Analysis
-
max time kernel
92s -
max time network
95s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
28-11-2024 03:40
Static task
static1
General
-
Target
PORQUEPUTASYANOSIRVE.7z
-
Size
923KB
-
MD5
d757d40193d311216967491e36fc2ba4
-
SHA1
2dd90fa74c489da4f85bdf301053230b480a31fa
-
SHA256
8a31693ddf8924f144ba19a8802766188bd13f1ed7eea7c226eb0e01a9e47685
-
SHA512
9be26ab222457605eea0c42a4dbcfa80154cb384e6abf0db6a010fcca172a0eda8792b9e3fff9d67717f095f67448d9310c7e049f7fea8dd5907afe8bd462921
-
SSDEEP
24576:q9gl2kNvEE7GFdGqXsShFTAkBojKLUI56eGk:46vbIGqXscAkW+h1
Malware Config
Extracted
quasar
1.4.1
Office04
azxq0ap.localto.net:3425
e51e2b65-e963-4051-9736-67d57ed46798
-
encryption_key
AEA258EF65BF1786F0F767C0BE2497ECC304C46F
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/files/0x0028000000045046-2.dat family_quasar behavioral1/memory/2720-5-0x0000000000A30000-0x0000000000D54000-memory.dmp family_quasar -
Executes dropped EXE 2 IoCs
pid Process 2720 PORQUEPUTASYANOSIRVE.exe 1704 Client.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133772389245164574" chrome.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3464 schtasks.exe 1688 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3504 chrome.exe 3504 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1388 7zFM.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1388 7zFM.exe Token: 35 1388 7zFM.exe Token: SeSecurityPrivilege 1388 7zFM.exe Token: SeDebugPrivilege 2720 PORQUEPUTASYANOSIRVE.exe Token: SeDebugPrivilege 1704 Client.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 1388 7zFM.exe 1388 7zFM.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1704 Client.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2720 wrote to memory of 3464 2720 PORQUEPUTASYANOSIRVE.exe 89 PID 2720 wrote to memory of 3464 2720 PORQUEPUTASYANOSIRVE.exe 89 PID 2720 wrote to memory of 1704 2720 PORQUEPUTASYANOSIRVE.exe 91 PID 2720 wrote to memory of 1704 2720 PORQUEPUTASYANOSIRVE.exe 91 PID 1704 wrote to memory of 1688 1704 Client.exe 94 PID 1704 wrote to memory of 1688 1704 Client.exe 94 PID 3504 wrote to memory of 2532 3504 chrome.exe 98 PID 3504 wrote to memory of 2532 3504 chrome.exe 98 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 2060 3504 chrome.exe 99 PID 3504 wrote to memory of 3656 3504 chrome.exe 100 PID 3504 wrote to memory of 3656 3504 chrome.exe 100 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 PID 3504 wrote to memory of 3128 3504 chrome.exe 101 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\PORQUEPUTASYANOSIRVE.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1388
-
C:\Users\Admin\Desktop\PORQUEPUTASYANOSIRVE.exe"C:\Users\Admin\Desktop\PORQUEPUTASYANOSIRVE.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3464
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1688
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffc995ccc40,0x7ffc995ccc4c,0x7ffc995ccc582⤵PID:2532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1916 /prefetch:22⤵PID:2060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1800,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=640 /prefetch:32⤵PID:3656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2324,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2504 /prefetch:82⤵PID:3128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:2524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3164,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3748,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4504 /prefetch:12⤵PID:4920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4744,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4788 /prefetch:12⤵PID:4720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3428,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3380 /prefetch:82⤵PID:1724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4452,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4440 /prefetch:82⤵PID:752
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2936
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1288
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD5d2e5f91bdc871f09da53aafc11e33bfc
SHA1873d098b91e1160913d1c6b2585bb43e39bf31da
SHA2567536cad7c9135f4cad1a013f56616edf1e6e65836f176ff0fc21196021c03ce9
SHA5128bca770e60999c532a006e98520c29f1612b802a4cd983dece34d56987a789d8e2e222b10ab20037444987e8bb3bbf7fce08736240031e5690b7b42fe8094982
-
Filesize
215KB
MD52be38925751dc3580e84c3af3a87f98d
SHA18a390d24e6588bef5da1d3db713784c11ca58921
SHA2561412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b
SHA5121341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2
-
Filesize
216B
MD54030efffd101ac109d18822bda477e57
SHA1166bb5a15f3a6ef5e32b1d714075263a9af62aa0
SHA256dbbbd3ce1dd928f7235a4fb5b88a2ffa10cf3828f2dfba8d90b06fa2049abd14
SHA5120b3e1a2e28b2242b1f23d72cb309742dad01b6a9826e7a9753de29703ffeaf5e1297c5011dfbfe56a31cfc80ee66c913670c2ba99e767fd3a95e96f90b1a7734
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD544c0c1fad014ec9b602a7bb95f77d43e
SHA1d38fd45394e8a9b7f1a0cd9fedb8be1f79c8a1f9
SHA25611e772622791cb5046293b2f40bc36fa6340de5ac1ccfa13d1823841dfa7e707
SHA5123040c18f8f3f77b03292b91a4ce4ef01b9b745c4241ef7703bd49daee7b3d3886fdcbc8366d775760c34657d11e5c4495500e7f9ea9fc5f3cbd456ad41d7c826
-
Filesize
9KB
MD5e059d7247b11a862c25cc674e5451a45
SHA197d7fac2f7ca0b97457b9569af6c60a76133d1d8
SHA256bf35c3882b1189e8d0b3bee1e45031a97410bcdf344f9949f0aabb87f30adb48
SHA5122c137087ff747efa9e4484091d45572d9fbcf931fa59523551781f85371820a410f0e47ce290431a2aac49aa7f07fb908fca71ddf824373d23a2fef9c60799be
-
Filesize
9KB
MD52bc980784b80b6280e7e07b292b4cf33
SHA1ab29a38ab92147543eb62ed024bd44a13a928655
SHA2566648def6afea254b398f86cd182bc11607ed0b53c2f9d145c8f87f6f78bfc698
SHA5122970458a0c5e36ad0151b5907fc1cafe29d3e6d4764f8e3621ab57c837e4112addb3e004fd7474082d7da63473b518d4b44173dae23c92f417f0f2775e297615
-
Filesize
15KB
MD5db21bb1520f68a7ca39e741a205d3f51
SHA1cb6d6ba179d7628c369b5932a541301e515d6057
SHA2565a80c185aabb1d313ebdd749e396ee81b961dc6a5a8aec62bcfaeff8926aaec9
SHA512145a6576c68eed827e68967e2e4a0a774f8b15e3a08c0a57e1e6b7024ec565f7daee3c6903e96ad0c5fad67df993d161065c5027ea6326bd7209de3502aeee62
-
Filesize
236KB
MD5c19a26c672278b217d3be3e0feaf34d6
SHA177096e6a20aac4b1ad52fd3d837f9f96906df357
SHA2569ea435878aa9d0fe54f5ee3bb033627a46d07d75117ee5adac3cba7c11efe135
SHA51240620731d2465d6a6008184b6d60442f1f286f14f3b597959026f505a91e1bd1fbad475c5ff877497b2bfef61b8cd9da6ac9c79b72d9f1db1d4f0f51d0db3e49
-
Filesize
3.1MB
MD573565f33ed4d8741291cbb30409f1727
SHA14d3a54b28f3ea80f884a25905e27165bdc353109
SHA256aafe953e627f9e733e101d7211f0c9594dbdf82ec4019b2c9aa361cbc478f0de
SHA512d897b098ddcdc94ac9177bc9a90b700c8b9a7cfafa74f729beebf74a094f76a7bd69e764711bdfedcdd231465daef16e937676e391ca2c010df03fecc863b583