Analysis
-
max time kernel
188s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-06-2022 13:41
Static task
static1
Behavioral task
behavioral1
Sample
29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe
-
Size
608KB
-
MD5
06f298ca1b04905975e45371d6594fbf
-
SHA1
6046763379a81c4be4cc733f750429f28f8892dd
-
SHA256
29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583
-
SHA512
4f0144b47f7ce29908dedb1669fb58e94508e8c7af9ab0be04a61442b9f73765ace6bb604349b61ebdffaf68c77021b72e6848f48faead75826549fd7976e640
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\S-1-5-21-2632097139-1792035885-811742494-1000\RECOVER+seekg.TXT
Ransom Note
__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA-4096.
More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA-4096 KEY, both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.
What do I do ?
So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way.
If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment.
For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1. http://akdfrefdkm45tf33fsdfsdf.yamenswash.com/6AB85974F3829A73
2. http://p4fhmjnsdfbm4w4fdsc.avowvoice.com/6AB85974F3829A73
3. http://nn54djhfnrnm4dnjnerfsd.replylaten.at/6AB85974F3829A73
If for some reasons the addresses are not available, follow these steps:
1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2. After a successful installation, run the browser and wait for initialization
3. Type in the address bar: fwgrhsao3aoml7ej.onion/6AB85974F3829A73
4. Follow the instructions on the site.
!!! IMPORTANT INFORMATION:
!!! Your personal pages:
http://akdfrefdkm45tf33fsdfsdf.yamenswash.com/6AB85974F3829A73
http://p4fhmjnsdfbm4w4fdsc.avowvoice.com/6AB85974F3829A73
http://nn54djhfnrnm4dnjnerfsd.replylaten.at/6AB85974F3829A73
!!! Your personal page Tor-Browser: fwgrhsao3aoml7ej.onion/6AB85974F3829A73
!!! Your personal identification ID: 6AB85974F3829A73
URLs
http://akdfrefdkm45tf33fsdfsdf.yamenswash.com/6AB85974F3829A73
http://p4fhmjnsdfbm4w4fdsc.avowvoice.com/6AB85974F3829A73
http://nn54djhfnrnm4dnjnerfsd.replylaten.at/6AB85974F3829A73
http://fwgrhsao3aoml7ej.onion/6AB85974F3829A73
Signatures
-
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 3 IoCs
pid Process 4236 jrsyuttid.exe 3152 jrsyuttid.exe 2192 myggi.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation myggi.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run jrsyuttid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\addon_v57 = "C:\\Windows\\jrsyuttid.exe" jrsyuttid.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3432 set thread context of 4264 3432 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 85 PID 4236 set thread context of 3152 4236 jrsyuttid.exe 89 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\RECOVER+seekg.HTM jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lv-LV\RECOVER+seekg.HTM jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Triedit\en-US\RECOVER+seekg.HTM jrsyuttid.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\RECOVER+seekg.HTM jrsyuttid.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\RECOVER+seekg.HTM jrsyuttid.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ar.pak jrsyuttid.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt jrsyuttid.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt jrsyuttid.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\RECOVER+seekg.HTM jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\RECOVER+seekg.TXT jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\RECOVER+seekg.TXT jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\he-IL\RECOVER+seekg.PNG jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nb-NO\RECOVER+seekg.PNG jrsyuttid.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\RECOVER+seekg.PNG jrsyuttid.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt jrsyuttid.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt jrsyuttid.exe File opened for modification C:\Program Files\Common Files\System\de-DE\RECOVER+seekg.HTM jrsyuttid.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\sw.pak jrsyuttid.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt jrsyuttid.exe File opened for modification C:\Program Files\Common Files\DESIGNER\RECOVER+seekg.HTM jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\RECOVER+seekg.HTM jrsyuttid.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\RECOVER+seekg.TXT jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\RECOVER+seekg.TXT jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\et-EE\RECOVER+seekg.TXT jrsyuttid.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\RECOVER+seekg.TXT jrsyuttid.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\nb.pak jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VGX\RECOVER+seekg.TXT jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-MX\RECOVER+seekg.PNG jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\RECOVER+seekg.TXT jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hr-HR\RECOVER+seekg.HTM jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-BR\RECOVER+seekg.TXT jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ro-RO\RECOVER+seekg.HTM jrsyuttid.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sk-SK\RECOVER+seekg.PNG jrsyuttid.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\pt-BR.pak jrsyuttid.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ja.pak jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\RECOVER+seekg.HTM jrsyuttid.exe File opened for modification C:\Program Files\Common Files\Services\RECOVER+seekg.TXT jrsyuttid.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\RECOVER+seekg.HTM jrsyuttid.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\sv.pak jrsyuttid.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt jrsyuttid.exe File opened for modification C:\Program Files\Common Files\System\it-IT\RECOVER+seekg.PNG jrsyuttid.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\RECOVER+seekg.HTM jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\RECOVER+seekg.PNG jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\RECOVER+seekg.PNG jrsyuttid.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\RECOVER+seekg.TXT jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\RECOVER+seekg.HTM jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\RECOVER+seekg.PNG jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ru-RU\RECOVER+seekg.PNG jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\RECOVER+seekg.HTM jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\RECOVER+seekg.TXT jrsyuttid.exe File opened for modification C:\Program Files\Common Files\DESIGNER\RECOVER+seekg.PNG jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\he-IL\RECOVER+seekg.TXT jrsyuttid.exe File opened for modification C:\Program Files\Common Files\RECOVER+seekg.TXT jrsyuttid.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\lv.pak jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\RECOVER+seekg.PNG jrsyuttid.exe File opened for modification C:\Program Files\Common Files\System\RECOVER+seekg.TXT jrsyuttid.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\da.pak jrsyuttid.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\fil.pak jrsyuttid.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\it.pak jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\RECOVER+seekg.TXT jrsyuttid.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Triedit\en-US\RECOVER+seekg.TXT jrsyuttid.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt jrsyuttid.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\jrsyuttid.exe 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe File created C:\Windows\jrsyuttid.exe 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1292 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe 3152 jrsyuttid.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4264 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe Token: SeDebugPrivilege 3152 jrsyuttid.exe Token: SeBackupPrivilege 3384 vssvc.exe Token: SeRestorePrivilege 3384 vssvc.exe Token: SeAuditPrivilege 3384 vssvc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3432 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 4236 jrsyuttid.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 3432 wrote to memory of 4264 3432 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 85 PID 3432 wrote to memory of 4264 3432 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 85 PID 3432 wrote to memory of 4264 3432 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 85 PID 3432 wrote to memory of 4264 3432 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 85 PID 3432 wrote to memory of 4264 3432 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 85 PID 3432 wrote to memory of 4264 3432 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 85 PID 3432 wrote to memory of 4264 3432 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 85 PID 3432 wrote to memory of 4264 3432 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 85 PID 3432 wrote to memory of 4264 3432 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 85 PID 3432 wrote to memory of 4264 3432 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 85 PID 4264 wrote to memory of 4236 4264 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 86 PID 4264 wrote to memory of 4236 4264 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 86 PID 4264 wrote to memory of 4236 4264 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 86 PID 4264 wrote to memory of 4592 4264 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 87 PID 4264 wrote to memory of 4592 4264 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 87 PID 4264 wrote to memory of 4592 4264 29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe 87 PID 4236 wrote to memory of 3152 4236 jrsyuttid.exe 89 PID 4236 wrote to memory of 3152 4236 jrsyuttid.exe 89 PID 4236 wrote to memory of 3152 4236 jrsyuttid.exe 89 PID 4236 wrote to memory of 3152 4236 jrsyuttid.exe 89 PID 4236 wrote to memory of 3152 4236 jrsyuttid.exe 89 PID 4236 wrote to memory of 3152 4236 jrsyuttid.exe 89 PID 4236 wrote to memory of 3152 4236 jrsyuttid.exe 89 PID 4236 wrote to memory of 3152 4236 jrsyuttid.exe 89 PID 4236 wrote to memory of 3152 4236 jrsyuttid.exe 89 PID 4236 wrote to memory of 3152 4236 jrsyuttid.exe 89 PID 3152 wrote to memory of 2192 3152 jrsyuttid.exe 90 PID 3152 wrote to memory of 2192 3152 jrsyuttid.exe 90 PID 3152 wrote to memory of 2192 3152 jrsyuttid.exe 90 PID 2192 wrote to memory of 1292 2192 myggi.exe 91 PID 2192 wrote to memory of 1292 2192 myggi.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe"C:\Users\Admin\AppData\Local\Temp\29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe"C:\Users\Admin\AppData\Local\Temp\29a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583.exe"2⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\jrsyuttid.exeC:\Windows\jrsyuttid.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\jrsyuttid.exeC:\Windows\jrsyuttid.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\Documents\myggi.exeC:\Users\Admin\Documents\myggi.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet6⤵
- Interacts with shadow copies
PID:1292
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\29A895~1.EXE3⤵PID:4592
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3384
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD59dfc75037c8deccc2f1840b249b17750
SHA1ee37e409cfe2b124e63f98f1797aec0330204b82
SHA256b5680fd682b7f64e577492c097c825e4a5a00baa82a8668f478640c5f8918da1
SHA51225e9f3546af040f3cf782b4d6c511517ac0c95cfff8b3afec407c5917427f3129c92495f95873fb67ad928a9c7ef234508ecc9ffd8835da260d8fd1e64ead16e
-
Filesize
3KB
MD59dfc75037c8deccc2f1840b249b17750
SHA1ee37e409cfe2b124e63f98f1797aec0330204b82
SHA256b5680fd682b7f64e577492c097c825e4a5a00baa82a8668f478640c5f8918da1
SHA51225e9f3546af040f3cf782b4d6c511517ac0c95cfff8b3afec407c5917427f3129c92495f95873fb67ad928a9c7ef234508ecc9ffd8835da260d8fd1e64ead16e
-
Filesize
608KB
MD506f298ca1b04905975e45371d6594fbf
SHA16046763379a81c4be4cc733f750429f28f8892dd
SHA25629a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583
SHA5124f0144b47f7ce29908dedb1669fb58e94508e8c7af9ab0be04a61442b9f73765ace6bb604349b61ebdffaf68c77021b72e6848f48faead75826549fd7976e640
-
Filesize
608KB
MD506f298ca1b04905975e45371d6594fbf
SHA16046763379a81c4be4cc733f750429f28f8892dd
SHA25629a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583
SHA5124f0144b47f7ce29908dedb1669fb58e94508e8c7af9ab0be04a61442b9f73765ace6bb604349b61ebdffaf68c77021b72e6848f48faead75826549fd7976e640
-
Filesize
608KB
MD506f298ca1b04905975e45371d6594fbf
SHA16046763379a81c4be4cc733f750429f28f8892dd
SHA25629a895e02f76f777c976eb865f8a8d49c2e721223bd3c98d8f4f60a8c96b9583
SHA5124f0144b47f7ce29908dedb1669fb58e94508e8c7af9ab0be04a61442b9f73765ace6bb604349b61ebdffaf68c77021b72e6848f48faead75826549fd7976e640