Analysis
-
max time kernel
143s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
27-11-2023 15:23
Static task
static1
Behavioral task
behavioral1
Sample
50b59ec66299f7a528e35b5747cff7ec.exe
Resource
win7-20231020-en
General
-
Target
50b59ec66299f7a528e35b5747cff7ec.exe
-
Size
434KB
-
MD5
50b59ec66299f7a528e35b5747cff7ec
-
SHA1
1a4a71093b3075a2b28184908fe5e80d03d65e82
-
SHA256
5abd71acc7aaa2bb26c92e6c5d1827b20b8157f74b612b3bd1a6b79e2bd6a2e6
-
SHA512
5b34ca72ddfd01617c0ee622b06117ee825c70c442a04dd4c931ff3ab7f1a449c19fe9127e0ddaaf75395bc00942e7040a1117bf5d20a0042324c430e20ad02d
-
SSDEEP
6144:E+rEsiveHU/h1HiUUgO+rO2gdY8xWthfs+Eusf/:E+rEsiveehZU2gYs0hfs+4/
Malware Config
Extracted
amadey
http://arrunda.ru
http://soetegem.com
http://tceducn.com
-
strings_key
eb714cabd2548b4a03c45f723f838bdc
-
url_paths
/forum/index.php
Extracted
amadey
4.11
http://shohetrc.com
http://sibcomputer.ru
http://tve-mail.com
-
install_dir
d4dd819322
-
install_file
Utsysc.exe
-
strings_key
8419b3024d6f72beef8af6915e592308
-
url_paths
/forum/index.php
Signatures
-
Blocklisted process makes network request 6 IoCs
Processes:
rundll32.exerundll32.exerundll32.exeflow pid process 17 2392 rundll32.exe 19 2392 rundll32.exe 22 2932 rundll32.exe 23 2932 rundll32.exe 26 2488 rundll32.exe 27 2488 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
Utsysc.exeUtsysc.exeUtsysc.exepid process 2888 Utsysc.exe 1656 Utsysc.exe 2996 Utsysc.exe -
Loads dropped DLL 44 IoCs
Processes:
50b59ec66299f7a528e35b5747cff7ec.exerundll32.exerundll32.exeWerFault.exerundll32.exerundll32.exeWerFault.exerundll32.exerundll32.exeWerFault.exerundll32.exerundll32.exerundll32.exepid process 2060 50b59ec66299f7a528e35b5747cff7ec.exe 2060 50b59ec66299f7a528e35b5747cff7ec.exe 2564 rundll32.exe 2564 rundll32.exe 2564 rundll32.exe 2564 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2940 WerFault.exe 2940 WerFault.exe 2120 rundll32.exe 2120 rundll32.exe 2120 rundll32.exe 2120 rundll32.exe 868 rundll32.exe 868 rundll32.exe 868 rundll32.exe 868 rundll32.exe 1956 WerFault.exe 1956 WerFault.exe 620 rundll32.exe 620 rundll32.exe 620 rundll32.exe 620 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe 676 WerFault.exe 676 WerFault.exe 2392 rundll32.exe 2392 rundll32.exe 2392 rundll32.exe 2392 rundll32.exe 2932 rundll32.exe 2932 rundll32.exe 2932 rundll32.exe 2932 rundll32.exe 2488 rundll32.exe 2488 rundll32.exe 2488 rundll32.exe 2488 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
50b59ec66299f7a528e35b5747cff7ec.exepid process 2060 50b59ec66299f7a528e35b5747cff7ec.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
50b59ec66299f7a528e35b5747cff7ec.exeUtsysc.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exetaskeng.exedescription pid process target process PID 2060 wrote to memory of 2888 2060 50b59ec66299f7a528e35b5747cff7ec.exe Utsysc.exe PID 2060 wrote to memory of 2888 2060 50b59ec66299f7a528e35b5747cff7ec.exe Utsysc.exe PID 2060 wrote to memory of 2888 2060 50b59ec66299f7a528e35b5747cff7ec.exe Utsysc.exe PID 2060 wrote to memory of 2888 2060 50b59ec66299f7a528e35b5747cff7ec.exe Utsysc.exe PID 2888 wrote to memory of 2796 2888 Utsysc.exe schtasks.exe PID 2888 wrote to memory of 2796 2888 Utsysc.exe schtasks.exe PID 2888 wrote to memory of 2796 2888 Utsysc.exe schtasks.exe PID 2888 wrote to memory of 2796 2888 Utsysc.exe schtasks.exe PID 2888 wrote to memory of 2564 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2564 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2564 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2564 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2564 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2564 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2564 2888 Utsysc.exe rundll32.exe PID 2564 wrote to memory of 2680 2564 rundll32.exe rundll32.exe PID 2564 wrote to memory of 2680 2564 rundll32.exe rundll32.exe PID 2564 wrote to memory of 2680 2564 rundll32.exe rundll32.exe PID 2564 wrote to memory of 2680 2564 rundll32.exe rundll32.exe PID 2680 wrote to memory of 2940 2680 rundll32.exe WerFault.exe PID 2680 wrote to memory of 2940 2680 rundll32.exe WerFault.exe PID 2680 wrote to memory of 2940 2680 rundll32.exe WerFault.exe PID 2888 wrote to memory of 2120 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2120 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2120 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2120 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2120 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2120 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2120 2888 Utsysc.exe rundll32.exe PID 2120 wrote to memory of 868 2120 rundll32.exe rundll32.exe PID 2120 wrote to memory of 868 2120 rundll32.exe rundll32.exe PID 2120 wrote to memory of 868 2120 rundll32.exe rundll32.exe PID 2120 wrote to memory of 868 2120 rundll32.exe rundll32.exe PID 868 wrote to memory of 1956 868 rundll32.exe WerFault.exe PID 868 wrote to memory of 1956 868 rundll32.exe WerFault.exe PID 868 wrote to memory of 1956 868 rundll32.exe WerFault.exe PID 2888 wrote to memory of 620 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 620 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 620 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 620 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 620 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 620 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 620 2888 Utsysc.exe rundll32.exe PID 620 wrote to memory of 1748 620 rundll32.exe rundll32.exe PID 620 wrote to memory of 1748 620 rundll32.exe rundll32.exe PID 620 wrote to memory of 1748 620 rundll32.exe rundll32.exe PID 620 wrote to memory of 1748 620 rundll32.exe rundll32.exe PID 1748 wrote to memory of 676 1748 rundll32.exe WerFault.exe PID 1748 wrote to memory of 676 1748 rundll32.exe WerFault.exe PID 1748 wrote to memory of 676 1748 rundll32.exe WerFault.exe PID 1116 wrote to memory of 1656 1116 taskeng.exe Utsysc.exe PID 1116 wrote to memory of 1656 1116 taskeng.exe Utsysc.exe PID 1116 wrote to memory of 1656 1116 taskeng.exe Utsysc.exe PID 1116 wrote to memory of 1656 1116 taskeng.exe Utsysc.exe PID 2888 wrote to memory of 2392 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2392 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2392 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2392 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2392 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2392 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2392 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2932 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2932 2888 Utsysc.exe rundll32.exe PID 2888 wrote to memory of 2932 2888 Utsysc.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\50b59ec66299f7a528e35b5747cff7ec.exe"C:\Users\Admin\AppData\Local\Temp\50b59ec66299f7a528e35b5747cff7ec.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exe"C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exe" /F3⤵
- Creates scheduled task(s)
PID:2796 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2680 -s 3125⤵
- Loads dropped DLL
PID:2940 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 868 -s 3125⤵
- Loads dropped DLL
PID:1956 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll, Main4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1748 -s 3125⤵
- Loads dropped DLL
PID:676 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2392 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2932 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\2eed656dd58e95\clip64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2488
-
C:\Windows\system32\taskeng.exetaskeng.exe {ECF70658-D9F6-4F29-846F-298B9CE00244} S-1-5-21-2952504676-3105837840-1406404655-1000:URUOZWGF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exe2⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\d4dd819322\Utsysc.exe2⤵
- Executes dropped EXE
PID:2996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD56eca2068c2f956ebfa56ef5c52112ae7
SHA1e55d56fc2dbc031793b99432527e97640d3c193c
SHA256e0e30b58582b8e390eacc5cee9d4385f126317484762709ed0dab5fdd9090f52
SHA512c3a6d272edfb134de2f82d8fd7ab67a2d3fba54b94598fdd7d11612f9bab2354162dd14ff7d76830bfa864bc3cdfec9a775bf7373bea40d8982fd7ae76a706b3
-
Filesize
434KB
MD550b59ec66299f7a528e35b5747cff7ec
SHA11a4a71093b3075a2b28184908fe5e80d03d65e82
SHA2565abd71acc7aaa2bb26c92e6c5d1827b20b8157f74b612b3bd1a6b79e2bd6a2e6
SHA5125b34ca72ddfd01617c0ee622b06117ee825c70c442a04dd4c931ff3ab7f1a449c19fe9127e0ddaaf75395bc00942e7040a1117bf5d20a0042324c430e20ad02d
-
Filesize
434KB
MD550b59ec66299f7a528e35b5747cff7ec
SHA11a4a71093b3075a2b28184908fe5e80d03d65e82
SHA2565abd71acc7aaa2bb26c92e6c5d1827b20b8157f74b612b3bd1a6b79e2bd6a2e6
SHA5125b34ca72ddfd01617c0ee622b06117ee825c70c442a04dd4c931ff3ab7f1a449c19fe9127e0ddaaf75395bc00942e7040a1117bf5d20a0042324c430e20ad02d
-
Filesize
434KB
MD550b59ec66299f7a528e35b5747cff7ec
SHA11a4a71093b3075a2b28184908fe5e80d03d65e82
SHA2565abd71acc7aaa2bb26c92e6c5d1827b20b8157f74b612b3bd1a6b79e2bd6a2e6
SHA5125b34ca72ddfd01617c0ee622b06117ee825c70c442a04dd4c931ff3ab7f1a449c19fe9127e0ddaaf75395bc00942e7040a1117bf5d20a0042324c430e20ad02d
-
Filesize
434KB
MD550b59ec66299f7a528e35b5747cff7ec
SHA11a4a71093b3075a2b28184908fe5e80d03d65e82
SHA2565abd71acc7aaa2bb26c92e6c5d1827b20b8157f74b612b3bd1a6b79e2bd6a2e6
SHA5125b34ca72ddfd01617c0ee622b06117ee825c70c442a04dd4c931ff3ab7f1a449c19fe9127e0ddaaf75395bc00942e7040a1117bf5d20a0042324c430e20ad02d
-
Filesize
434KB
MD550b59ec66299f7a528e35b5747cff7ec
SHA11a4a71093b3075a2b28184908fe5e80d03d65e82
SHA2565abd71acc7aaa2bb26c92e6c5d1827b20b8157f74b612b3bd1a6b79e2bd6a2e6
SHA5125b34ca72ddfd01617c0ee622b06117ee825c70c442a04dd4c931ff3ab7f1a449c19fe9127e0ddaaf75395bc00942e7040a1117bf5d20a0042324c430e20ad02d
-
Filesize
102KB
MD54194e9b8b694b1e9b672c36f0d868e32
SHA1252f27fe313c7bf8e9f36aef0c7b676383872efb
SHA25697e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
SHA512f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7
-
Filesize
102KB
MD54194e9b8b694b1e9b672c36f0d868e32
SHA1252f27fe313c7bf8e9f36aef0c7b676383872efb
SHA25697e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
SHA512f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
434KB
MD550b59ec66299f7a528e35b5747cff7ec
SHA11a4a71093b3075a2b28184908fe5e80d03d65e82
SHA2565abd71acc7aaa2bb26c92e6c5d1827b20b8157f74b612b3bd1a6b79e2bd6a2e6
SHA5125b34ca72ddfd01617c0ee622b06117ee825c70c442a04dd4c931ff3ab7f1a449c19fe9127e0ddaaf75395bc00942e7040a1117bf5d20a0042324c430e20ad02d
-
Filesize
434KB
MD550b59ec66299f7a528e35b5747cff7ec
SHA11a4a71093b3075a2b28184908fe5e80d03d65e82
SHA2565abd71acc7aaa2bb26c92e6c5d1827b20b8157f74b612b3bd1a6b79e2bd6a2e6
SHA5125b34ca72ddfd01617c0ee622b06117ee825c70c442a04dd4c931ff3ab7f1a449c19fe9127e0ddaaf75395bc00942e7040a1117bf5d20a0042324c430e20ad02d
-
Filesize
102KB
MD54194e9b8b694b1e9b672c36f0d868e32
SHA1252f27fe313c7bf8e9f36aef0c7b676383872efb
SHA25697e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
SHA512f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7
-
Filesize
102KB
MD54194e9b8b694b1e9b672c36f0d868e32
SHA1252f27fe313c7bf8e9f36aef0c7b676383872efb
SHA25697e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
SHA512f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7
-
Filesize
102KB
MD54194e9b8b694b1e9b672c36f0d868e32
SHA1252f27fe313c7bf8e9f36aef0c7b676383872efb
SHA25697e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
SHA512f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7
-
Filesize
102KB
MD54194e9b8b694b1e9b672c36f0d868e32
SHA1252f27fe313c7bf8e9f36aef0c7b676383872efb
SHA25697e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
SHA512f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7
-
Filesize
102KB
MD54194e9b8b694b1e9b672c36f0d868e32
SHA1252f27fe313c7bf8e9f36aef0c7b676383872efb
SHA25697e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
SHA512f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7
-
Filesize
102KB
MD54194e9b8b694b1e9b672c36f0d868e32
SHA1252f27fe313c7bf8e9f36aef0c7b676383872efb
SHA25697e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
SHA512f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7
-
Filesize
102KB
MD54194e9b8b694b1e9b672c36f0d868e32
SHA1252f27fe313c7bf8e9f36aef0c7b676383872efb
SHA25697e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
SHA512f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7
-
Filesize
102KB
MD54194e9b8b694b1e9b672c36f0d868e32
SHA1252f27fe313c7bf8e9f36aef0c7b676383872efb
SHA25697e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
SHA512f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7
-
Filesize
102KB
MD54194e9b8b694b1e9b672c36f0d868e32
SHA1252f27fe313c7bf8e9f36aef0c7b676383872efb
SHA25697e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
SHA512f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7
-
Filesize
102KB
MD54194e9b8b694b1e9b672c36f0d868e32
SHA1252f27fe313c7bf8e9f36aef0c7b676383872efb
SHA25697e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
SHA512f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7
-
Filesize
102KB
MD54194e9b8b694b1e9b672c36f0d868e32
SHA1252f27fe313c7bf8e9f36aef0c7b676383872efb
SHA25697e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
SHA512f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7
-
Filesize
102KB
MD54194e9b8b694b1e9b672c36f0d868e32
SHA1252f27fe313c7bf8e9f36aef0c7b676383872efb
SHA25697e342fb4dbfe474ab2674682a816931bb9f56814bf13b20ff11ac1939775125
SHA512f956acdec4c0255030f784d27210d59e30c3377e0a5abec915818bde8545afc3ef04a06395a2bfa5946f86cdf1088c9089bfc5064d9fd71b8137eae14f64e5c7
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63
-
Filesize
1.1MB
MD5f01f5bc76b9596e0cfeab8a272cba3a5
SHA119cab1291e4e518ae636f2fb3d41567e4e6e4722
SHA25683ef6d2414a5c0c9cb6cfe502cb40cdda5c425ee7408a4075e32891f4599d938
SHA512ccfa16f0bbcdb909446fc4d47c1732e0b1baa759d78866fcce9ac7c5c12f1299e74df03b23881f3e37627b358bc6ddd2941c9110e030f6d68dd79f67c9e39f63