Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 19:25
Static task
static1
Behavioral task
behavioral1
Sample
6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe
Resource
win7-20220812-en
General
-
Target
6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe
-
Size
295KB
-
MD5
824b3506d2ab0f74351789f19e4afe80
-
SHA1
7429041f3cbbe23f2445cbd34d4baa80ff171a94
-
SHA256
6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4
-
SHA512
4ce0380ee22f9d294391d7f57707d74066a685a24c4dfe9c4203adf1836f80eef556b6fcca8c27f44baabc22db04c2495af6f58787dd51a9ce1bcd850c6af003
-
SSDEEP
6144:/4V8reak7THSdiDOzHnoj/j4S5ubqWak1Hwnuz7zdLF:/PSqdiDOzHoLrSqJk12uzlLF
Malware Config
Extracted
cybergate
v1.02.1
Lammer
fiduma.servehttp.com:90
Pluguin
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Microsoft
-
install_file
Pluguin.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Falta de rondaocx
-
message_box_title
Erro
-
password
12345
-
regkey_hkcu
Avirnt
-
regkey_hklm
Avgnt
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\Microsoft\\Pluguin\\Microsoft\\Pluguin.exe" 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\Microsoft\\Pluguin\\Microsoft\\Pluguin.exe" 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe -
Executes dropped EXE 7 IoCs
pid Process 1280 Pluguin.exe 1068 Pluguin.exe 1388 Pluguin.exe 1644 Pluguin.exe 304 Pluguin.exe 916 Pluguin.exe 1924 Pluguin.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{GP06C732-5R7R-8WST-656S-36O7HRB70241} 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{GP06C732-5R7R-8WST-656S-36O7HRB70241}\StubPath = "c:\\directory\\Microsoft\\Pluguin\\Microsoft\\Pluguin.exe Restart" 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{GP06C732-5R7R-8WST-656S-36O7HRB70241} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{GP06C732-5R7R-8WST-656S-36O7HRB70241}\StubPath = "c:\\directory\\Microsoft\\Pluguin\\Microsoft\\Pluguin.exe" explorer.exe -
resource yara_rule behavioral1/memory/1104-73-0x0000000024010000-0x0000000024070000-memory.dmp upx behavioral1/memory/1104-82-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral1/memory/2032-87-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral1/memory/2032-90-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral1/memory/1068-143-0x0000000024010000-0x0000000024070000-memory.dmp upx behavioral1/memory/304-148-0x0000000024010000-0x0000000024070000-memory.dmp upx behavioral1/memory/304-172-0x0000000024010000-0x0000000024070000-memory.dmp upx behavioral1/memory/304-176-0x0000000024010000-0x0000000024070000-memory.dmp upx -
Loads dropped DLL 3 IoCs
pid Process 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 2032 explorer.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Avirnt = "c:\\directory\\Microsoft\\Pluguin\\Microsoft\\Pluguin.exe" 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "c:\\directory\\Microsoft\\Pluguin\\Microsoft\\Pluguin.exe" 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1140 set thread context of 1104 1140 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 27 PID 1280 set thread context of 1068 1280 Pluguin.exe 30 PID 1388 set thread context of 1644 1388 Pluguin.exe 32 PID 916 set thread context of 1924 916 Pluguin.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 1068 Pluguin.exe 1644 Pluguin.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 304 Pluguin.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 304 Pluguin.exe Token: SeDebugPrivilege 304 Pluguin.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1140 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 1280 Pluguin.exe 1388 Pluguin.exe 916 Pluguin.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1140 wrote to memory of 1104 1140 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 27 PID 1140 wrote to memory of 1104 1140 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 27 PID 1140 wrote to memory of 1104 1140 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 27 PID 1140 wrote to memory of 1104 1140 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 27 PID 1140 wrote to memory of 1104 1140 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 27 PID 1140 wrote to memory of 1104 1140 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 27 PID 1140 wrote to memory of 1104 1140 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 27 PID 1140 wrote to memory of 1104 1140 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 27 PID 1140 wrote to memory of 1104 1140 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 27 PID 1140 wrote to memory of 1104 1140 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 27 PID 1140 wrote to memory of 1104 1140 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 27 PID 1140 wrote to memory of 1104 1140 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 27 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10 PID 1104 wrote to memory of 1256 1104 6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe 10
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe"C:\Users\Admin\AppData\Local\Temp\6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe"C:\Users\Admin\AppData\Local\Temp\6394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4.exe"3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
PID:2032 -
C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe"C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1388 -
C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe"C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1644
-
-
-
-
C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe"C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1280 -
C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe"C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1068 -
C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe"C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:304 -
C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe"C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:916 -
C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe"C:\directory\Microsoft\Pluguin\Microsoft\Pluguin.exe"8⤵
- Executes dropped EXE
PID:1924
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
221KB
MD50d0a32cd034035a9809326d96598b825
SHA1f9148b07f2f9c7e17329b460b9579a3f8f0233d5
SHA25644c11412ad0a5dfdcab7c3a69f88ddae713e8a17218bde8064cb8eb3c1a04ab4
SHA51284588fac42fd1a434802d8e9722a54caad08ddfdc8d77a8cad4af680e923675798889ecc33de47d858804a28fe071b777874f7c0f18012c198bcf61ef71ad3f7
-
Filesize
221KB
MD5c68cc29c58475f1baa75aa0f0bae0909
SHA11deda0c25018a33c1871689437b5c642d08f865d
SHA25653de59b31221145ad36806caf024d0ea798c39ccb31744ce8b78370e52f09873
SHA512491a6f065c361064b91d931ed5516771846b6fe8005cc9a0073afee250fdd33d1b39da8869db0e007514f2f321cbfe1d0bf745870f8dca35cae2871146fcf113
-
Filesize
295KB
MD5824b3506d2ab0f74351789f19e4afe80
SHA17429041f3cbbe23f2445cbd34d4baa80ff171a94
SHA2566394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4
SHA5124ce0380ee22f9d294391d7f57707d74066a685a24c4dfe9c4203adf1836f80eef556b6fcca8c27f44baabc22db04c2495af6f58787dd51a9ce1bcd850c6af003
-
Filesize
295KB
MD5824b3506d2ab0f74351789f19e4afe80
SHA17429041f3cbbe23f2445cbd34d4baa80ff171a94
SHA2566394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4
SHA5124ce0380ee22f9d294391d7f57707d74066a685a24c4dfe9c4203adf1836f80eef556b6fcca8c27f44baabc22db04c2495af6f58787dd51a9ce1bcd850c6af003
-
Filesize
295KB
MD5824b3506d2ab0f74351789f19e4afe80
SHA17429041f3cbbe23f2445cbd34d4baa80ff171a94
SHA2566394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4
SHA5124ce0380ee22f9d294391d7f57707d74066a685a24c4dfe9c4203adf1836f80eef556b6fcca8c27f44baabc22db04c2495af6f58787dd51a9ce1bcd850c6af003
-
Filesize
295KB
MD5824b3506d2ab0f74351789f19e4afe80
SHA17429041f3cbbe23f2445cbd34d4baa80ff171a94
SHA2566394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4
SHA5124ce0380ee22f9d294391d7f57707d74066a685a24c4dfe9c4203adf1836f80eef556b6fcca8c27f44baabc22db04c2495af6f58787dd51a9ce1bcd850c6af003
-
Filesize
295KB
MD5824b3506d2ab0f74351789f19e4afe80
SHA17429041f3cbbe23f2445cbd34d4baa80ff171a94
SHA2566394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4
SHA5124ce0380ee22f9d294391d7f57707d74066a685a24c4dfe9c4203adf1836f80eef556b6fcca8c27f44baabc22db04c2495af6f58787dd51a9ce1bcd850c6af003
-
Filesize
295KB
MD5824b3506d2ab0f74351789f19e4afe80
SHA17429041f3cbbe23f2445cbd34d4baa80ff171a94
SHA2566394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4
SHA5124ce0380ee22f9d294391d7f57707d74066a685a24c4dfe9c4203adf1836f80eef556b6fcca8c27f44baabc22db04c2495af6f58787dd51a9ce1bcd850c6af003
-
Filesize
295KB
MD5824b3506d2ab0f74351789f19e4afe80
SHA17429041f3cbbe23f2445cbd34d4baa80ff171a94
SHA2566394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4
SHA5124ce0380ee22f9d294391d7f57707d74066a685a24c4dfe9c4203adf1836f80eef556b6fcca8c27f44baabc22db04c2495af6f58787dd51a9ce1bcd850c6af003
-
Filesize
295KB
MD5824b3506d2ab0f74351789f19e4afe80
SHA17429041f3cbbe23f2445cbd34d4baa80ff171a94
SHA2566394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4
SHA5124ce0380ee22f9d294391d7f57707d74066a685a24c4dfe9c4203adf1836f80eef556b6fcca8c27f44baabc22db04c2495af6f58787dd51a9ce1bcd850c6af003
-
Filesize
295KB
MD5824b3506d2ab0f74351789f19e4afe80
SHA17429041f3cbbe23f2445cbd34d4baa80ff171a94
SHA2566394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4
SHA5124ce0380ee22f9d294391d7f57707d74066a685a24c4dfe9c4203adf1836f80eef556b6fcca8c27f44baabc22db04c2495af6f58787dd51a9ce1bcd850c6af003
-
Filesize
295KB
MD5824b3506d2ab0f74351789f19e4afe80
SHA17429041f3cbbe23f2445cbd34d4baa80ff171a94
SHA2566394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4
SHA5124ce0380ee22f9d294391d7f57707d74066a685a24c4dfe9c4203adf1836f80eef556b6fcca8c27f44baabc22db04c2495af6f58787dd51a9ce1bcd850c6af003
-
Filesize
295KB
MD5824b3506d2ab0f74351789f19e4afe80
SHA17429041f3cbbe23f2445cbd34d4baa80ff171a94
SHA2566394153c75d25ed54cf47ccdfccf28a0e230aa6d08fc3168616cd967619cd5f4
SHA5124ce0380ee22f9d294391d7f57707d74066a685a24c4dfe9c4203adf1836f80eef556b6fcca8c27f44baabc22db04c2495af6f58787dd51a9ce1bcd850c6af003