Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 21:50
Static task
static1
Behavioral task
behavioral1
Sample
43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe
-
Size
410KB
-
MD5
56815047f7f330dcb598899915d6606e
-
SHA1
8f20faecf7448606c2601bc03f94a6ed4d7c960b
-
SHA256
43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b
-
SHA512
fbc69c4cb808840209bec0ac52cf29e0442fc80c72dea460ced3dc0ef6e035fef7da9dbd21b8fd1ebebfdf43b02184c65ee73995473fc075bb6ad2de113fba03
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\S-1-5-21-1819626980-2277161760-1023733287-1000\RECOVERaduws.txt
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What's the matter with your files?
Your data was secured using a strong encryption with RSA4096.
Use the link down below to find additional information on the encryption keys using RSA4096:https://en.wikipedia.org/wiki/RSA_(cryptosystem)
What exactly that means?
It means that on a structural level your files have been transformed. You won't be able to use, read, see or work with them anymore.
In other words they are useless, however, there is a possibility to restore them with our help.
What exactly happened to your files?
*** Two personal RSA4096 keys were generated for your PC/Laptop; one key is public, another key is private.
*** All your data and files were encrypted by the means of the public key, which you received over the web.
*** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers.
What should you do next?
There are several options for you to consider:
1. You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or
2. You can start getting BitCoins right now and get access to your data quite fast.
In case you have valuable files, we advise you to act fast as there is no other option rather than paying in order to get back your data.
In order to obtain specific instructions, please access your personal homepage by choosing one of the few addresses down below:
http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/37E76456ECB79F
http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/37E76456ECB79F
http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/37E76456ECB79F
If you can't access your personal homepage or the addresses are not working, complete the following steps:
1. Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en
2. Install TOR Browser
3. Open TOR Browser
4. Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/37E76456ECB79F
5. Follow the steps on your screen
IMPORTANT INFORMATION
Your personal homepages:
http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/37E76456ECB79F
http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/37E76456ECB79F
http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/37E76456ECB79F
Your personal page Tor-Browser k7tlx3ghr3m4n2tu.onion/37E76456ECB79F
Your personal identification ID: 37E76456ECB79F
URLs
http://kkr4hbwdklf234bfl84uoqleflqwrfqwuelfh.brazabaya.com/37E76456ECB79F
http://974gfbjhb23hbfkyfaby3byqlyuebvly5q254y.mendilobo.com/37E76456ECB79F
http://a64gfdsjhb4htbiwaysbdvukyft5q.zobodine.at/37E76456ECB79F
http://k7tlx3ghr3m4n2tu.onion/37E76456ECB79F
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
pid Process 1400 kgudig.exe 1976 kgudig.exe -
Deletes itself 1 IoCs
pid Process 776 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1664 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 1664 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1800 set thread context of 1664 1800 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 27 PID 1400 set thread context of 1976 1400 kgudig.exe 31 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\RECOVERaduws.html kgudig.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png kgudig.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\RECOVERaduws.txt kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\RECOVERaduws.html kgudig.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\RECOVERaduws.html kgudig.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\RECOVERaduws.html kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\RECOVERaduws.html kgudig.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\RECOVERaduws.txt kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\RECOVERaduws.png kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.data\RECOVERaduws.png kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css kgudig.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\RECOVERaduws.txt kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\RECOVERaduws.html kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\RECOVERaduws.png kgudig.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\RECOVERaduws.html kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\RECOVERaduws.txt kgudig.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg kgudig.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\RECOVERaduws.html kgudig.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\RECOVERaduws.html kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\RECOVERaduws.png kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macTSFrame.png kgudig.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt kgudig.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\RECOVERaduws.png kgudig.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png kgudig.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\RECOVERaduws.html kgudig.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\RECOVERaduws.html kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\RECOVERaduws.html kgudig.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\RECOVERaduws.txt kgudig.exe File opened for modification C:\Program Files\Common Files\System\it-IT\RECOVERaduws.txt kgudig.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\RECOVERaduws.png kgudig.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\RECOVERaduws.png kgudig.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\RECOVERaduws.html kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\RECOVERaduws.png kgudig.exe File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\RECOVERaduws.png kgudig.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png kgudig.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\RECOVERaduws.html kgudig.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\RECOVERaduws.png kgudig.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\RECOVERaduws.png kgudig.exe File opened for modification C:\Program Files\DVD Maker\Shared\DissolveNoise.png kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\RECOVERaduws.html kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png kgudig.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\RECOVERaduws.txt kgudig.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\RECOVERaduws.txt kgudig.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\RECOVERaduws.txt kgudig.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\RECOVERaduws.png kgudig.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png kgudig.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png kgudig.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\it.pak kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\RECOVERaduws.html kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png kgudig.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt kgudig.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\RECOVERaduws.txt kgudig.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png kgudig.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\RECOVERaduws.html kgudig.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt kgudig.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt kgudig.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv kgudig.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1336 vssadmin.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\trueimg kgudig.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe 1976 kgudig.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1976 kgudig.exe Token: SeBackupPrivilege 636 vssvc.exe Token: SeRestorePrivilege 636 vssvc.exe Token: SeAuditPrivilege 636 vssvc.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1800 wrote to memory of 1664 1800 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 27 PID 1800 wrote to memory of 1664 1800 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 27 PID 1800 wrote to memory of 1664 1800 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 27 PID 1800 wrote to memory of 1664 1800 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 27 PID 1800 wrote to memory of 1664 1800 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 27 PID 1800 wrote to memory of 1664 1800 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 27 PID 1800 wrote to memory of 1664 1800 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 27 PID 1800 wrote to memory of 1664 1800 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 27 PID 1800 wrote to memory of 1664 1800 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 27 PID 1800 wrote to memory of 1664 1800 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 27 PID 1800 wrote to memory of 1664 1800 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 27 PID 1664 wrote to memory of 1400 1664 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 28 PID 1664 wrote to memory of 1400 1664 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 28 PID 1664 wrote to memory of 1400 1664 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 28 PID 1664 wrote to memory of 1400 1664 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 28 PID 1664 wrote to memory of 776 1664 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 29 PID 1664 wrote to memory of 776 1664 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 29 PID 1664 wrote to memory of 776 1664 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 29 PID 1664 wrote to memory of 776 1664 43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe 29 PID 1400 wrote to memory of 1976 1400 kgudig.exe 31 PID 1400 wrote to memory of 1976 1400 kgudig.exe 31 PID 1400 wrote to memory of 1976 1400 kgudig.exe 31 PID 1400 wrote to memory of 1976 1400 kgudig.exe 31 PID 1400 wrote to memory of 1976 1400 kgudig.exe 31 PID 1400 wrote to memory of 1976 1400 kgudig.exe 31 PID 1400 wrote to memory of 1976 1400 kgudig.exe 31 PID 1400 wrote to memory of 1976 1400 kgudig.exe 31 PID 1400 wrote to memory of 1976 1400 kgudig.exe 31 PID 1400 wrote to memory of 1976 1400 kgudig.exe 31 PID 1400 wrote to memory of 1976 1400 kgudig.exe 31 PID 1976 wrote to memory of 1336 1976 kgudig.exe 32 PID 1976 wrote to memory of 1336 1976 kgudig.exe 32 PID 1976 wrote to memory of 1336 1976 kgudig.exe 32 PID 1976 wrote to memory of 1336 1976 kgudig.exe 32 PID 1976 wrote to memory of 1480 1976 kgudig.exe 36 PID 1976 wrote to memory of 1480 1976 kgudig.exe 36 PID 1976 wrote to memory of 1480 1976 kgudig.exe 36 PID 1976 wrote to memory of 1480 1976 kgudig.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe"C:\Users\Admin\AppData\Local\Temp\43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe"C:\Users\Admin\AppData\Local\Temp\43c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\Documents\kgudig.exeC:\Users\Admin\Documents\kgudig.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\Documents\kgudig.exeC:\Users\Admin\Documents\kgudig.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" Delete Shadows /All /Quiet5⤵
- Interacts with shadow copies
PID:1336
-
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\juanv.bat5⤵PID:1480
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\43C4D8~1.EXE >> NUL3⤵
- Deletes itself
PID:776
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:636
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD504d2d5e62bf08ba848dfef7a1dae5347
SHA104017eb2a205ad24a80a676e9b3b1b6798a6ae54
SHA2560f314b8bccc34be459927f166712f9e5119980db1fb98681b818633a9715ba43
SHA512c85219c26873e0b243bcbf139eeda1adf09c1e9650a2f78233bb55554dccce5022a19b1f7f574b16a2f0df66412b3dbcd01a32e7a1e82e22ac94eef6f3c9b11d
-
Filesize
410KB
MD556815047f7f330dcb598899915d6606e
SHA18f20faecf7448606c2601bc03f94a6ed4d7c960b
SHA25643c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b
SHA512fbc69c4cb808840209bec0ac52cf29e0442fc80c72dea460ced3dc0ef6e035fef7da9dbd21b8fd1ebebfdf43b02184c65ee73995473fc075bb6ad2de113fba03
-
Filesize
410KB
MD556815047f7f330dcb598899915d6606e
SHA18f20faecf7448606c2601bc03f94a6ed4d7c960b
SHA25643c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b
SHA512fbc69c4cb808840209bec0ac52cf29e0442fc80c72dea460ced3dc0ef6e035fef7da9dbd21b8fd1ebebfdf43b02184c65ee73995473fc075bb6ad2de113fba03
-
Filesize
410KB
MD556815047f7f330dcb598899915d6606e
SHA18f20faecf7448606c2601bc03f94a6ed4d7c960b
SHA25643c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b
SHA512fbc69c4cb808840209bec0ac52cf29e0442fc80c72dea460ced3dc0ef6e035fef7da9dbd21b8fd1ebebfdf43b02184c65ee73995473fc075bb6ad2de113fba03
-
Filesize
410KB
MD556815047f7f330dcb598899915d6606e
SHA18f20faecf7448606c2601bc03f94a6ed4d7c960b
SHA25643c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b
SHA512fbc69c4cb808840209bec0ac52cf29e0442fc80c72dea460ced3dc0ef6e035fef7da9dbd21b8fd1ebebfdf43b02184c65ee73995473fc075bb6ad2de113fba03
-
Filesize
410KB
MD556815047f7f330dcb598899915d6606e
SHA18f20faecf7448606c2601bc03f94a6ed4d7c960b
SHA25643c4d8f6942c51587508802dc4a3336de1ae902abb8380a7aeb9b8945ee65c7b
SHA512fbc69c4cb808840209bec0ac52cf29e0442fc80c72dea460ced3dc0ef6e035fef7da9dbd21b8fd1ebebfdf43b02184c65ee73995473fc075bb6ad2de113fba03