Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
81s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/10/2022, 20:01
Static task
static1
Behavioral task
behavioral1
Sample
5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe
Resource
win7-20220812-en
General
-
Target
5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe
-
Size
540KB
-
MD5
60ac1843cc126d243721e7739f704bbf
-
SHA1
acf60750c5e5aa79759c26e6b2cbb1e573181dcf
-
SHA256
5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076
-
SHA512
63b000df53636ae9c83fcf345e4f293a22a16a49bd79291d5ae794b71286c635658e82f2e2394032a95aa6abf438ad79d9d145e26d1b0ba060f597c314119acd
-
SSDEEP
12288:SCeZPb6rNio2MY+c2TlbRcdTgioCL2oK764d5o0R6CUqxtKUlR:fRcd0ioCLUv/o0R6C5xtr/
Malware Config
Extracted
cybergate
2.6
Server
panik0.no-ip.org:2000
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
spynet
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe" 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\spynet\\server.exe" 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe -
Executes dropped EXE 3 IoCs
pid Process 1608 server.exe 968 server.exe 1976 server.exe -
resource yara_rule behavioral1/memory/1700-67-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1700-69-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1700-70-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1700-74-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1700-76-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1700-77-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1700-78-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1700-80-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/1700-89-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1224-94-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1224-95-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1700-97-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral1/memory/1700-105-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1700-111-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/584-110-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/584-112-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1976-142-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1976-141-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1976-143-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1224-144-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1976-145-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/584-146-0x0000000024160000-0x00000000241C2000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 584 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 584 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\spynet\\server.exe" 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\spynet\ 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe File created C:\Windows\SysWOW64\spynet\server.exe 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe File opened for modification C:\Windows\SysWOW64\spynet\server.exe 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe File opened for modification C:\Windows\SysWOW64\spynet\server.exe 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1992 set thread context of 1972 1992 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 26 PID 1972 set thread context of 1700 1972 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 27 PID 1608 set thread context of 968 1608 server.exe 32 PID 968 set thread context of 1976 968 server.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 1976 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 584 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 584 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe Token: SeDebugPrivilege 584 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1992 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 1972 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 1608 server.exe 968 server.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1972 1992 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 26 PID 1992 wrote to memory of 1972 1992 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 26 PID 1992 wrote to memory of 1972 1992 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 26 PID 1992 wrote to memory of 1972 1992 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 26 PID 1992 wrote to memory of 1972 1992 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 26 PID 1992 wrote to memory of 1972 1992 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 26 PID 1992 wrote to memory of 1972 1992 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 26 PID 1992 wrote to memory of 1972 1992 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 26 PID 1992 wrote to memory of 1972 1992 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 26 PID 1972 wrote to memory of 1700 1972 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 27 PID 1972 wrote to memory of 1700 1972 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 27 PID 1972 wrote to memory of 1700 1972 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 27 PID 1972 wrote to memory of 1700 1972 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 27 PID 1972 wrote to memory of 1700 1972 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 27 PID 1972 wrote to memory of 1700 1972 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 27 PID 1972 wrote to memory of 1700 1972 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 27 PID 1972 wrote to memory of 1700 1972 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 27 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11 PID 1700 wrote to memory of 1192 1700 5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe 11
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe"C:\Users\Admin\AppData\Local\Temp\5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exeC:\Users\Admin\AppData\Local\Temp\5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exeC:\Users\Admin\AppData\Local\Temp\5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe4⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe5⤵PID:1224
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2036
-
-
C:\Users\Admin\AppData\Local\Temp\5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe"C:\Users\Admin\AppData\Local\Temp\5e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076.exe"5⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:584 -
C:\Windows\SysWOW64\spynet\server.exe"C:\Windows\system32\spynet\server.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1608 -
C:\Windows\SysWOW64\spynet\server.exeC:\Windows\SysWOW64\spynet\server.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:968 -
C:\Windows\SysWOW64\spynet\server.exeC:\Windows\SysWOW64\spynet\server.exe8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1976
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD5901f5657426558bb410202051200b4b5
SHA1afaf3894559ca2e2ed62fd167e7b4eba9308f5fd
SHA2560ac9ee60047d3c862fdfdf6083e8f7a7feeb4018aeef4fa1ed33f45fd232d3e5
SHA51258b31b09f76d7f0079103488d1c99d995d25df4d881870fef295633880dad435f58f0c619b5e1749002fb90ad6c7f5deab870237da4289b1cd9a8e8f730a116a
-
Filesize
201B
MD5e6931696a293309856fb0dd79a26045c
SHA1b6f2396760a0c592340aa99008af3619a6130410
SHA25601be0c5471962da7687728f5a063a5857bf5203f9813e81a0fb23ef4dca87dda
SHA5129044829afccf78533e13f1d241392ee650702acd70e48d5376384a0d49c89999df93442115eccc4f6fb625d27733b0fa8c3c7292001c6a6558a4fd8be5825a66
-
Filesize
540KB
MD560ac1843cc126d243721e7739f704bbf
SHA1acf60750c5e5aa79759c26e6b2cbb1e573181dcf
SHA2565e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076
SHA51263b000df53636ae9c83fcf345e4f293a22a16a49bd79291d5ae794b71286c635658e82f2e2394032a95aa6abf438ad79d9d145e26d1b0ba060f597c314119acd
-
Filesize
540KB
MD560ac1843cc126d243721e7739f704bbf
SHA1acf60750c5e5aa79759c26e6b2cbb1e573181dcf
SHA2565e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076
SHA51263b000df53636ae9c83fcf345e4f293a22a16a49bd79291d5ae794b71286c635658e82f2e2394032a95aa6abf438ad79d9d145e26d1b0ba060f597c314119acd
-
Filesize
540KB
MD560ac1843cc126d243721e7739f704bbf
SHA1acf60750c5e5aa79759c26e6b2cbb1e573181dcf
SHA2565e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076
SHA51263b000df53636ae9c83fcf345e4f293a22a16a49bd79291d5ae794b71286c635658e82f2e2394032a95aa6abf438ad79d9d145e26d1b0ba060f597c314119acd
-
Filesize
540KB
MD560ac1843cc126d243721e7739f704bbf
SHA1acf60750c5e5aa79759c26e6b2cbb1e573181dcf
SHA2565e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076
SHA51263b000df53636ae9c83fcf345e4f293a22a16a49bd79291d5ae794b71286c635658e82f2e2394032a95aa6abf438ad79d9d145e26d1b0ba060f597c314119acd
-
Filesize
540KB
MD560ac1843cc126d243721e7739f704bbf
SHA1acf60750c5e5aa79759c26e6b2cbb1e573181dcf
SHA2565e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076
SHA51263b000df53636ae9c83fcf345e4f293a22a16a49bd79291d5ae794b71286c635658e82f2e2394032a95aa6abf438ad79d9d145e26d1b0ba060f597c314119acd
-
Filesize
540KB
MD560ac1843cc126d243721e7739f704bbf
SHA1acf60750c5e5aa79759c26e6b2cbb1e573181dcf
SHA2565e9f5a1034f680865f7c0a7c655c9d5ef631b981c029b4f6fae39b4d311cf076
SHA51263b000df53636ae9c83fcf345e4f293a22a16a49bd79291d5ae794b71286c635658e82f2e2394032a95aa6abf438ad79d9d145e26d1b0ba060f597c314119acd