Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 16:52
Static task
static1
Behavioral task
behavioral1
Sample
44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe
Resource
win7-20220812-en
windows7-x64
20 signatures
150 seconds
General
-
Target
44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe
-
Size
667KB
-
MD5
300e3f51957787fe3a0a27572a80ad20
-
SHA1
b2ddf592123cba982e04199f759a902f61f40b44
-
SHA256
44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460
-
SHA512
27170c020b651a172707b0be18b0fc875a294dca53a9e86c464bf115f629cab9caa13bbd58ba4636103e5164628050d89171e5697e125d5269f400ca622d1b12
-
SSDEEP
6144:uRC0LS6V23ltSpcW3Go+jE7RkCrphFbaSKh8KBQexaZm:uRC0OqAnSCW29ARkghNvGYeoZm
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1940 WaterMark.exe -
resource yara_rule behavioral1/memory/564-55-0x0000000002660000-0x00000000036EE000-memory.dmp upx behavioral1/memory/564-58-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/564-59-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/564-64-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/564-66-0x0000000002660000-0x00000000036EE000-memory.dmp upx behavioral1/memory/1940-82-0x0000000000400000-0x00000000004B2000-memory.dmp upx behavioral1/memory/1940-144-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\WaterMark.exe 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7z.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\pxC51.tmp 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe 1940 WaterMark.exe 1940 WaterMark.exe 1940 WaterMark.exe 1940 WaterMark.exe 1940 WaterMark.exe 1940 WaterMark.exe 1940 WaterMark.exe 1940 WaterMark.exe 1136 svchost.exe 1136 svchost.exe 1136 svchost.exe 1136 svchost.exe 1136 svchost.exe 1136 svchost.exe 1136 svchost.exe 1136 svchost.exe 1136 svchost.exe 1136 svchost.exe 1136 svchost.exe 1136 svchost.exe 1136 svchost.exe 1136 svchost.exe 1136 svchost.exe 1136 svchost.exe 1136 svchost.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe Token: SeDebugPrivilege 1940 WaterMark.exe Token: SeDebugPrivilege 1136 svchost.exe Token: SeDebugPrivilege 1940 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe 1940 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 564 wrote to memory of 1120 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe 11 PID 564 wrote to memory of 1172 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe 19 PID 564 wrote to memory of 1236 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe 18 PID 564 wrote to memory of 1940 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe 27 PID 564 wrote to memory of 1940 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe 27 PID 564 wrote to memory of 1940 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe 27 PID 564 wrote to memory of 1940 564 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe 27 PID 1940 wrote to memory of 960 1940 WaterMark.exe 28 PID 1940 wrote to memory of 960 1940 WaterMark.exe 28 PID 1940 wrote to memory of 960 1940 WaterMark.exe 28 PID 1940 wrote to memory of 960 1940 WaterMark.exe 28 PID 1940 wrote to memory of 960 1940 WaterMark.exe 28 PID 1940 wrote to memory of 960 1940 WaterMark.exe 28 PID 1940 wrote to memory of 960 1940 WaterMark.exe 28 PID 1940 wrote to memory of 960 1940 WaterMark.exe 28 PID 1940 wrote to memory of 960 1940 WaterMark.exe 28 PID 1940 wrote to memory of 960 1940 WaterMark.exe 28 PID 1940 wrote to memory of 1136 1940 WaterMark.exe 29 PID 1940 wrote to memory of 1136 1940 WaterMark.exe 29 PID 1940 wrote to memory of 1136 1940 WaterMark.exe 29 PID 1940 wrote to memory of 1136 1940 WaterMark.exe 29 PID 1940 wrote to memory of 1136 1940 WaterMark.exe 29 PID 1940 wrote to memory of 1136 1940 WaterMark.exe 29 PID 1940 wrote to memory of 1136 1940 WaterMark.exe 29 PID 1940 wrote to memory of 1136 1940 WaterMark.exe 29 PID 1940 wrote to memory of 1136 1940 WaterMark.exe 29 PID 1940 wrote to memory of 1136 1940 WaterMark.exe 29 PID 1136 wrote to memory of 260 1136 svchost.exe 7 PID 1136 wrote to memory of 260 1136 svchost.exe 7 PID 1136 wrote to memory of 260 1136 svchost.exe 7 PID 1136 wrote to memory of 260 1136 svchost.exe 7 PID 1136 wrote to memory of 260 1136 svchost.exe 7 PID 1136 wrote to memory of 336 1136 svchost.exe 6 PID 1136 wrote to memory of 336 1136 svchost.exe 6 PID 1136 wrote to memory of 336 1136 svchost.exe 6 PID 1136 wrote to memory of 336 1136 svchost.exe 6 PID 1136 wrote to memory of 336 1136 svchost.exe 6 PID 1136 wrote to memory of 372 1136 svchost.exe 5 PID 1136 wrote to memory of 372 1136 svchost.exe 5 PID 1136 wrote to memory of 372 1136 svchost.exe 5 PID 1136 wrote to memory of 372 1136 svchost.exe 5 PID 1136 wrote to memory of 372 1136 svchost.exe 5 PID 1136 wrote to memory of 380 1136 svchost.exe 2 PID 1136 wrote to memory of 380 1136 svchost.exe 2 PID 1136 wrote to memory of 380 1136 svchost.exe 2 PID 1136 wrote to memory of 380 1136 svchost.exe 2 PID 1136 wrote to memory of 380 1136 svchost.exe 2 PID 1136 wrote to memory of 412 1136 svchost.exe 1 PID 1136 wrote to memory of 412 1136 svchost.exe 1 PID 1136 wrote to memory of 412 1136 svchost.exe 1 PID 1136 wrote to memory of 412 1136 svchost.exe 1 PID 1136 wrote to memory of 412 1136 svchost.exe 1 PID 1136 wrote to memory of 464 1136 svchost.exe 4 PID 1136 wrote to memory of 464 1136 svchost.exe 4 PID 1136 wrote to memory of 464 1136 svchost.exe 4 PID 1136 wrote to memory of 464 1136 svchost.exe 4 PID 1136 wrote to memory of 464 1136 svchost.exe 4 PID 1136 wrote to memory of 480 1136 svchost.exe 3 PID 1136 wrote to memory of 480 1136 svchost.exe 3 PID 1136 wrote to memory of 480 1136 svchost.exe 3 PID 1136 wrote to memory of 480 1136 svchost.exe 3 PID 1136 wrote to memory of 480 1136 svchost.exe 3 PID 1136 wrote to memory of 488 1136 svchost.exe 8 PID 1136 wrote to memory of 488 1136 svchost.exe 8 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:412
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:480
-
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:464
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:756
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:884
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:1796
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1120
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:1792
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:536
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1088
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:1028
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:292
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:852
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:816
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:680
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:604
-
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:488
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:372
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:336
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:260
-
C:\Users\Admin\AppData\Local\Temp\44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe"C:\Users\Admin\AppData\Local\Temp\44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe"1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:564 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
PID:960
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1236
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
667KB
MD5300e3f51957787fe3a0a27572a80ad20
SHA1b2ddf592123cba982e04199f759a902f61f40b44
SHA25644c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460
SHA51227170c020b651a172707b0be18b0fc875a294dca53a9e86c464bf115f629cab9caa13bbd58ba4636103e5164628050d89171e5697e125d5269f400ca622d1b12
-
Filesize
667KB
MD5300e3f51957787fe3a0a27572a80ad20
SHA1b2ddf592123cba982e04199f759a902f61f40b44
SHA25644c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460
SHA51227170c020b651a172707b0be18b0fc875a294dca53a9e86c464bf115f629cab9caa13bbd58ba4636103e5164628050d89171e5697e125d5269f400ca622d1b12
-
Filesize
667KB
MD5300e3f51957787fe3a0a27572a80ad20
SHA1b2ddf592123cba982e04199f759a902f61f40b44
SHA25644c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460
SHA51227170c020b651a172707b0be18b0fc875a294dca53a9e86c464bf115f629cab9caa13bbd58ba4636103e5164628050d89171e5697e125d5269f400ca622d1b12
-
Filesize
667KB
MD5300e3f51957787fe3a0a27572a80ad20
SHA1b2ddf592123cba982e04199f759a902f61f40b44
SHA25644c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460
SHA51227170c020b651a172707b0be18b0fc875a294dca53a9e86c464bf115f629cab9caa13bbd58ba4636103e5164628050d89171e5697e125d5269f400ca622d1b12