Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
29-07-2024 16:58
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240704-en
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
9a4f3b0223e0bcb90d5a08afdae6a169
-
SHA1
b8ea3a64121a47f7a7abc73fc9a39d912b31a724
-
SHA256
031b3b1935b0eac9273bafb8b20484be97a1c3f9ea1bb611315042b32168f104
-
SHA512
38ab6b70078807bc8c56f5c004ae4ef4a40690ec26bc896213a158765530caec5812b556a5555037ac986175fb1d4d588f1a982dd5e383a8c5734783507f6601
-
SSDEEP
49152:SvHI22SsaNYfdPBldt698dBcjHJwRJ6cbR3LoGdFgTHHB72eh2NT:Svo22SsaNYfdPBldt6+dBcjHJwRJ6m
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.1.70:4782
34828de8-c350-4dd4-85c9-16051c0443f7
-
encryption_key
2F1B645695C7578786A6BD1B6CD3966DFF24BC11
-
install_name
sigmaexecutor.exe.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
WIndows Updater
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4880-1-0x00000000009B0000-0x0000000000CD4000-memory.dmp family_quasar C:\Windows\System32\SubDir\sigmaexecutor.exe.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
sigmaexecutor.exe.exepid process 2040 sigmaexecutor.exe.exe -
Drops file in System32 directory 5 IoCs
Processes:
Client-built.exesigmaexecutor.exe.exedescription ioc process File created C:\Windows\system32\SubDir\sigmaexecutor.exe.exe Client-built.exe File opened for modification C:\Windows\system32\SubDir\sigmaexecutor.exe.exe Client-built.exe File opened for modification C:\Windows\system32\SubDir Client-built.exe File opened for modification C:\Windows\system32\SubDir\sigmaexecutor.exe.exe sigmaexecutor.exe.exe File opened for modification C:\Windows\system32\SubDir sigmaexecutor.exe.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3084 schtasks.exe 744 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 5052 msedge.exe 5052 msedge.exe 4124 msedge.exe 4124 msedge.exe 984 identity_helper.exe 984 identity_helper.exe 5276 msedge.exe 5276 msedge.exe 5276 msedge.exe 5276 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Client-built.exesigmaexecutor.exe.exedescription pid process Token: SeDebugPrivilege 4880 Client-built.exe Token: SeDebugPrivilege 2040 sigmaexecutor.exe.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe 4124 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
sigmaexecutor.exe.exepid process 2040 sigmaexecutor.exe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Client-built.exesigmaexecutor.exe.exemsedge.exedescription pid process target process PID 4880 wrote to memory of 744 4880 Client-built.exe schtasks.exe PID 4880 wrote to memory of 744 4880 Client-built.exe schtasks.exe PID 4880 wrote to memory of 2040 4880 Client-built.exe sigmaexecutor.exe.exe PID 4880 wrote to memory of 2040 4880 Client-built.exe sigmaexecutor.exe.exe PID 2040 wrote to memory of 3084 2040 sigmaexecutor.exe.exe schtasks.exe PID 2040 wrote to memory of 3084 2040 sigmaexecutor.exe.exe schtasks.exe PID 4124 wrote to memory of 3548 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 3548 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 2744 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 5052 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 5052 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 1204 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 1204 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 1204 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 1204 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 1204 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 1204 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 1204 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 1204 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 1204 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 1204 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 1204 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 1204 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 1204 4124 msedge.exe msedge.exe PID 4124 wrote to memory of 1204 4124 msedge.exe msedge.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WIndows Updater" /sc ONLOGON /tr "C:\Windows\system32\SubDir\sigmaexecutor.exe.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:744 -
C:\Windows\system32\SubDir\sigmaexecutor.exe.exe"C:\Windows\system32\SubDir\sigmaexecutor.exe.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WIndows Updater" /sc ONLOGON /tr "C:\Windows\system32\SubDir\sigmaexecutor.exe.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:3084
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3568
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd59f246f8,0x7ffd59f24708,0x7ffd59f247182⤵PID:3548
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9545281544529963273,8875472531800667375,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:2744
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,9545281544529963273,8875472531800667375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5052 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,9545281544529963273,8875472531800667375,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:82⤵PID:1204
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9545281544529963273,8875472531800667375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:3628
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9545281544529963273,8875472531800667375,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵PID:2864
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9545281544529963273,8875472531800667375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:896
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9545281544529963273,8875472531800667375,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:12⤵PID:2784
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9545281544529963273,8875472531800667375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3472 /prefetch:82⤵PID:2736
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9545281544529963273,8875472531800667375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3472 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:984 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9545281544529963273,8875472531800667375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:12⤵PID:1980
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9545281544529963273,8875472531800667375,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:12⤵PID:3872
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9545281544529963273,8875472531800667375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:12⤵PID:5300
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9545281544529963273,8875472531800667375,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3052 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5276
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4344
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD560ead4145eb78b972baf6c6270ae6d72
SHA1e71f4507bea5b518d9ee9fb2d523c5a11adea842
SHA256b9e99e7387a915275e8fe4ac0b0c0cd330b4632814d5c9c446beb2755f1309a7
SHA5128cdbafd2783048f5f54f22e13f6ef890936d5b986b0bb3fa86d2420a5bfecf7bedc56f46e6d5f126eae79f492315843c134c441084b912296e269f384a73ccde
-
Filesize
152B
MD51f9d180c0bcf71b48e7bc8302f85c28f
SHA1ade94a8e51c446383dc0a45edf5aad5fa20edf3c
SHA256a17d56c41d524453a78e3f06e0d0b0081e79d090a4b75d0b693ddbc39f6f7fdc
SHA512282863df0e51288049587886ed37ad1cf5b6bfeed86454ea3b9f2bb7f0a1c591f3540c62712ebfcd6f1095e1977446dd5b13b904bb52b6d5c910a1efc208c785
-
Filesize
5KB
MD5cbb9bc596d24301e75d303fa52a6f79f
SHA10e54cbe67755cd835f417824fc7eb6808fd8d623
SHA256d1b7de4a4f55330f4f5e37b97e33252af98aedead03e1a724f5a2ffd7c999006
SHA51213a78903fe09522c7faf8f36ef76540ef7f484f462de23ea46bbee5e29440eab60d6986b95232fe7a2b1a11a373b1f3c66056a437f616760631ad9430c103cc5
-
Filesize
6KB
MD5fe230f868ace7d0ebd87f3b2bc6aca38
SHA1ec45136ede51924415ec3a95d20b6debcebc3005
SHA25687aa45cbb7203b6060b86b85f2d5f5765e65e8c8a479416453d9a37a06d4e6d3
SHA512a965e82c931ae5be33d6a9a1ba348e53c6de60e44af542cf0accee0d79c42290b9636236f71ffedff6931c2203153b14325c9f5ae67d0a6d9f7054d576278d6c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5dde9872d5b10478a48d557daeb30295a
SHA14ec096909738342c1279a7be9ab0ad029f454e0b
SHA256d28a2a67355cead306d2595b6074a449d2a36b990caee6c1537bed4c539b1df3
SHA5120471472e3e167bcbe50ad0d4445c721ec16b930d4840bf0a654e020fa7b6fb4a54a566f2ec5247763134580556fddc1ff443960648ea0e814c333a14e842b3b9
-
Filesize
3.1MB
MD59a4f3b0223e0bcb90d5a08afdae6a169
SHA1b8ea3a64121a47f7a7abc73fc9a39d912b31a724
SHA256031b3b1935b0eac9273bafb8b20484be97a1c3f9ea1bb611315042b32168f104
SHA51238ab6b70078807bc8c56f5c004ae4ef4a40690ec26bc896213a158765530caec5812b556a5555037ac986175fb1d4d588f1a982dd5e383a8c5734783507f6601
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e