Analysis
-
max time kernel
63s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-04-2024 02:40
Static task
static1
Behavioral task
behavioral1
Sample
Antares Auto-Tune Pro X v10.3.1 CE.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Antares Auto-Tune Pro X v10.3.1 CE.exe
Resource
win10v2004-20240226-en
General
-
Target
Antares Auto-Tune Pro X v10.3.1 CE.exe
-
Size
85.9MB
-
MD5
bc098726a5e3276880e0f32d2e6cfda1
-
SHA1
7e12e8091bfdc3a5a917725016bcb5eba401e36a
-
SHA256
dc7de9526b50b299217087a4bf2a40bb529005a4d441743f6fa9c7b9fce0bf77
-
SHA512
b9bb06f4250e2deb3978e6b069640cc1e0348fd68972d8da51a85eec4d05a7f972808bb4f0d55f8057c90cec8cd2636556fe6f20af85e83d6c4148af691a033a
-
SSDEEP
1572864:BxhAXXk7jJMEb5/oolzSylAPSkavpme7ILvWeqfBQC:Brl7tMEhBhlETaobgBQC
Malware Config
Signatures
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2308 attrib.exe 2072 attrib.exe -
Executes dropped EXE 4 IoCs
pid Process 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 1216 Antares Central.exe 2928 Antares Central.exe 1936 Antares Central.exe -
Loads dropped DLL 2 IoCs
pid Process 2112 Antares Auto-Tune Pro X v10.3.1 CE.exe 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\desktop.ini Antares Auto-Tune Pro X v10.3.1 CE.tmp File opened for modification C:\Program Files\Common Files\VST3\Antares\desktop.ini Antares Auto-Tune Pro X v10.3.1 CE.tmp File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\desktop.ini attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin\desktop.ini attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\desktop.ini attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin\desktop.ini attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\desktop.ini attrib.exe -
Drops file in Program Files directory 45 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\Contents\x64 attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\desktop.ini attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin\desktop.ini attrib.exe File created C:\Program Files\Common Files\VST3\Antares\is-JMPF6.tmp Antares Auto-Tune Pro X v10.3.1 CE.tmp File opened for modification C:\Program Files\Common Files\VST3\Antares\desktop.ini Antares Auto-Tune Pro X v10.3.1 CE.tmp File opened for modification C:\Program Files\Common Files\VST3\Antares\PlugIn.ico Antares Auto-Tune Pro X v10.3.1 CE.tmp File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\Contents\x64\Auto-Key.aaxplugin attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\Contents attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin\Contents\Resources attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\PlugIn.ico attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\PlugIn.ico Antares Auto-Tune Pro X v10.3.1 CE.tmp File created C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin\is-K0NF0.tmp Antares Auto-Tune Pro X v10.3.1 CE.tmp File created C:\Program Files\Antares Audio Technologies\is-GESR1.tmp Antares Auto-Tune Pro X v10.3.1 CE.tmp File created C:\Program Files\Antares Audio Technologies\Auto-Tune Unlimited\is-OM8ML.tmp Antares Auto-Tune Pro X v10.3.1 CE.tmp File created C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\Contents\Resources\is-O76JG.tmp Antares Auto-Tune Pro X v10.3.1 CE.tmp File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\Contents\Resources attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\PlugIn.ico attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin\Contents\x64\Auto-Tune Pro.aaxplugin attrib.exe File opened for modification C:\Program Files\Common Files\VST3\Antares Antares Auto-Tune Pro X v10.3.1 CE.tmp File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\desktop.ini Antares Auto-Tune Pro X v10.3.1 CE.tmp File created C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\is-EOHSK.tmp Antares Auto-Tune Pro X v10.3.1 CE.tmp File created C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\is-22SV2.tmp Antares Auto-Tune Pro X v10.3.1 CE.tmp File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin\Contents attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\PlugIn.ico attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin\PlugIn.ico attrib.exe File created C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin\Contents\x64\is-C7RFF.tmp Antares Auto-Tune Pro X v10.3.1 CE.tmp File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin\Contents\Resources\AutoTunePro.xml attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\desktop.ini attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\desktop.ini attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin\Contents\x64 attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares Antares Auto-Tune Pro X v10.3.1 CE.tmp File created C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\Contents\x64\is-GVQ2U.tmp Antares Auto-Tune Pro X v10.3.1 CE.tmp File created C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin\is-VRJUD.tmp Antares Auto-Tune Pro X v10.3.1 CE.tmp File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\Contents\Resources\Auto-Key.xml attrib.exe File opened for modification C:\Program Files\Antares Audio Technologies\Antares Central.exe Antares Auto-Tune Pro X v10.3.1 CE.tmp File created C:\Program Files\Common Files\VST3\Antares\is-OCBLP.tmp Antares Auto-Tune Pro X v10.3.1 CE.tmp File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin\PlugIn.ico attrib.exe File created C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\is-UMSOR.tmp Antares Auto-Tune Pro X v10.3.1 CE.tmp File created C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\is-0IJL6.tmp Antares Auto-Tune Pro X v10.3.1 CE.tmp File created C:\Program Files\Common Files\VST3\Antares\is-7VVEC.tmp Antares Auto-Tune Pro X v10.3.1 CE.tmp File created C:\Program Files\Common Files\VST3\Antares\is-A667V.tmp Antares Auto-Tune Pro X v10.3.1 CE.tmp File created C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin\Contents\Resources\is-7BS67.tmp Antares Auto-Tune Pro X v10.3.1 CE.tmp File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin\desktop.ini attrib.exe File opened for modification C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin attrib.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2872 2112 Antares Auto-Tune Pro X v10.3.1 CE.exe 28 PID 2112 wrote to memory of 2872 2112 Antares Auto-Tune Pro X v10.3.1 CE.exe 28 PID 2112 wrote to memory of 2872 2112 Antares Auto-Tune Pro X v10.3.1 CE.exe 28 PID 2112 wrote to memory of 2872 2112 Antares Auto-Tune Pro X v10.3.1 CE.exe 28 PID 2112 wrote to memory of 2872 2112 Antares Auto-Tune Pro X v10.3.1 CE.exe 28 PID 2112 wrote to memory of 2872 2112 Antares Auto-Tune Pro X v10.3.1 CE.exe 28 PID 2112 wrote to memory of 2872 2112 Antares Auto-Tune Pro X v10.3.1 CE.exe 28 PID 2872 wrote to memory of 1684 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 29 PID 2872 wrote to memory of 1684 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 29 PID 2872 wrote to memory of 1684 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 29 PID 2872 wrote to memory of 1684 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 29 PID 1684 wrote to memory of 1508 1684 net.exe 31 PID 1684 wrote to memory of 1508 1684 net.exe 31 PID 1684 wrote to memory of 1508 1684 net.exe 31 PID 2872 wrote to memory of 1884 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 32 PID 2872 wrote to memory of 1884 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 32 PID 2872 wrote to memory of 1884 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 32 PID 2872 wrote to memory of 1884 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 32 PID 1884 wrote to memory of 1880 1884 net.exe 34 PID 1884 wrote to memory of 1880 1884 net.exe 34 PID 1884 wrote to memory of 1880 1884 net.exe 34 PID 2872 wrote to memory of 1640 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 35 PID 2872 wrote to memory of 1640 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 35 PID 2872 wrote to memory of 1640 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 35 PID 2872 wrote to memory of 1640 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 35 PID 1640 wrote to memory of 1084 1640 net.exe 37 PID 1640 wrote to memory of 1084 1640 net.exe 37 PID 1640 wrote to memory of 1084 1640 net.exe 37 PID 2872 wrote to memory of 2044 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 38 PID 2872 wrote to memory of 2044 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 38 PID 2872 wrote to memory of 2044 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 38 PID 2872 wrote to memory of 2044 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 38 PID 2872 wrote to memory of 2072 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 40 PID 2872 wrote to memory of 2072 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 40 PID 2872 wrote to memory of 2072 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 40 PID 2872 wrote to memory of 2072 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 40 PID 2872 wrote to memory of 2308 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 42 PID 2872 wrote to memory of 2308 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 42 PID 2872 wrote to memory of 2308 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 42 PID 2872 wrote to memory of 2308 2872 Antares Auto-Tune Pro X v10.3.1 CE.tmp 42 -
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 2044 attrib.exe 2072 attrib.exe 2308 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune Pro X v10.3.1 CE.exe"C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune Pro X v10.3.1 CE.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\is-TIMI6.tmp\Antares Auto-Tune Pro X v10.3.1 CE.tmp"C:\Users\Admin\AppData\Local\Temp\is-TIMI6.tmp\Antares Auto-Tune Pro X v10.3.1 CE.tmp" /SL5="$90120,89194940,864768,C:\Users\Admin\AppData\Local\Temp\Antares Auto-Tune Pro X v10.3.1 CE.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" stop "Antares Central Services"3⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Antares Central Services"4⤵PID:1508
-
-
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" stop CmWebAdmin.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CmWebAdmin.exe4⤵PID:1880
-
-
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" stop CodeMeter.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CodeMeter.exe4⤵PID:1084
-
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +r /s /d "C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\*"3⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Views/modifies file attributes
PID:2044
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +s +h /s /d "C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\*.ini"3⤵
- Sets file to hidden
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Views/modifies file attributes
PID:2072
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +s +h /s /d "C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\*.ico"3⤵
- Sets file to hidden
- Drops file in Program Files directory
- Views/modifies file attributes
PID:2308
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1424
-
C:\Program Files\Antares Audio Technologies\Antares Central.exe"C:\Program Files\Antares Audio Technologies\Antares Central.exe"1⤵
- Executes dropped EXE
PID:1216
-
C:\Program Files\Antares Audio Technologies\Antares Central.exe"C:\Program Files\Antares Audio Technologies\Antares Central.exe"1⤵
- Executes dropped EXE
PID:2928
-
C:\Program Files\Antares Audio Technologies\Antares Central.exe"C:\Program Files\Antares Audio Technologies\Antares Central.exe"1⤵
- Executes dropped EXE
PID:1936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5a7ca0d123c7252899d4a6372ec198e3e
SHA115f645713de2ec4adc24c6965ff972a455a17347
SHA25622474c4ea7c88736a4a400175a266ce176a899571f14db9497b9895b81b7568d
SHA512371508340775ed1b530cba573ffaae2aeea92d82e8f7bd761cd8747a549eb169c5952cbd0c6a1a23d5340bfd365459046134679c76bae0a751d184837ed47f80
-
C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\Contents\Resources\Auto-Key.xml
Filesize9KB
MD544554c48016e097a80f592dc7656e292
SHA15bd0c43722cf276e9c51d8b372bda33297ca6bbe
SHA25662a96686da67da29fd6d54f65f44806c6f88185a45bbbe342cc385d90e00fdb9
SHA512ffaf43c826170f5bc8e246a6a039738553ebd8a90ab8b6885729ea297189fdcde6c4e52a5a1d134f3306c052fdd0b567ca7c59267b3e812a213ed70def234c0b
-
C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Key.aaxplugin\Contents\x64\Auto-Key.aaxplugin
Filesize13.8MB
MD5e84c950b03d5c72e3fe198d789854701
SHA17cc2d95a593c2c4be22c2ccef8d361d72576aa78
SHA2560f09bb391e3038f59f76a9c8927335182690aff373594578db0b455911a36314
SHA512ea5c097abb159724c8d66f7b1e066a444ba57cbce9e433a9e28347c7081786bcb3165401069ea3aabbfc3b51e2cf30c90ee12f64fa01c939cd63453b2c4e3974
-
C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin\Contents\Resources\AutoTunePro.xml
Filesize32KB
MD5f6d7e92c546f969afbe4158ce2feb785
SHA1277cf1d0f1f0bf9a4549f766b502369955ca5aec
SHA25660f1b3dbcae91d77d52bf3cec20add1a76d80151558e21a94a3bc4c9fd9a696c
SHA512f887feb06dbeafabbe1faf65e627b9315070e74f0b815386ff8b5c0627c50750bc35fa3b4084fb1fb6b8a65f5b9aa45aa641984002a8a5a3f6e3b572aa15b3a6
-
C:\Program Files\Common Files\Avid\Audio\Plug-Ins\Antares\Auto-Tune Pro.aaxplugin\Contents\x64\Auto-Tune Pro.aaxplugin
Filesize42.7MB
MD500f1e4a9fcd5e1574da621dde42336e9
SHA1bc881b4183e418191e8e42f0e55c6bd1de274c61
SHA2564a23755ae9b36c7642a68a31f8507f33eb1d7975669bc74f97070c115cb8ef14
SHA5125cff154cc098606fb934cca2aa164f42fb4c5180086573176b94fcb6216bb31311c607e8a300d681cba5cf9d1c895d900913e372184f13e7e8a45494e26c22a6
-
Filesize
126B
MD5798095cd31340606c8e81d0a5107d57e
SHA139d058c4d45ef84b188f7ece620106124eb3d74e
SHA2565526ef6345adee7c693e58354dd72b095df152be62ff7298b4c6f6d0f91e2f83
SHA5129ca995c89d3f23cd2a977fb2826da1f75dc4caa4fe965f9aac3a6d486f6558429a44eaeea35217f85d94ba6d7c2c54ab520c9a1786133b2edd103e36159e53a1
-
Filesize
45KB
MD56e03b680fbee54e69e52a15245989862
SHA10136100d693fa2cf4eba38ac0314951b7be22c9b
SHA25600999004190475604537034d99d9a2cc84355579e4b199045dc6c8c3479e3600
SHA5121a2e8770e676bfe9c84f81185584fdf347271897637f18ccbcb1f1dfb7f4afac4cf65ab0d19d7f34044b5f5b304d7b54c9c85c8049fee0a4a3e4cabe3ae7c578
-
Filesize
46B
MD592872f8ac2aed2db0b07e0bd2a2cc207
SHA16f7560add23274d6e0482754c186b59518269112
SHA256524c4940611c5338397e0bbdd9f23c030da1e5387f772a38b1599b467be78732
SHA51217b4a82fe65178e7701c61239d951155929a1b950c1ad35cd214286fa05032b10f1300bb01ef25910d4685e67dcd511da5f13de531e2210fc413ad77528969df
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
3.1MB
MD531cd6eb9935a435a0e2810ccc5892767
SHA18081b5b305cce54ee398bb2201d16e0ba7a153c4
SHA2569ce72a80569d00b753bc86f066d0448428d5f9be11b9aa8355d652127f212749
SHA512bdac5c47cd1e6b96348f9b08a978b6ba5965db9f8a45f321cef0c06909d54a663212e415cb2ed464355694c613cda4a81192dd6c542723996cb8f91c26813ae7