Analysis
-
max time kernel
174s -
max time network
196s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 00:04
Behavioral task
behavioral1
Sample
d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe
Resource
win7-20221111-en
General
-
Target
d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe
-
Size
276KB
-
MD5
eed6b6a8bfefc17d144e6e26179fa650
-
SHA1
f13ded6ff3f12ee3301ee6e2bb06cc50d7ab5563
-
SHA256
d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940
-
SHA512
06e22381810eca956ef46a0edef6707b3bcfd515b66f36d1071893345657ec55a670120ca2c85937ae9ea006c6b432319ec5a7cdcbef71480b9f7b9fe24a9313
-
SSDEEP
6144:Kk4qmKQpYgh9AATiSbgo1hTslHqSfV0RdoGFSZrZj:V9G9A4prcqjSZ
Malware Config
Extracted
cybergate
2.6
Kurban
connect.cryptr.org:1454
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
google
-
install_file
index.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
1453
-
regkey_hkcu
Google
-
regkey_hklm
Google
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 1768 index.exe 1412 index.exe 1440 index.exe 836 index.exe 1384 index.exe -
resource yara_rule behavioral1/memory/972-54-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/972-57-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/972-66-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/876-71-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/876-72-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/files/0x00090000000141fc-74.dat upx behavioral1/memory/972-76-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral1/files/0x00090000000141fc-81.dat upx behavioral1/files/0x00090000000141fc-84.dat upx behavioral1/files/0x00090000000141fc-82.dat upx behavioral1/memory/1768-90-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1692-89-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/972-91-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/files/0x00090000000141fc-98.dat upx behavioral1/files/0x00090000000141fc-100.dat upx behavioral1/files/0x00090000000141fc-102.dat upx behavioral1/memory/876-104-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1440-106-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/876-105-0x0000000003A50000-0x0000000003AA7000-memory.dmp upx behavioral1/memory/972-107-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1692-114-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/972-113-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1768-119-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1692-122-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1412-123-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/files/0x00090000000141fc-130.dat upx behavioral1/memory/836-131-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/files/0x00090000000141fc-133.dat upx behavioral1/memory/1384-136-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1440-137-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1440-142-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/836-143-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/836-144-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1412-146-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/files/0x00090000000141fc-149.dat upx behavioral1/files/0x00090000000141fc-148.dat upx behavioral1/files/0x00090000000141fc-150.dat upx behavioral1/memory/1384-151-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/836-152-0x0000000024080000-0x00000000240E2000-memory.dmp upx -
Loads dropped DLL 6 IoCs
pid Process 876 explorer.exe 876 explorer.exe 876 explorer.exe 1816 WerFault.exe 1816 WerFault.exe 1816 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Google = "C:\\Program Files (x86)\\google\\index.exe" d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google = "C:\\Program Files (x86)\\google\\index.exe" d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\google\index.exe index.exe File opened for modification C:\Program Files (x86)\google\index.exe index.exe File created C:\Program Files (x86)\google\index.exe d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe File opened for modification C:\Program Files (x86)\google\index.exe d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1816 836 WerFault.exe 36 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1412 index.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1412 index.exe Token: SeDebugPrivilege 1412 index.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12 PID 972 wrote to memory of 1288 972 d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe 12
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe"C:\Users\Admin\AppData\Local\Temp\d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Loads dropped DLL
PID:876 -
C:\Program Files (x86)\google\index.exe"C:\Program Files (x86)\google\index.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1768 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:1436
-
-
C:\Program Files (x86)\google\index.exe"C:\Program Files (x86)\google\index.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1412 -
C:\Program Files (x86)\google\index.exe"C:\Program Files (x86)\google\index.exe"6⤵
- Executes dropped EXE
PID:1384
-
-
-
-
C:\Program Files (x86)\google\index.exe"C:\Program Files (x86)\google\index.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1440 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:1520
-
-
C:\Program Files (x86)\google\index.exe"C:\Program Files (x86)\google\index.exe"5⤵
- Executes dropped EXE
PID:836 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 5046⤵
- Loads dropped DLL
- Program crash
PID:1816
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:996
-
-
C:\Users\Admin\AppData\Local\Temp\d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe"C:\Users\Admin\AppData\Local\Temp\d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940.exe"3⤵PID:1692
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
276KB
MD5eed6b6a8bfefc17d144e6e26179fa650
SHA1f13ded6ff3f12ee3301ee6e2bb06cc50d7ab5563
SHA256d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940
SHA51206e22381810eca956ef46a0edef6707b3bcfd515b66f36d1071893345657ec55a670120ca2c85937ae9ea006c6b432319ec5a7cdcbef71480b9f7b9fe24a9313
-
Filesize
276KB
MD5eed6b6a8bfefc17d144e6e26179fa650
SHA1f13ded6ff3f12ee3301ee6e2bb06cc50d7ab5563
SHA256d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940
SHA51206e22381810eca956ef46a0edef6707b3bcfd515b66f36d1071893345657ec55a670120ca2c85937ae9ea006c6b432319ec5a7cdcbef71480b9f7b9fe24a9313
-
Filesize
276KB
MD5eed6b6a8bfefc17d144e6e26179fa650
SHA1f13ded6ff3f12ee3301ee6e2bb06cc50d7ab5563
SHA256d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940
SHA51206e22381810eca956ef46a0edef6707b3bcfd515b66f36d1071893345657ec55a670120ca2c85937ae9ea006c6b432319ec5a7cdcbef71480b9f7b9fe24a9313
-
Filesize
276KB
MD5eed6b6a8bfefc17d144e6e26179fa650
SHA1f13ded6ff3f12ee3301ee6e2bb06cc50d7ab5563
SHA256d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940
SHA51206e22381810eca956ef46a0edef6707b3bcfd515b66f36d1071893345657ec55a670120ca2c85937ae9ea006c6b432319ec5a7cdcbef71480b9f7b9fe24a9313
-
Filesize
276KB
MD5eed6b6a8bfefc17d144e6e26179fa650
SHA1f13ded6ff3f12ee3301ee6e2bb06cc50d7ab5563
SHA256d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940
SHA51206e22381810eca956ef46a0edef6707b3bcfd515b66f36d1071893345657ec55a670120ca2c85937ae9ea006c6b432319ec5a7cdcbef71480b9f7b9fe24a9313
-
Filesize
276KB
MD5eed6b6a8bfefc17d144e6e26179fa650
SHA1f13ded6ff3f12ee3301ee6e2bb06cc50d7ab5563
SHA256d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940
SHA51206e22381810eca956ef46a0edef6707b3bcfd515b66f36d1071893345657ec55a670120ca2c85937ae9ea006c6b432319ec5a7cdcbef71480b9f7b9fe24a9313
-
Filesize
229KB
MD5e324fe5b45b5c552d7d9b7b69b81265c
SHA12856cc89538f2bf236fffab1a5248027fa518bfb
SHA256fe52df587a05281e75f28327442a6c85255ec2ecc0dfd03dd71133657aff9eb1
SHA512d1f142ada71d5823c31df362dee835d41b7774d98ce63ff78975bc219724ad1ff0b77570e1acb47e5a04ac25b3c15c1e5bb38c1fb6d73830dc0c3ae0eec948e3
-
Filesize
229KB
MD56140e884cd7e3f886ffbb35213545047
SHA12c22704bf7123c2f7daf770db248f814490932ba
SHA256cb593a07369cc9ddcca7bc94b8ad7a7f76773074ebdd048aee3789259bf55c0f
SHA51288a6b1897c00d95f07b204fb5076f8a3f54dcfb583bbce63d703f05b88eaf444353bf5dc865990f14c120d70c8f4c6522cd89797b45fde008c0f9f74374e75d6
-
Filesize
276KB
MD5eed6b6a8bfefc17d144e6e26179fa650
SHA1f13ded6ff3f12ee3301ee6e2bb06cc50d7ab5563
SHA256d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940
SHA51206e22381810eca956ef46a0edef6707b3bcfd515b66f36d1071893345657ec55a670120ca2c85937ae9ea006c6b432319ec5a7cdcbef71480b9f7b9fe24a9313
-
Filesize
276KB
MD5eed6b6a8bfefc17d144e6e26179fa650
SHA1f13ded6ff3f12ee3301ee6e2bb06cc50d7ab5563
SHA256d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940
SHA51206e22381810eca956ef46a0edef6707b3bcfd515b66f36d1071893345657ec55a670120ca2c85937ae9ea006c6b432319ec5a7cdcbef71480b9f7b9fe24a9313
-
Filesize
276KB
MD5eed6b6a8bfefc17d144e6e26179fa650
SHA1f13ded6ff3f12ee3301ee6e2bb06cc50d7ab5563
SHA256d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940
SHA51206e22381810eca956ef46a0edef6707b3bcfd515b66f36d1071893345657ec55a670120ca2c85937ae9ea006c6b432319ec5a7cdcbef71480b9f7b9fe24a9313
-
Filesize
276KB
MD5eed6b6a8bfefc17d144e6e26179fa650
SHA1f13ded6ff3f12ee3301ee6e2bb06cc50d7ab5563
SHA256d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940
SHA51206e22381810eca956ef46a0edef6707b3bcfd515b66f36d1071893345657ec55a670120ca2c85937ae9ea006c6b432319ec5a7cdcbef71480b9f7b9fe24a9313
-
Filesize
276KB
MD5eed6b6a8bfefc17d144e6e26179fa650
SHA1f13ded6ff3f12ee3301ee6e2bb06cc50d7ab5563
SHA256d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940
SHA51206e22381810eca956ef46a0edef6707b3bcfd515b66f36d1071893345657ec55a670120ca2c85937ae9ea006c6b432319ec5a7cdcbef71480b9f7b9fe24a9313
-
Filesize
276KB
MD5eed6b6a8bfefc17d144e6e26179fa650
SHA1f13ded6ff3f12ee3301ee6e2bb06cc50d7ab5563
SHA256d25f55f47cb59e23c2e14eb461545ee4d08190e651a6a2e946b0d4a335345940
SHA51206e22381810eca956ef46a0edef6707b3bcfd515b66f36d1071893345657ec55a670120ca2c85937ae9ea006c6b432319ec5a7cdcbef71480b9f7b9fe24a9313