Analysis
-
max time kernel
166s -
max time network
182s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
21/10/2022, 07:10
Static task
static1
Behavioral task
behavioral1
Sample
9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe
Resource
win10v2004-20220812-en
General
-
Target
9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe
-
Size
460KB
-
MD5
531590abb6298342e1ea7f7cf582f560
-
SHA1
3211be2f4e1103860dd85d5eaf8f1886be1214f2
-
SHA256
9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
-
SHA512
57220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
SSDEEP
6144:dBJ46bsarHBnVSdGhFkan0TTmLc+wjQPSDV+rvI28bx81VRO9rqQ9pUfhM7raMoj:d9bJx8TmLFu22x8jRO0Q9bun6fY
Malware Config
Extracted
cybergate
v1.02.1
domdom2121
176.240.164.204:2121
95.6.97.198:2121
Pluguin
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Microsoft
-
install_file
Pluguin.exe
-
install_flag
false
-
keylogger_enable_ftp
false
-
message_box_caption
VOCÊ FOI HACKEADO ...SEU SISTEMA SERÁ FORMATADO.
-
message_box_title
LAMMER
-
password
21212121
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 1684 server.exe 336 server.exe 1312 server.exe 1700 server.exe 1532 server.exe -
resource yara_rule behavioral1/memory/336-83-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/336-85-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/336-86-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/336-92-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/336-97-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/336-98-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/336-102-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/336-104-0x0000000024010000-0x0000000024070000-memory.dmp upx behavioral1/memory/336-113-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral1/memory/1292-118-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral1/memory/1292-120-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral1/memory/336-129-0x00000000240D0000-0x0000000024130000-memory.dmp upx behavioral1/memory/336-135-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1312-134-0x00000000240D0000-0x0000000024130000-memory.dmp upx behavioral1/memory/1312-143-0x0000000005150000-0x0000000005297000-memory.dmp upx behavioral1/memory/1312-149-0x00000000240D0000-0x0000000024130000-memory.dmp upx behavioral1/memory/1532-163-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1532-168-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1532-169-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1532-173-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral1/memory/1312-175-0x00000000240D0000-0x0000000024130000-memory.dmp upx behavioral1/memory/1532-176-0x0000000000400000-0x0000000000455000-memory.dmp upx -
Loads dropped DLL 23 IoCs
pid Process 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 1684 server.exe 1684 server.exe 1684 server.exe 1684 server.exe 336 server.exe 336 server.exe 336 server.exe 336 server.exe 1312 server.exe 1312 server.exe 1312 server.exe 1312 server.exe 1700 server.exe 1700 server.exe 1700 server.exe 1700 server.exe 1532 server.exe 1532 server.exe 1532 server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\server = "C:\\Users\\Admin\\AppData\\Roaming\\FolderName\\server.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1684 set thread context of 336 1684 server.exe 31 PID 1700 set thread context of 1532 1700 server.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 336 server.exe 1532 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1312 server.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1312 server.exe Token: SeDebugPrivilege 1312 server.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 336 server.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 1684 server.exe 1700 server.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1928 wrote to memory of 1760 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 27 PID 1928 wrote to memory of 1760 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 27 PID 1928 wrote to memory of 1760 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 27 PID 1928 wrote to memory of 1760 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 27 PID 1928 wrote to memory of 1760 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 27 PID 1928 wrote to memory of 1760 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 27 PID 1928 wrote to memory of 1760 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 27 PID 1760 wrote to memory of 620 1760 cmd.exe 29 PID 1760 wrote to memory of 620 1760 cmd.exe 29 PID 1760 wrote to memory of 620 1760 cmd.exe 29 PID 1760 wrote to memory of 620 1760 cmd.exe 29 PID 1760 wrote to memory of 620 1760 cmd.exe 29 PID 1760 wrote to memory of 620 1760 cmd.exe 29 PID 1760 wrote to memory of 620 1760 cmd.exe 29 PID 1928 wrote to memory of 1684 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 30 PID 1928 wrote to memory of 1684 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 30 PID 1928 wrote to memory of 1684 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 30 PID 1928 wrote to memory of 1684 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 30 PID 1928 wrote to memory of 1684 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 30 PID 1928 wrote to memory of 1684 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 30 PID 1928 wrote to memory of 1684 1928 9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe 30 PID 1684 wrote to memory of 336 1684 server.exe 31 PID 1684 wrote to memory of 336 1684 server.exe 31 PID 1684 wrote to memory of 336 1684 server.exe 31 PID 1684 wrote to memory of 336 1684 server.exe 31 PID 1684 wrote to memory of 336 1684 server.exe 31 PID 1684 wrote to memory of 336 1684 server.exe 31 PID 1684 wrote to memory of 336 1684 server.exe 31 PID 1684 wrote to memory of 336 1684 server.exe 31 PID 1684 wrote to memory of 336 1684 server.exe 31 PID 1684 wrote to memory of 336 1684 server.exe 31 PID 1684 wrote to memory of 336 1684 server.exe 31 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15 PID 336 wrote to memory of 1400 336 server.exe 15
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe"C:\Users\Admin\AppData\Local\Temp\9271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7109605.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "server" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderName\server.exe" /f4⤵
- Adds Run key to start application
PID:620
-
-
-
C:\Users\Admin\AppData\Roaming\FolderName\server.exe"C:\Users\Admin\AppData\Roaming\FolderName\server.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Roaming\FolderName\server.exe"C:\Users\Admin\AppData\Roaming\FolderName\server.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe5⤵PID:1292
-
-
C:\Users\Admin\AppData\Roaming\FolderName\server.exe"C:\Users\Admin\AppData\Roaming\FolderName\server.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1312 -
C:\Users\Admin\AppData\Roaming\FolderName\server.exe"C:\Users\Admin\AppData\Roaming\FolderName\server.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1700 -
C:\Users\Admin\AppData\Roaming\FolderName\server.exe"C:\Users\Admin\AppData\Roaming\FolderName\server.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1532
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
143B
MD530427ea9b824990e669b8a383ad42b73
SHA19550aa03263d08a15cb8789c80043686712ac68b
SHA256c7addd0e470d90071c05c5e80ed6ca7bf8a968636b3b732bb735d90ceffdd2f4
SHA512475eb9b535fcc5eb26c1483a4ed0784af509bb195feaf9ceffab3ba6e7ba853590ebd25bd419c7e9846aeba9135f11d3996fef2b2db3e50a5a4f72070acd0d52
-
Filesize
221KB
MD578ec5e9296040c4cecc14210cb2bcd13
SHA18183bcfab475fb5f35f9be4e8d7335ed57da7f6e
SHA2568daf3aefd73885fe84d746a7f672e3032bf8f6fb01e5951d9c7c16e2251feddf
SHA5123fd22d2745b7583c42b9abbae5e86d037b9161ff5410b7e78a655dfede7dc8ab9a617085ee4ddb06253fec77a41bd6d1e19cea6c29c3b3f05e7c1a13e5ec212e
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4063495947-34355257-727531523-1000\699c4b9cdebca7aaea5193cae8a50098_8e28fefd-2db0-4dd4-85d7-665f2cf2c74b
Filesize50B
MD55b63d4dd8c04c88c0e30e494ec6a609a
SHA1884d5a8bdc25fe794dc22ef9518009dcf0069d09
SHA2564d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
SHA51215ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151
-
Filesize
460KB
MD5531590abb6298342e1ea7f7cf582f560
SHA13211be2f4e1103860dd85d5eaf8f1886be1214f2
SHA2569271a2bd2b18dee74fef414b94d2a5cb7d45f33e68cf662887674e01c21cb300
SHA51257220af5ef24d78ed68b19744267c69fc9107eb8ad4baf4ddc47704236a0a8d5bcb2927fea4e887d976f825dc08ca86a71c3b23aadd37f0403538d28fe130151