Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-12-2024 09:38
Static task
static1
Behavioral task
behavioral1
Sample
FortniteExternal.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
FortniteExternal.exe
Resource
win10v2004-20241007-en
General
-
Target
FortniteExternal.exe
-
Size
37KB
-
MD5
ba116c70830d49029c03acbb2f2fac1b
-
SHA1
ec5de491b7910e25b5bfb7e8803b30186b38a71d
-
SHA256
96391e7351eeec459e219aa35afd521e528eca4bf32d0aaf4ff018392c4894e3
-
SHA512
768328944e44f88fc116376045b934ab251362ea41349ce0c4b968abbb09ce6a3060d70cd75344acb72b6db8c51c164dcf56ac3279ca2e1608bbbbc65b09c410
-
SSDEEP
384:aLi12fprueXnMnUNGNlrFV5ga0gEVjIMDYf4/ERnvawR6KhzVcQSgafw2IwrWGcp:+Im6nUjIMDPEJ5h3X2rjmeCt070H7
Malware Config
Extracted
quasar
1.4.1
Runtime Broker
92.221.125.55:49868
73f0bf3a-83f3-424b-b7a1-a8200df3e317
-
encryption_key
5CB2755608EFDB1313EF4F2ACEA101833F5AEE2B
-
install_name
Runtime Broker.exe
-
log_directory
Logs
-
reconnect_delay
100
-
startup_key
System
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral1/files/0x0006000000019623-1626.dat family_quasar behavioral1/memory/1976-1627-0x0000000001320000-0x0000000001644000-memory.dmp family_quasar behavioral1/memory/1844-1633-0x0000000000220000-0x0000000000544000-memory.dmp family_quasar -
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
pid Process 2732 System64Service.exe 1032 Windows_Updateservices64.exe 2436 Windows_Updateservices64.exe 1208 Process not Found 1976 Windows_Systemservices64.exe 1844 Runtime Broker.exe -
Loads dropped DLL 10 IoCs
pid Process 1860 FortniteExternal.exe 2732 System64Service.exe 2436 Windows_Updateservices64.exe 2436 Windows_Updateservices64.exe 2436 Windows_Updateservices64.exe 2436 Windows_Updateservices64.exe 2436 Windows_Updateservices64.exe 2436 Windows_Updateservices64.exe 2436 Windows_Updateservices64.exe 1208 Process not Found -
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\SubDir Runtime Broker.exe File created C:\windows\system32\Windows_Updateservices64.exe System64Service.exe File opened for modification C:\windows\system32\Windows_Updateservices64.exe System64Service.exe File created C:\windows\system32\Windows_Systemservices64.exe System64Service.exe File opened for modification C:\windows\system32\Windows_Systemservices64.exe System64Service.exe File opened for modification C:\Windows\system32\SubDir\Runtime Broker.exe Runtime Broker.exe File created C:\Windows\system32\System64_Telecom.exe FortniteExternal.exe File opened for modification C:\Windows\system32\System64_Telecom.exe FortniteExternal.exe File created C:\Windows\system32\SubDir\Runtime Broker.exe Windows_Systemservices64.exe File opened for modification C:\Windows\system32\SubDir\Runtime Broker.exe Windows_Systemservices64.exe File opened for modification C:\Windows\system32\SubDir Windows_Systemservices64.exe -
resource yara_rule behavioral1/files/0x00030000000209ad-842.dat upx behavioral1/memory/2436-844-0x000007FEF5BF0000-0x000007FEF6255000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 3 IoCs
pid Process 2640 reg.exe 2344 reg.exe 2160 reg.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 System64Service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde System64Service.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2016 schtasks.exe 780 schtasks.exe 984 schtasks.exe 1784 schtasks.exe 2880 schtasks.exe 3056 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1976 Windows_Systemservices64.exe Token: SeDebugPrivilege 1844 Runtime Broker.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1844 Runtime Broker.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1844 Runtime Broker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1844 Runtime Broker.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1860 wrote to memory of 2852 1860 FortniteExternal.exe 31 PID 1860 wrote to memory of 2852 1860 FortniteExternal.exe 31 PID 1860 wrote to memory of 2852 1860 FortniteExternal.exe 31 PID 2852 wrote to memory of 2880 2852 cmd.exe 32 PID 2852 wrote to memory of 2880 2852 cmd.exe 32 PID 2852 wrote to memory of 2880 2852 cmd.exe 32 PID 1860 wrote to memory of 2732 1860 FortniteExternal.exe 33 PID 1860 wrote to memory of 2732 1860 FortniteExternal.exe 33 PID 1860 wrote to memory of 2732 1860 FortniteExternal.exe 33 PID 2732 wrote to memory of 2828 2732 System64Service.exe 35 PID 2732 wrote to memory of 2828 2732 System64Service.exe 35 PID 2732 wrote to memory of 2828 2732 System64Service.exe 35 PID 2828 wrote to memory of 2640 2828 cmd.exe 37 PID 2828 wrote to memory of 2640 2828 cmd.exe 37 PID 2828 wrote to memory of 2640 2828 cmd.exe 37 PID 2732 wrote to memory of 2632 2732 System64Service.exe 38 PID 2732 wrote to memory of 2632 2732 System64Service.exe 38 PID 2732 wrote to memory of 2632 2732 System64Service.exe 38 PID 2632 wrote to memory of 2344 2632 cmd.exe 40 PID 2632 wrote to memory of 2344 2632 cmd.exe 40 PID 2632 wrote to memory of 2344 2632 cmd.exe 40 PID 2732 wrote to memory of 2744 2732 System64Service.exe 41 PID 2732 wrote to memory of 2744 2732 System64Service.exe 41 PID 2732 wrote to memory of 2744 2732 System64Service.exe 41 PID 2744 wrote to memory of 2160 2744 cmd.exe 43 PID 2744 wrote to memory of 2160 2744 cmd.exe 43 PID 2744 wrote to memory of 2160 2744 cmd.exe 43 PID 2732 wrote to memory of 2616 2732 System64Service.exe 44 PID 2732 wrote to memory of 2616 2732 System64Service.exe 44 PID 2732 wrote to memory of 2616 2732 System64Service.exe 44 PID 2616 wrote to memory of 1652 2616 cmd.exe 46 PID 2616 wrote to memory of 1652 2616 cmd.exe 46 PID 2616 wrote to memory of 1652 2616 cmd.exe 46 PID 2732 wrote to memory of 372 2732 System64Service.exe 47 PID 2732 wrote to memory of 372 2732 System64Service.exe 47 PID 2732 wrote to memory of 372 2732 System64Service.exe 47 PID 372 wrote to memory of 676 372 cmd.exe 49 PID 372 wrote to memory of 676 372 cmd.exe 49 PID 372 wrote to memory of 676 372 cmd.exe 49 PID 2732 wrote to memory of 1316 2732 System64Service.exe 50 PID 2732 wrote to memory of 1316 2732 System64Service.exe 50 PID 2732 wrote to memory of 1316 2732 System64Service.exe 50 PID 1316 wrote to memory of 3056 1316 cmd.exe 52 PID 1316 wrote to memory of 3056 1316 cmd.exe 52 PID 1316 wrote to memory of 3056 1316 cmd.exe 52 PID 2732 wrote to memory of 2940 2732 System64Service.exe 53 PID 2732 wrote to memory of 2940 2732 System64Service.exe 53 PID 2732 wrote to memory of 2940 2732 System64Service.exe 53 PID 2940 wrote to memory of 1092 2940 cmd.exe 55 PID 2940 wrote to memory of 1092 2940 cmd.exe 55 PID 2940 wrote to memory of 1092 2940 cmd.exe 55 PID 2732 wrote to memory of 2592 2732 System64Service.exe 56 PID 2732 wrote to memory of 2592 2732 System64Service.exe 56 PID 2732 wrote to memory of 2592 2732 System64Service.exe 56 PID 2592 wrote to memory of 2924 2592 cmd.exe 58 PID 2592 wrote to memory of 2924 2592 cmd.exe 58 PID 2592 wrote to memory of 2924 2592 cmd.exe 58 PID 2732 wrote to memory of 3036 2732 System64Service.exe 59 PID 2732 wrote to memory of 3036 2732 System64Service.exe 59 PID 2732 wrote to memory of 3036 2732 System64Service.exe 59 PID 3036 wrote to memory of 2016 3036 cmd.exe 61 PID 3036 wrote to memory of 2016 3036 cmd.exe 61 PID 3036 wrote to memory of 2016 3036 cmd.exe 61 PID 2732 wrote to memory of 1200 2732 System64Service.exe 62 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FortniteExternal.exe"C:\Users\Admin\AppData\Local\Temp\FortniteExternal.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /f /tn "System64_Telecom" /tr "C:\Windows\system32\System64_Telecom.exe" /sc onlogon /rl highest >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "System64_Telecom" /tr "C:\Windows\system32\System64_Telecom.exe" /sc onlogon /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
PID:2880
-
-
-
C:\Users\Admin\Documents\System64Service.exe"C:\Users\Admin\Documents\System64Service.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications /v ToastEnabled /t REG_DWORD /d 0 /f > nul 2>&13⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications /v ToastEnabled /t REG_DWORD /d 0 /f4⤵
- Modifies registry key
PID:2640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings /v NOC_GLOBAL_SETTING_ALLOW_TOASTS_ABOVE_LOCK /t REG_DWORD /d 0 /f > nul 2>&13⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings /v NOC_GLOBAL_SETTING_ALLOW_TOASTS_ABOVE_LOCK /t REG_DWORD /d 0 /f4⤵
- Modifies registry key
PID:2344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKCU\Software\Policies\Microsoft\Windows\Explorer /v DisableNotificationCenter /t REG_DWORD /d 1 /f > nul 2>&13⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\system32\reg.exereg add HKCU\Software\Policies\Microsoft\Windows\Explorer /v DisableNotificationCenter /t REG_DWORD /d 1 /f4⤵
- Modifies registry key
PID:2160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /query /tn "Windows_Updateservices64" >nul 2>&13⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\system32\schtasks.exeschtasks /query /tn "Windows_Updateservices64"4⤵PID:1652
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /query /tn "Windows_Updateservices64" >nul 2>&13⤵
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\system32\schtasks.exeschtasks /query /tn "Windows_Updateservices64"4⤵PID:676
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /f /tn "Windows_Updateservices64" /tr "C:\windows\system32\Windows_Updateservices64.exe" /sc onlogon /rl highest >nul 2>&13⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "Windows_Updateservices64" /tr "C:\windows\system32\Windows_Updateservices64.exe" /sc onlogon /rl highest4⤵
- Scheduled Task/Job: Scheduled Task
PID:3056
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /query /tn "Windows_Systemservices64" >nul 2>&13⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\system32\schtasks.exeschtasks /query /tn "Windows_Systemservices64"4⤵PID:1092
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /query /tn "Windows_Systemservices64" >nul 2>&13⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\system32\schtasks.exeschtasks /query /tn "Windows_Systemservices64"4⤵PID:2924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /f /tn "Windows_Systemservices64" /tr "C:\windows\system32\Windows_Systemservices64.exe" /sc onlogon /rl highest >nul 2>&13⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "Windows_Systemservices64" /tr "C:\windows\system32\Windows_Systemservices64.exe" /sc onlogon /rl highest4⤵
- Scheduled Task/Job: Scheduled Task
PID:2016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /query /tn "System32HealthMonitor" >nul 2>&13⤵PID:1200
-
C:\Windows\system32\schtasks.exeschtasks /query /tn "System32HealthMonitor"4⤵PID:2116
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /query /tn "System32HealthMonitor" >nul 2>&13⤵PID:840
-
C:\Windows\system32\schtasks.exeschtasks /query /tn "System32HealthMonitor"4⤵PID:1772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /f /tn "System32HealthMonitor" /tr "C:\windows\system32\System32HealthMonitor.exe" /sc onlogon /rl highest >nul 2>&13⤵PID:2120
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "System32HealthMonitor" /tr "C:\windows\system32\System32HealthMonitor.exe" /sc onlogon /rl highest4⤵
- Scheduled Task/Job: Scheduled Task
PID:780
-
-
-
C:\windows\system32\Windows_Updateservices64.exeC:\windows\system32\Windows_Updateservices64.exe3⤵
- Executes dropped EXE
PID:1032 -
C:\windows\system32\Windows_Updateservices64.exeC:\windows\system32\Windows_Updateservices64.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436
-
-
-
C:\windows\system32\Windows_Systemservices64.exeC:\windows\system32\Windows_Systemservices64.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1976 -
C:\windows\system32\schtasks.exe"schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Runtime Broker.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
PID:984
-
-
C:\Windows\system32\SubDir\Runtime Broker.exe"C:\Windows\system32\SubDir\Runtime Broker.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1844 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Runtime Broker.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
PID:1784
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD567e486b2f148a3fca863728242b6273e
SHA1452a84c183d7ea5b7c015b597e94af8eef66d44a
SHA256facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb
SHA512d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e
-
Filesize
436B
MD5971c514f84bba0785f80aa1c23edfd79
SHA1732acea710a87530c6b08ecdf32a110d254a54c8
SHA256f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA51243dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize174B
MD5252dedc21006198a70f5a0df2aa4925a
SHA1a7ded3d99bb410016de179daef67bda99f4ac29f
SHA25692b638f25bf8fcd796c1b5be1edb8f8eeb394189ac950a6cc8538e4c3d9152b7
SHA512145e5e35b8870106aada551d3772e8bf041984e4d263fd12af9bf51e861857f1500575516efba9dfc2e769b708bfc5c7de25e7cc7827181b09c4dcec0d4c4a40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Filesize170B
MD576d9c1b2f9080fa847aa077883d157b2
SHA196f83433ce78da1ec4940504c30f928775055677
SHA2568b27bb1ae2560735068e11fe24b3f3cec9a7e0727a435e792f2a4298fa6baf00
SHA51228585a2298139c5d3b47ca86616f5e6cf4a7dc5722df8c9652a0b47136c119abf8dc40afb436f98139c7b77c92d5e2550fc8402f69ec60c1262f3544644db9f1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
21KB
MD51c58526d681efe507deb8f1935c75487
SHA10e6d328faf3563f2aae029bc5f2272fb7a742672
SHA256ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
SHA5128edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1
-
Filesize
18KB
MD5bfffa7117fd9b1622c66d949bac3f1d7
SHA1402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA2561ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f
-
Filesize
21KB
MD5724223109e49cb01d61d63a8be926b8f
SHA1072a4d01e01dbbab7281d9bd3add76f9a3c8b23b
SHA2564e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210
SHA51219b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c
-
Filesize
21KB
MD5517eb9e2cb671ae49f99173d7f7ce43f
SHA14ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab
SHA25657cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54
SHA512492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be
-
Filesize
1.8MB
MD51490ed147cdd2c2fb09259d2b6c42161
SHA111c639b79b11d6c6d2a5910e602b199e8c63fffe
SHA256c47c6432c0c202e885b344a18dcb4e392999c9a78eb987720b48e0fcff2e6a61
SHA5121f086ab3e2029ad450a9be92d3e367342b6eed52e7581647e7b88596a1cbee1d9b478c41ce956396e4056974f1f3fe148192828bad3613ab58ed2c3e758b8a03
-
Filesize
4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
Filesize
992KB
MD50e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA14189f4459c54e69c6d3155a82524bda7549a75a6
SHA2568a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd
-
Filesize
35KB
MD590957299e9047efc9634f190eff4f693
SHA10292c0f3389eae94e29a9d890a5518e142db5096
SHA256a616be7d091cc959e4db7fc74fe52998ef675309af83e459282cda0828fa03b6
SHA512109ba2d4ae56cad1226603cc9864d2e40c6fe7d4413cd9b8ffa185b0252ae69e81163bda4298fb198b1e58456eb4d7ee7487db7bde0ec76ea1273d821a094513
-
Filesize
3.1MB
MD552025b6114feff994df431c8a0a5c9ae
SHA14b0e9178616c83f68f45775eaacace6027dd42c2
SHA2568c5c09639035ecd95ba08dd6aae713443b3f45614e1fde653b2d6f45156b4e7b
SHA51203ee1109f2d0e79620f7f9fee61411762842cc77ccbc1bc25e98c97278e4ee7745d5e3d46d165761ba5134e228e45c270b1d05cdbda6fef51a3409b8e9cdb73f
-
Filesize
21KB
MD5d12403ee11359259ba2b0706e5e5111c
SHA103cc7827a30fd1dee38665c0cc993b4b533ac138
SHA256f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781
SHA5129004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0