Analysis
-
max time kernel
148s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23/11/2022, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe
Resource
win10v2004-20220812-en
General
-
Target
1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe
-
Size
712KB
-
MD5
5244590f29e5fdf4267f60fe2a06ea90
-
SHA1
00ea26b62e1962ccd9a64ddec59d0700accadb6e
-
SHA256
1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4
-
SHA512
48f252a903222289520a594ee904fcf76ff7c3f70c2b733af02ef0f2bd430bca3f5934da4704de5c4d86d87e2e5a663aa0f80c9406d3dba7be077535af5bc885
-
SSDEEP
12288:tOqBSImJ7uD4vqQOqCg/0+cdEuH8uitp4xieV31K93V:kCSXOTRdEuUpJGls
Malware Config
Extracted
xtremerat
hussienashraf2020.zapto.org
Signatures
-
Detect XtremeRAT payload 18 IoCs
resource yara_rule behavioral1/memory/1596-57-0x0000000000C80000-0x0000000000CEE000-memory.dmp family_xtremerat behavioral1/memory/1596-59-0x0000000000C80000-0x0000000000CEE000-memory.dmp family_xtremerat behavioral1/memory/1596-62-0x0000000000C80000-0x0000000000CEE000-memory.dmp family_xtremerat behavioral1/memory/1596-65-0x0000000000C80000-0x0000000000CEE000-memory.dmp family_xtremerat behavioral1/memory/1596-67-0x0000000000C80000-0x0000000000CEE000-memory.dmp family_xtremerat behavioral1/memory/1596-70-0x0000000000C80000-0x0000000000CEE000-memory.dmp family_xtremerat behavioral1/memory/1596-72-0x0000000000C88B20-mapping.dmp family_xtremerat behavioral1/memory/1596-74-0x0000000000C80000-0x0000000000CEE000-memory.dmp family_xtremerat behavioral1/memory/1596-75-0x0000000000C81000-0x0000000000C8A000-memory.dmp family_xtremerat behavioral1/memory/1116-78-0x0000000000000000-mapping.dmp family_xtremerat behavioral1/memory/1116-79-0x0000000000C80000-0x0000000000CEE000-memory.dmp family_xtremerat behavioral1/memory/944-84-0x0000000000000000-mapping.dmp family_xtremerat behavioral1/memory/944-87-0x0000000000C80000-0x0000000000CEE000-memory.dmp family_xtremerat behavioral1/memory/944-92-0x0000000000C80000-0x0000000000CEE000-memory.dmp family_xtremerat behavioral1/memory/1984-117-0x0000000000C88B20-mapping.dmp family_xtremerat behavioral1/memory/844-141-0x0000000000C88B20-mapping.dmp family_xtremerat behavioral1/memory/928-201-0x0000000000C88B20-mapping.dmp family_xtremerat behavioral1/memory/1756-223-0x0000000000C88B20-mapping.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Executes dropped EXE 8 IoCs
pid Process 1340 Server.exe 1824 Server.exe 1556 Server.exe 1984 Server.exe 844 Server.exe 1148 Server.exe 928 Server.exe 1756 Server.exe -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6X05Y61Y-KU8F-VAM6-OEN2-1T0Q20C4EGNI}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6X05Y61Y-KU8F-VAM6-OEN2-1T0Q20C4EGNI} Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6X05Y61Y-KU8F-VAM6-OEN2-1T0Q20C4EGNI}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6X05Y61Y-KU8F-VAM6-OEN2-1T0Q20C4EGNI} Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6X05Y61Y-KU8F-VAM6-OEN2-1T0Q20C4EGNI}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" Server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6X05Y61Y-KU8F-VAM6-OEN2-1T0Q20C4EGNI} 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6X05Y61Y-KU8F-VAM6-OEN2-1T0Q20C4EGNI}\StubPath = "C:\\Windows\\InstallDir\\Server.exe restart" 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6X05Y61Y-KU8F-VAM6-OEN2-1T0Q20C4EGNI} svchost.exe -
Loads dropped DLL 5 IoCs
pid Process 944 explorer.exe 944 explorer.exe 1116 svchost.exe 1116 svchost.exe 1116 svchost.exe -
Adds Run key to start application 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\Server.exe" 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" Server.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\Server.exe" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Server.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini explorer.exe -
Suspicious use of SetThreadContext 7 IoCs
description pid Process procid_target PID 1364 set thread context of 1596 1364 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 28 PID 1340 set thread context of 1984 1340 Server.exe 35 PID 1824 set thread context of 844 1824 Server.exe 38 PID 1984 set thread context of 536 1984 Server.exe 37 PID 844 set thread context of 584 844 Server.exe 41 PID 1556 set thread context of 928 1556 Server.exe 42 PID 1148 set thread context of 1756 1148 Server.exe 43 -
Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\InstallDir\Server.exe 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe File created C:\Windows\InstallDir\Server.exe 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe File opened for modification C:\Windows\InstallDir\ 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe File opened for modification C:\Windows\InstallDir\Server.exe Server.exe File opened for modification C:\Windows\InstallDir\ Server.exe File opened for modification C:\Windows\InstallDir\Server.exe Server.exe File opened for modification C:\Windows\InstallDir\ Server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 584 explorer.exe 536 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 944 explorer.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 944 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 944 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1364 wrote to memory of 1596 1364 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 28 PID 1364 wrote to memory of 1596 1364 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 28 PID 1364 wrote to memory of 1596 1364 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 28 PID 1364 wrote to memory of 1596 1364 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 28 PID 1364 wrote to memory of 1596 1364 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 28 PID 1364 wrote to memory of 1596 1364 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 28 PID 1364 wrote to memory of 1596 1364 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 28 PID 1364 wrote to memory of 1596 1364 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 28 PID 1364 wrote to memory of 1596 1364 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 28 PID 1364 wrote to memory of 1596 1364 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 28 PID 1364 wrote to memory of 1596 1364 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 28 PID 1364 wrote to memory of 1596 1364 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 28 PID 1596 wrote to memory of 1116 1596 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 29 PID 1596 wrote to memory of 1116 1596 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 29 PID 1596 wrote to memory of 1116 1596 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 29 PID 1596 wrote to memory of 1116 1596 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 29 PID 1596 wrote to memory of 1116 1596 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 29 PID 1596 wrote to memory of 1804 1596 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 30 PID 1596 wrote to memory of 1804 1596 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 30 PID 1596 wrote to memory of 1804 1596 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 30 PID 1596 wrote to memory of 1804 1596 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 30 PID 1596 wrote to memory of 944 1596 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 31 PID 1596 wrote to memory of 944 1596 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 31 PID 1596 wrote to memory of 944 1596 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 31 PID 1596 wrote to memory of 944 1596 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 31 PID 1596 wrote to memory of 944 1596 1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe 31 PID 944 wrote to memory of 1340 944 explorer.exe 32 PID 944 wrote to memory of 1340 944 explorer.exe 32 PID 944 wrote to memory of 1340 944 explorer.exe 32 PID 944 wrote to memory of 1340 944 explorer.exe 32 PID 1116 wrote to memory of 1824 1116 svchost.exe 33 PID 1116 wrote to memory of 1824 1116 svchost.exe 33 PID 1116 wrote to memory of 1824 1116 svchost.exe 33 PID 1116 wrote to memory of 1824 1116 svchost.exe 33 PID 1116 wrote to memory of 1556 1116 svchost.exe 34 PID 1116 wrote to memory of 1556 1116 svchost.exe 34 PID 1116 wrote to memory of 1556 1116 svchost.exe 34 PID 1116 wrote to memory of 1556 1116 svchost.exe 34 PID 1340 wrote to memory of 1984 1340 Server.exe 35 PID 1340 wrote to memory of 1984 1340 Server.exe 35 PID 1340 wrote to memory of 1984 1340 Server.exe 35 PID 1340 wrote to memory of 1984 1340 Server.exe 35 PID 1340 wrote to memory of 1984 1340 Server.exe 35 PID 1340 wrote to memory of 1984 1340 Server.exe 35 PID 1340 wrote to memory of 1984 1340 Server.exe 35 PID 1340 wrote to memory of 1984 1340 Server.exe 35 PID 1340 wrote to memory of 1984 1340 Server.exe 35 PID 1340 wrote to memory of 1984 1340 Server.exe 35 PID 1340 wrote to memory of 1984 1340 Server.exe 35 PID 1340 wrote to memory of 1984 1340 Server.exe 35 PID 1984 wrote to memory of 1628 1984 Server.exe 36 PID 1984 wrote to memory of 1628 1984 Server.exe 36 PID 1984 wrote to memory of 1628 1984 Server.exe 36 PID 1984 wrote to memory of 1628 1984 Server.exe 36 PID 1984 wrote to memory of 536 1984 Server.exe 37 PID 1984 wrote to memory of 536 1984 Server.exe 37 PID 1984 wrote to memory of 536 1984 Server.exe 37 PID 1984 wrote to memory of 536 1984 Server.exe 37 PID 1824 wrote to memory of 844 1824 Server.exe 38 PID 1824 wrote to memory of 844 1824 Server.exe 38 PID 1824 wrote to memory of 844 1824 Server.exe 38 PID 1824 wrote to memory of 844 1824 Server.exe 38 PID 1824 wrote to memory of 844 1824 Server.exe 38 PID 1824 wrote to memory of 844 1824 Server.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe"C:\Users\Admin\AppData\Local\Temp\1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exeC:\Users\Admin\AppData\Local\Temp\1aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4.exe2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\InstallDir\Server.exeC:\Windows\InstallDir\Server.exe5⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:844 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵PID:1472
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe6⤵
- Suspicious behavior: EnumeratesProcesses
PID:584
-
-
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1556 -
C:\Windows\InstallDir\Server.exeC:\Windows\InstallDir\Server.exe5⤵
- Executes dropped EXE
PID:928
-
-
-
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1148 -
C:\Windows\InstallDir\Server.exeC:\Windows\InstallDir\Server.exe5⤵
- Executes dropped EXE
PID:1756
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:1804
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\InstallDir\Server.exe"C:\Windows\InstallDir\Server.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\InstallDir\Server.exeC:\Windows\InstallDir\Server.exe5⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵PID:1628
-
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe6⤵
- Suspicious behavior: EnumeratesProcesses
PID:536
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5892fb7ae7b1a8c59133b27f958ccb550
SHA113a80dff0481d5aee88c51d2130186a0a9194932
SHA2561678881e96078de557abfd5f5e5a18f468c625a255c2976bdc3251713ad7bfd8
SHA5128538ecca79bec6269159cacff826e05752650174e6963c78aa0d29071d9fafaf31f17523d7b1b7596dedca11a691fdfa4f28c35b4a4593ef6b13a5c04bd9f884
-
Filesize
1KB
MD5892fb7ae7b1a8c59133b27f958ccb550
SHA113a80dff0481d5aee88c51d2130186a0a9194932
SHA2561678881e96078de557abfd5f5e5a18f468c625a255c2976bdc3251713ad7bfd8
SHA5128538ecca79bec6269159cacff826e05752650174e6963c78aa0d29071d9fafaf31f17523d7b1b7596dedca11a691fdfa4f28c35b4a4593ef6b13a5c04bd9f884
-
Filesize
1KB
MD5892fb7ae7b1a8c59133b27f958ccb550
SHA113a80dff0481d5aee88c51d2130186a0a9194932
SHA2561678881e96078de557abfd5f5e5a18f468c625a255c2976bdc3251713ad7bfd8
SHA5128538ecca79bec6269159cacff826e05752650174e6963c78aa0d29071d9fafaf31f17523d7b1b7596dedca11a691fdfa4f28c35b4a4593ef6b13a5c04bd9f884
-
Filesize
343KB
MD56426d400c96fb9ffef4eaa54f6647f4c
SHA170a37871aff432790b6adf7d3fc4eb929476e082
SHA25698bba0cf4c57ecd35b227f45e4aa6dd50ef7cfb1160235cc14687c96eb09fa3c
SHA5122c8b4d3ab066cbfca6cf0c8d89d5044152b5e3d7100249cbedd1c816e3a4a94efc8bc6b79c1dab4bdf96e3ce476d6caccf625cfbe0aff3bf5e7a29dfcfa948c5
-
Filesize
712KB
MD55244590f29e5fdf4267f60fe2a06ea90
SHA100ea26b62e1962ccd9a64ddec59d0700accadb6e
SHA2561aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4
SHA51248f252a903222289520a594ee904fcf76ff7c3f70c2b733af02ef0f2bd430bca3f5934da4704de5c4d86d87e2e5a663aa0f80c9406d3dba7be077535af5bc885
-
Filesize
712KB
MD55244590f29e5fdf4267f60fe2a06ea90
SHA100ea26b62e1962ccd9a64ddec59d0700accadb6e
SHA2561aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4
SHA51248f252a903222289520a594ee904fcf76ff7c3f70c2b733af02ef0f2bd430bca3f5934da4704de5c4d86d87e2e5a663aa0f80c9406d3dba7be077535af5bc885
-
Filesize
712KB
MD55244590f29e5fdf4267f60fe2a06ea90
SHA100ea26b62e1962ccd9a64ddec59d0700accadb6e
SHA2561aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4
SHA51248f252a903222289520a594ee904fcf76ff7c3f70c2b733af02ef0f2bd430bca3f5934da4704de5c4d86d87e2e5a663aa0f80c9406d3dba7be077535af5bc885
-
Filesize
712KB
MD55244590f29e5fdf4267f60fe2a06ea90
SHA100ea26b62e1962ccd9a64ddec59d0700accadb6e
SHA2561aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4
SHA51248f252a903222289520a594ee904fcf76ff7c3f70c2b733af02ef0f2bd430bca3f5934da4704de5c4d86d87e2e5a663aa0f80c9406d3dba7be077535af5bc885
-
Filesize
712KB
MD55244590f29e5fdf4267f60fe2a06ea90
SHA100ea26b62e1962ccd9a64ddec59d0700accadb6e
SHA2561aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4
SHA51248f252a903222289520a594ee904fcf76ff7c3f70c2b733af02ef0f2bd430bca3f5934da4704de5c4d86d87e2e5a663aa0f80c9406d3dba7be077535af5bc885
-
Filesize
712KB
MD55244590f29e5fdf4267f60fe2a06ea90
SHA100ea26b62e1962ccd9a64ddec59d0700accadb6e
SHA2561aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4
SHA51248f252a903222289520a594ee904fcf76ff7c3f70c2b733af02ef0f2bd430bca3f5934da4704de5c4d86d87e2e5a663aa0f80c9406d3dba7be077535af5bc885
-
Filesize
712KB
MD55244590f29e5fdf4267f60fe2a06ea90
SHA100ea26b62e1962ccd9a64ddec59d0700accadb6e
SHA2561aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4
SHA51248f252a903222289520a594ee904fcf76ff7c3f70c2b733af02ef0f2bd430bca3f5934da4704de5c4d86d87e2e5a663aa0f80c9406d3dba7be077535af5bc885
-
Filesize
712KB
MD55244590f29e5fdf4267f60fe2a06ea90
SHA100ea26b62e1962ccd9a64ddec59d0700accadb6e
SHA2561aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4
SHA51248f252a903222289520a594ee904fcf76ff7c3f70c2b733af02ef0f2bd430bca3f5934da4704de5c4d86d87e2e5a663aa0f80c9406d3dba7be077535af5bc885
-
Filesize
712KB
MD55244590f29e5fdf4267f60fe2a06ea90
SHA100ea26b62e1962ccd9a64ddec59d0700accadb6e
SHA2561aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4
SHA51248f252a903222289520a594ee904fcf76ff7c3f70c2b733af02ef0f2bd430bca3f5934da4704de5c4d86d87e2e5a663aa0f80c9406d3dba7be077535af5bc885
-
Filesize
712KB
MD55244590f29e5fdf4267f60fe2a06ea90
SHA100ea26b62e1962ccd9a64ddec59d0700accadb6e
SHA2561aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4
SHA51248f252a903222289520a594ee904fcf76ff7c3f70c2b733af02ef0f2bd430bca3f5934da4704de5c4d86d87e2e5a663aa0f80c9406d3dba7be077535af5bc885
-
Filesize
712KB
MD55244590f29e5fdf4267f60fe2a06ea90
SHA100ea26b62e1962ccd9a64ddec59d0700accadb6e
SHA2561aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4
SHA51248f252a903222289520a594ee904fcf76ff7c3f70c2b733af02ef0f2bd430bca3f5934da4704de5c4d86d87e2e5a663aa0f80c9406d3dba7be077535af5bc885
-
Filesize
712KB
MD55244590f29e5fdf4267f60fe2a06ea90
SHA100ea26b62e1962ccd9a64ddec59d0700accadb6e
SHA2561aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4
SHA51248f252a903222289520a594ee904fcf76ff7c3f70c2b733af02ef0f2bd430bca3f5934da4704de5c4d86d87e2e5a663aa0f80c9406d3dba7be077535af5bc885
-
Filesize
712KB
MD55244590f29e5fdf4267f60fe2a06ea90
SHA100ea26b62e1962ccd9a64ddec59d0700accadb6e
SHA2561aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4
SHA51248f252a903222289520a594ee904fcf76ff7c3f70c2b733af02ef0f2bd430bca3f5934da4704de5c4d86d87e2e5a663aa0f80c9406d3dba7be077535af5bc885
-
Filesize
712KB
MD55244590f29e5fdf4267f60fe2a06ea90
SHA100ea26b62e1962ccd9a64ddec59d0700accadb6e
SHA2561aab225382e13f21383beacb5816af4cb6cca594012388e547a49fbacedb82f4
SHA51248f252a903222289520a594ee904fcf76ff7c3f70c2b733af02ef0f2bd430bca3f5934da4704de5c4d86d87e2e5a663aa0f80c9406d3dba7be077535af5bc885