Analysis
-
max time kernel
147s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
04-07-2023 15:19
Behavioral task
behavioral1
Sample
easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe
Resource
win7-20230703-en
General
-
Target
easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe
-
Size
290KB
-
MD5
cc5d023b5fa3916f2ef1a794145254ea
-
SHA1
b496eb4a3947eb290717059b70d6d2fb17ed6d6b
-
SHA256
40675c4b5d24820f25d5ea8e99f2381c1dd57565ab67f68aad2a110d892108de
-
SHA512
17fd636fce02c4545731897781db2dd966aaf3b2a5c761b5aebf2d5c02f9e1af18be8b0f93298e65dd12a15f0d4d1a88267cd28a035016ed50fe4e232d593e7b
-
SSDEEP
6144:2OpslFlqLhdBCkWYxuukP1pjSKSNVkq/MVJbX:2wsl2TBd47GLRMTbX
Malware Config
Extracted
cybergate
v1.07.5
remote
smokie666.chickenkiller.com:8090
TG0LNKN1EO587L
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe" easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\CyberGate\\install\\server.exe" easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{65712V73-T7AW-S821-21E2-LU324O72L4U7} easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{65712V73-T7AW-S821-21E2-LU324O72L4U7}\StubPath = "c:\\directory\\CyberGate\\install\\server.exe Restart" easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{65712V73-T7AW-S821-21E2-LU324O72L4U7} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{65712V73-T7AW-S821-21E2-LU324O72L4U7}\StubPath = "c:\\directory\\CyberGate\\install\\server.exe" explorer.exe -
Executes dropped EXE 1 IoCs
pid Process 1712 server.exe -
Loads dropped DLL 2 IoCs
pid Process 2996 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 2996 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe -
resource yara_rule behavioral1/memory/936-584-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/2996-903-0x0000000010560000-0x00000000105C5000-memory.dmp upx behavioral1/memory/2996-933-0x0000000010560000-0x00000000105C5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "c:\\directory\\CyberGate\\install\\server.exe" easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Windows\CurrentVersion\Run easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "c:\\directory\\CyberGate\\install\\server.exe" easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2996 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeBackupPrivilege 936 explorer.exe Token: SeRestorePrivilege 936 explorer.exe Token: SeBackupPrivilege 2996 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe Token: SeRestorePrivilege 2996 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe Token: SeDebugPrivilege 2996 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe Token: SeDebugPrivilege 2996 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12 PID 1684 wrote to memory of 1408 1684 easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe 12
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe"C:\Users\Admin\AppData\Local\Temp\easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
PID:936
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:2540
-
-
C:\Users\Admin\AppData\Local\Temp\easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe"C:\Users\Admin\AppData\Local\Temp\easy_Malicious_2b763683f4bc917c6f2970f0166f8b0931de1de97c43c5554d23d34004ab4beb.exe"3⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2996 -
C:\directory\CyberGate\install\server.exe"C:\directory\CyberGate\install\server.exe"4⤵
- Executes dropped EXE
PID:1712
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
225KB
MD5588f4bda1eedb5632a811768ae008ca7
SHA1b3f1e9d87cdfddfde233e08be77ac1b42956216d
SHA256c115d1071aa3b3be7728202cd3ed93a3cedf5164094525f5e9986a4e55f5ca77
SHA51238d391ecae3eb274634cc32cf68094ddd8ca011442587aff73b45021a9a23a110f1cb32bd588c0c297ce03ee11b7ef2e0ff949fe22077bf2338d0df3d4bba146
-
Filesize
8B
MD58d3fbfceb06ab716f5c9b00db2cafbc6
SHA1fc5d18fde9b65c18e79df54898f174c07d6e6f7f
SHA25630ef603442981ffe800507b86340336442f32aa75cb75876c6d58944b103f359
SHA5128409364ebe0f33b92449c1547db359e42e40bd344d0418ed18bc08bb8769950c4731c3ee5148e62d80fe4528e3d4dc0d365c489dd1bd8d958a09d96307eab387
-
Filesize
8B
MD507ba418bf7b7583dec1ed0748d9aaddd
SHA1af3e03dca542c74de33d4617a5b90cfa0677912f
SHA256359eb7defef47b7eaca98ac3c53f2032b7d6f27178e3b566e5b15623afca4bfe
SHA51268d4d770f5fa76c844b5d197d3dc6708eb79fa2b4bbdf2365de1ba6268a2bad3f9a3cdb24f6ce035e767efb36cb00027060f4e112d60096ff9283e45628df536
-
Filesize
15B
MD5bf3dba41023802cf6d3f8c5fd683a0c7
SHA1466530987a347b68ef28faad238d7b50db8656a5
SHA2564a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314
-
Filesize
290KB
MD5cc5d023b5fa3916f2ef1a794145254ea
SHA1b496eb4a3947eb290717059b70d6d2fb17ed6d6b
SHA25640675c4b5d24820f25d5ea8e99f2381c1dd57565ab67f68aad2a110d892108de
SHA51217fd636fce02c4545731897781db2dd966aaf3b2a5c761b5aebf2d5c02f9e1af18be8b0f93298e65dd12a15f0d4d1a88267cd28a035016ed50fe4e232d593e7b
-
Filesize
290KB
MD5cc5d023b5fa3916f2ef1a794145254ea
SHA1b496eb4a3947eb290717059b70d6d2fb17ed6d6b
SHA25640675c4b5d24820f25d5ea8e99f2381c1dd57565ab67f68aad2a110d892108de
SHA51217fd636fce02c4545731897781db2dd966aaf3b2a5c761b5aebf2d5c02f9e1af18be8b0f93298e65dd12a15f0d4d1a88267cd28a035016ed50fe4e232d593e7b
-
Filesize
290KB
MD5cc5d023b5fa3916f2ef1a794145254ea
SHA1b496eb4a3947eb290717059b70d6d2fb17ed6d6b
SHA25640675c4b5d24820f25d5ea8e99f2381c1dd57565ab67f68aad2a110d892108de
SHA51217fd636fce02c4545731897781db2dd966aaf3b2a5c761b5aebf2d5c02f9e1af18be8b0f93298e65dd12a15f0d4d1a88267cd28a035016ed50fe4e232d593e7b
-
Filesize
290KB
MD5cc5d023b5fa3916f2ef1a794145254ea
SHA1b496eb4a3947eb290717059b70d6d2fb17ed6d6b
SHA25640675c4b5d24820f25d5ea8e99f2381c1dd57565ab67f68aad2a110d892108de
SHA51217fd636fce02c4545731897781db2dd966aaf3b2a5c761b5aebf2d5c02f9e1af18be8b0f93298e65dd12a15f0d4d1a88267cd28a035016ed50fe4e232d593e7b