Analysis
-
max time kernel
172s -
max time network
193s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
14/01/2023, 18:29
Static task
static1
URLScan task
urlscan1
General
Malware Config
Extracted
quasar
1.4.0
Office04
pimveldhof-60417.portmap.host:60417
982805a1-538c-4652-b82b-f35c8c7d3aca
-
encryption_key
7CD294CCD8B0790D5277B1060F06CD099C4F33C2
-
install_name
IXWare.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
IXWare is loading...
-
subdirectory
SubDir
Signatures
-
Quasar payload 10 IoCs
resource yara_rule behavioral1/files/0x0006000000015cae-56.dat family_quasar behavioral1/files/0x0006000000015cae-57.dat family_quasar behavioral1/memory/2360-58-0x0000000001330000-0x00000000013B8000-memory.dmp family_quasar behavioral1/files/0x0006000000015eb4-61.dat family_quasar behavioral1/files/0x0006000000015eb4-62.dat family_quasar behavioral1/memory/2404-63-0x0000000000880000-0x0000000000908000-memory.dmp family_quasar behavioral1/files/0x0006000000015cae-67.dat family_quasar behavioral1/files/0x0006000000015eb4-70.dat family_quasar behavioral1/files/0x0006000000015eb4-71.dat family_quasar behavioral1/memory/3004-72-0x0000000000FD0000-0x0000000001058000-memory.dmp family_quasar -
Executes dropped EXE 4 IoCs
pid Process 2360 IXWare (2) (1).exe 2404 IXWare.exe 2948 IXWare (2) (1).exe 3004 IXWare.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1484 chrome.exe 1128 chrome.exe 1128 chrome.exe 2236 chrome.exe 2648 chrome.exe 1128 chrome.exe 1128 chrome.exe 2752 chrome.exe 2948 IXWare (2) (1).exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: 33 2056 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2056 AUDIODG.EXE Token: 33 2056 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2056 AUDIODG.EXE Token: SeDebugPrivilege 2360 IXWare (2) (1).exe Token: SeDebugPrivilege 2404 IXWare.exe Token: SeDebugPrivilege 2948 IXWare (2) (1).exe Token: SeDebugPrivilege 3004 IXWare.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 2404 IXWare.exe 3004 IXWare.exe -
Suspicious use of SendNotifyMessage 34 IoCs
pid Process 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 1128 chrome.exe 2404 IXWare.exe 3004 IXWare.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2404 IXWare.exe 3004 IXWare.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1128 wrote to memory of 1112 1128 chrome.exe 27 PID 1128 wrote to memory of 1112 1128 chrome.exe 27 PID 1128 wrote to memory of 1112 1128 chrome.exe 27 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1228 1128 chrome.exe 28 PID 1128 wrote to memory of 1484 1128 chrome.exe 29 PID 1128 wrote to memory of 1484 1128 chrome.exe 29 PID 1128 wrote to memory of 1484 1128 chrome.exe 29 PID 1128 wrote to memory of 360 1128 chrome.exe 30 PID 1128 wrote to memory of 360 1128 chrome.exe 30 PID 1128 wrote to memory of 360 1128 chrome.exe 30 PID 1128 wrote to memory of 360 1128 chrome.exe 30 PID 1128 wrote to memory of 360 1128 chrome.exe 30 PID 1128 wrote to memory of 360 1128 chrome.exe 30 PID 1128 wrote to memory of 360 1128 chrome.exe 30 PID 1128 wrote to memory of 360 1128 chrome.exe 30 PID 1128 wrote to memory of 360 1128 chrome.exe 30 PID 1128 wrote to memory of 360 1128 chrome.exe 30 PID 1128 wrote to memory of 360 1128 chrome.exe 30 PID 1128 wrote to memory of 360 1128 chrome.exe 30 PID 1128 wrote to memory of 360 1128 chrome.exe 30 PID 1128 wrote to memory of 360 1128 chrome.exe 30 PID 1128 wrote to memory of 360 1128 chrome.exe 30 PID 1128 wrote to memory of 360 1128 chrome.exe 30 PID 1128 wrote to memory of 360 1128 chrome.exe 30
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://mega.nz/file/zNxAlJpK#aj1s-SkIlCU0LxnlG-8kEE_JPN_mhFg-JnVXYNAQt7U1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefb7f4f50,0x7fefb7f4f60,0x7fefb7f4f702⤵PID:1112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1124 /prefetch:22⤵PID:1228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1272 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1720 /prefetch:82⤵PID:360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:12⤵PID:308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2008 /prefetch:12⤵PID:952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:82⤵PID:1664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3292 /prefetch:22⤵PID:1712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3744 /prefetch:82⤵PID:1600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4080 /prefetch:82⤵PID:2152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4120 /prefetch:82⤵PID:2160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4268 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4240 /prefetch:82⤵PID:2296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4244 /prefetch:82⤵PID:2288
-
-
C:\Users\Admin\Downloads\IXWare (2) (1).exe"C:\Users\Admin\Downloads\IXWare (2) (1).exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2360 -
C:\Users\Admin\AppData\Roaming\SubDir\IXWare.exe"C:\Users\Admin\AppData\Roaming\SubDir\IXWare.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2404
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=536 /prefetch:82⤵PID:2488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1800 /prefetch:82⤵PID:2580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3076 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2616 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=500 /prefetch:82⤵PID:2760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:82⤵PID:2768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:82⤵PID:2864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1112,630887147502269724,13022807285005619147,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1744 /prefetch:82⤵PID:2904
-
-
C:\Users\Admin\Downloads\IXWare (2) (1).exe"C:\Users\Admin\Downloads\IXWare (2) (1).exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2948 -
C:\Users\Admin\AppData\Roaming\SubDir\IXWare.exe"C:\Users\Admin\AppData\Roaming\SubDir\IXWare.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3004
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5681⤵
- Suspicious use of AdjustPrivilegeToken
PID:2056
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
517KB
MD5485bb76fca2d5b339e3a4f3ce1b45fce
SHA1c5bdd971c60e9b21b34c25407e49ddee7065aa31
SHA25692d18d636576cf5a0cf770ce552df78141ad89592dccef1b55c15ba48e81875b
SHA512b36d5497aad0473f7e8d4d9a110bacd4d1185bcd6b9fb37c3df1509eb65d7fd1bb4f06e0c59e381ed73a1fc6c2d32708efe67a434251636b2d7c673d19e9cbfd
-
Filesize
517KB
MD5485bb76fca2d5b339e3a4f3ce1b45fce
SHA1c5bdd971c60e9b21b34c25407e49ddee7065aa31
SHA25692d18d636576cf5a0cf770ce552df78141ad89592dccef1b55c15ba48e81875b
SHA512b36d5497aad0473f7e8d4d9a110bacd4d1185bcd6b9fb37c3df1509eb65d7fd1bb4f06e0c59e381ed73a1fc6c2d32708efe67a434251636b2d7c673d19e9cbfd
-
Filesize
517KB
MD5485bb76fca2d5b339e3a4f3ce1b45fce
SHA1c5bdd971c60e9b21b34c25407e49ddee7065aa31
SHA25692d18d636576cf5a0cf770ce552df78141ad89592dccef1b55c15ba48e81875b
SHA512b36d5497aad0473f7e8d4d9a110bacd4d1185bcd6b9fb37c3df1509eb65d7fd1bb4f06e0c59e381ed73a1fc6c2d32708efe67a434251636b2d7c673d19e9cbfd
-
Filesize
517KB
MD5485bb76fca2d5b339e3a4f3ce1b45fce
SHA1c5bdd971c60e9b21b34c25407e49ddee7065aa31
SHA25692d18d636576cf5a0cf770ce552df78141ad89592dccef1b55c15ba48e81875b
SHA512b36d5497aad0473f7e8d4d9a110bacd4d1185bcd6b9fb37c3df1509eb65d7fd1bb4f06e0c59e381ed73a1fc6c2d32708efe67a434251636b2d7c673d19e9cbfd
-
Filesize
517KB
MD5485bb76fca2d5b339e3a4f3ce1b45fce
SHA1c5bdd971c60e9b21b34c25407e49ddee7065aa31
SHA25692d18d636576cf5a0cf770ce552df78141ad89592dccef1b55c15ba48e81875b
SHA512b36d5497aad0473f7e8d4d9a110bacd4d1185bcd6b9fb37c3df1509eb65d7fd1bb4f06e0c59e381ed73a1fc6c2d32708efe67a434251636b2d7c673d19e9cbfd
-
Filesize
517KB
MD5485bb76fca2d5b339e3a4f3ce1b45fce
SHA1c5bdd971c60e9b21b34c25407e49ddee7065aa31
SHA25692d18d636576cf5a0cf770ce552df78141ad89592dccef1b55c15ba48e81875b
SHA512b36d5497aad0473f7e8d4d9a110bacd4d1185bcd6b9fb37c3df1509eb65d7fd1bb4f06e0c59e381ed73a1fc6c2d32708efe67a434251636b2d7c673d19e9cbfd
-
Filesize
517KB
MD5485bb76fca2d5b339e3a4f3ce1b45fce
SHA1c5bdd971c60e9b21b34c25407e49ddee7065aa31
SHA25692d18d636576cf5a0cf770ce552df78141ad89592dccef1b55c15ba48e81875b
SHA512b36d5497aad0473f7e8d4d9a110bacd4d1185bcd6b9fb37c3df1509eb65d7fd1bb4f06e0c59e381ed73a1fc6c2d32708efe67a434251636b2d7c673d19e9cbfd