319afc6aed8fd7d7ad8b5b6c292c
SHA1987ba47c990d688987abd75e2dcb2776654c3270
SHA256fc54fe6337474698dda82986cbadb7a899373e346699535a6cb2fc24108dcc7f
SHA512821d2035a13b81f0f557b092aca85a76e4f0099422fee3408f5b3022e6636f2c8215479a5ddbe6e2ae3334b5af4268a1715f049e9400b40b15099fd38c57c8ca
-
Filesize
76.6MB
MD5d20860e743f5ac137a9b517f92425f77
SHA12fc3982df3268cb313d6c02ed65827896ea023ed
SHA256b7eeb6226237063c032631e246f7f0737d8da94cd542003312e1724f50c0b58b
SHA512b0601ac98dcd244e25a54f27d4693a5d6761d26a2978fa8e6a7487e86c0cf8167623777293a4eb5fd015452332573e48c8f42fd03774ad834d4c957f26fb0545
-
Filesize
96.8MB
MD5542684a45a99b2cfe198c28411acda08
SHA106e45ace4a818138ce750f8530ad32f8684daf59
SHA256f197019a9792749300dcb8ba2004a01116b671a6c0d19249500fa5945d9bf721
SHA512078b4a94b4024028b85bc07da2ba1ffde4563b6acab1a03cc50d5b66c489dd5c0189a8d522ffa4df21ce01ea51cc09931c34f6edacd4af367bb12911b9b32eb1
-
Filesize
328KB
MD515bbbe562f9be3e5dcbb834e635cc231
SHA17c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a
SHA256ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde
SHA512769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287