Resubmissions
18/04/2024, 05:22
240418-f2z8nscc74 1018/04/2024, 05:22
240418-f2njwade8w 1018/04/2024, 05:21
240418-f2gfkade8s 718/04/2024, 05:21
240418-f2csdacc53 1018/04/2024, 05:21
240418-f2b6vade7x 7Analysis
-
max time kernel
1190s -
max time network
1175s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
18/04/2024, 05:22
General
-
Target
d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe
-
Size
371KB
-
MD5
bb8cd5df2be7e8bcc5be439675b3d0a2
-
SHA1
627ac60f64974d5caaf81c2de8ca0977c91f4219
-
SHA256
d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a
-
SHA512
57031eb7d7b2c27d7ecacdc085d07065ced46a742128f9818f62c9fe6633c31aa8eb20ffc52c8415613787946060f5a6b5adf8b977d5ca4fed9656233ebd9cfa
-
SSDEEP
6144:tnzQnu/cmM1oSigOQT2F8U92Iu7DMVQZhWLvLRXdYX9ji+uhi2PsrhY:hzQnkM1oSiBGI8bxn5m6i+uo20tY
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5ceae7b1-17bf-4fab-bca8-ce293d94e845}\_DECRYPT_INFO_uhoftmy.html
Ransom Note
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
<!-- saved from url=(0014)about:internet -->
<html xmlns='http://www.w3.org/1999/xhtml'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=UTF-8' />
<title>uhoftmy decrypt</title>
<style type='text/css'>
<!--
html, body {margin: 0;padding: 0;margin-left: 0px;margin-top: 0px;margin-right: 0px;margin-bottom: 0px; background-color: #bfbfbf; height: 100%;}
a {color:426BBD; font-family:Tahoma, Verdana, Arial, Helvetica; font-size:12px;}
td {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f0f0f0;
font-size: 14px;
}
.style1 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #d7001e;
font-size: 48px;
}
.style3 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f5e700;
font-size: 60px;
}
.style4 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #28caf9;
font-size: 14px;
}
.style5 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f5e700;
font-size: 14px;
}
.style6 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #d7001e;
font-size: 14px;
}
.style7 {
width:685px;
height:120px;
background-color:#393838;
border:1px solid #565656;
font-family: Courier New;
font-weight: bold;
color: #f0f0f0;
font-size: 13px;
}
.styled-select select {
background-color:#393838;
font-weight: bold;
color: #f0f0f0;
width: 178px;
padding: 5px;
font-size: 16px;
line-height: 1;
border: 0;
border-radius: 0;
height: 34px;
-webkit-appearance: none;
}
-->
</style>
<script type='text/javascript'>
function init()
{
var xtime;
document.getElementById('fe_text').innerHTML = '00:00:00';
var language = window.navigator.userLanguage || window.navigator.language;
if (language.indexOf('-') !== -1)
language = language.split('-')[0];
if (language.indexOf('_') !== -1)
language = language.split('_')[0];
change_lang(language);
var ua = window.navigator.userAgent;
var msie = ua.indexOf('MSIE ');
xtime = Math.floor( (1713419021+(12*60*60)) - (Date.now()/1000));
if (msie == 0)
window.setTimeout('update_timestamp('+xtime+')',1000);
else
update_timestamp(xtime);
}
function component(x, y, z)
{
var res
if (z == 1)
res = Math.floor(x / y);
else
res = Math.floor(x / y) % z;
if (res < 10)
res = '0'+res;
return res;
}
function update_timestamp(tstamp)
{
if (tstamp < 1)
{
document.getElementById('fe_text').innerHTML = '00:00:00';
}
else
{
var hours = component(tstamp, 60*60, 1),
minutes = component(tstamp, 60, 60),
seconds = component(tstamp, 1, 60);
document.getElementById('fe_text').innerHTML = hours+':'+minutes+':'+seconds;
tstamp-=1;
window.setTimeout('update_timestamp('+tstamp+')',1000);
}
}
function change_lang(lang)
{
if (lang == "de")
show_de();
else if (lang == "es")
show_es();
else if (lang == "fr")
show_fr();
else if (lang == "it")
show_it();
else if (lang == "nl")
show_nl();
else
show_en();
}
function show_en()
{
document.getElementById('text_01').innerHTML = 'WARNING!';
document.getElementById('text_02').innerHTML = 'Your personal files are encrypted.';
document.getElementById('text_03').innerHTML = 'Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.';
document.getElementById('text_09').innerHTML = 'Download TOR Browser from';
document.getElementById('text_10').innerHTML = 'In the Tor Browser open the';
document.getElementById('text_11').innerHTML = '(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).';
document.getElementById('text_12').innerHTML = 'Write in the following public key in the input from on server:';
}
function show_de()
{
document.getElementById('text_01').innerHTML = 'WARNUNG!';
document.getElementById('text_02').innerHTML = 'Ihre persönlichen Dateien sind verschlüsselt!';
document.getElementById('text_03').innerHTML = 'Ihre Dokumente, Fotos, Datenbanken und andere wichtige Dateien wurden mit der stärkste Verschlüsselung und einem einzigartigen Schlüssel verschlüsselt, der für diesen Computer generiert wurde. Der Dechiffrierschlüssel ist auf einem geheimen Internet-Server gespeichert und niemand kann Ihre Dateien entschlüsseln, bis Sie bezahlen und den privaten Schlüssel erhalten. Der Server wird den Schlüssel nach einer bestimmten Zeit löschen, die in diesem Fenster angezeigt wird.';
document.getElementById('text_09').innerHTML = 'Laden Sie TOR-Browser von';
document.getElementById('text_10').innerHTML = 'Im Tor-Browser öffnen Sie';
document.getElementById('text_11').innerHTML = '(Beachten Sie, dass dieser Server nur über den Tor-Browser verfügbar ist. Wiederholen Sie den Vorgang nach 1 Stunde, wenn die Website nicht erreichbar ist).';
document.getElementById('text_12').innerHTML = 'Schreiben Sie den folgenden öffentlichen Schlüssel in die Eingabemaske auf dem Server:';
}
function show_es()
{
document.getElementById('text_01').innerHTML = '¡PELIGRO!';
document.getElementById('text_02').innerHTML = '¡Tus archivos personales han sido encriptados!';
document.getElementById('text_03').innerHTML = 'Tus documentos, fotos, bases de datos y otros archivos importantes han sido encriptados con una encriptación extremadamente fuerte y una clave única, generada para este computador. La clave de desencriptación privada está almacenada en un servidor de internet secreto. El servidor eliminará la clave luego del tiempo especificado en esta ventana.';
document.getElementById('text_09').innerHTML = 'Descarga el navegador TOR desde';
document.getElementById('text_10').innerHTML = 'En el navegador TOR abre';
document.getElementById('text_11').innerHTML = '(Nota que este servidor solo es accesible desde el navegador TOR. Intenta nuevamente en 1 hora si no puedes acceder).';
document.getElementById('text_12').innerHTML = 'Escribe la siguiente clave publica en la forma de ingreso del servidor:';
}
function show_fr()
{
document.getElementById('text_01').innerHTML = 'ATTENTION!';
document.getElementById('text_02').innerHTML = 'Vos fichiers personnels ont été cryptés !';
document.getElementById('text_03').innerHTML = 'Vos documents, photos, bases de données, et autres fichiers importants ont été cryptées avec le meilleur processus de cryptage et une clé unique générée pour cet ordinateur. La clé privée de cryptage est accessible sur un serveur Internet secret et personne ne peut décrypter vos fichiers à moins que vous ne payiez et obtenez cette clé. Le serveur éliminera la clé après le compte à rebours affiché sur cette fenêtre.';
document.getElementById('text_09').innerHTML = 'Télécharger le navigateur TOR de';
document.getElementById('text_10').innerHTML = 'Dans le navigateur, ouvrez ';
document.getElementById('text_11').innerHTML = '(Veuillez noter que ce serveur est disponible via le navigateur Tor uniquement. Réessayez dans 1 heure si le site n’est pas accessible).';
document.getElementById('text_12').innerHTML = 'Ecrivez les clés publiques suivantes sur le portail d’entrée du serveur :';
}
function show_it()
{
document.getElementById('text_01').innerHTML = 'ATTENZIONE!';
document.getElementById('text_02').innerHTML = 'I tuoi file personali sono criptati!';
document.getElementById('text_03').innerHTML = 'I tuoi documenti, le tue foto, database e altri file importanti sono stati criptati con forte codificazione ed una chiave unica, generata appositamente per questo computer. La chiave segreta di decriptazione è conservata su un server Internet segreto e nessuno può decriptare i tuoi file finché non paghi per ottenere la chiave. Il server eliminerà la chiave dopo il tempo indicato in questa finestra.';
document.getElementById('text_09').innerHTML = 'Scarica il Browser TOR da';
document.getElementById('text_10').innerHTML = 'Nel Browser TOR apri il link';
document.getElementById('text_11').innerHTML = '(Nota che questo server è disponibile solo tramite il Browser TOR. Riprova tra un’ora se il sito non è raggiungibile).';
document.getElementById('text_12').innerHTML = 'Scrivi la seguente chiave pubblica nel modulo di input sul server:';
}
function show_nl()
{
document.getElementById('text_01').innerHTML = 'WAARSCHUWING!';
document.getElementById('text_02').innerHTML = 'Uw persoonlijke bestanden zijn gecodeerd!';
document.getElementById('text_03').innerHTML = 'Uw documenten, foto’s, databases en andere belangrijke bestanden zijn gecodeerd met de sterkste encryptie en een unieke sleutel, gegenereerd voor deze computer. De persoonlijke decoderingssleutel is te vinden op een geheime Internet server en niemand kan uw bestanden decoderen totdat u betaalt en de persoonlijke sleutel heeft. De server zal de sleutel elimineren na de tijdsperiode genoemd in dit venster.';
document.getElementById('text_09').innerHTML = 'Download de TOR Browser van';
document.getElementById('text_10').innerHTML = 'In de Tor Browser, open';
document.getElementById('text_11').innerHTML = '(Let op dat deze server alleen via de Tor Browser te bereiken is. Probeer het na een uur weer als de site niet werkt).';
document.getElementById('text_12').innerHTML = 'Schrijf in de volgende openbare sleutel in het invoerformulier op de server:';
}
//var language = window.navigator.userLanguage || window.navigator.language;
//alert(language);
</script>
</head>
<body onload='init();'>
<div align='center'>
<table width='700' height='100%' border='0' cellpadding='0' cellspacing='0' bgcolor='#000000'>
<tr>
<td width='225' align='left'><img src='file:///C:/Users/Admin/AppData/Local/Temp/uhoftmy.gif' width='225' height='221' /></td>
<td width='415' valign='top'><div align='center' class='style1' id='text_01'>WARNING!</div><br />
<div align='center' id='text_02'>Your personal files are encrypted.<br />
<br />
<br />
</div>
<div align='center' class='style3' id='fe_text'></div></p>
<div class="styled-select" align='center'>
<select id ="ddl" name="ddl" onmousedown="this.value='';" onchange="change_lang(this.value);">
<option selected disabled value="" style="display:none;">Select language</option>
<option value='en'> ENGLISH</option>
<option value='de'> GERMAN</option>
<option value='es'> SPANISH</option>
<option value='fr'> FRENCH</option>
<option value='it'> ITALIAN</option>
<option value='nl'> DUTCH</option>
</select>
</div>
</td>
</tr>
<tr>
<td colspan='2' align='center'><table width='97%' border='0' cellpadding='0' cellspacing='0'>
<tr>
<td colspan='2' align='left'>
<br />
<div id='text_03'>Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.</div><br />
<br />
</td>
</tr>
<tr>
<td colspan='2' align='left'>
1) <span id='text_09'>Download TOR Browser from</span> <a href='http://torproject.org' class='style4'>http://torproject.org</a><br />
2) <span id='text_10'>In the Tor Browser open the</span> <span class='style6'>http://maktubmpcxqmo6gi.onion</span><br /><br />
<span id='text_11'>(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).</span><br />
<br />
<span class='style5' id='text_12'>Write in the following public key in the input from on server:</span><br /><br />
<div align='center'><textarea class='style7'>
PDED3-XJ2NC-DGF4G-540VZ-B5XWX-BMG0N-CJEZV-MY81T-KK704-RM5CC-XA7A5-1Z5ZA-7364T-4WG7W
UKSEC-UW4W5-YNJTZ-5X2UJ-4GW32-A8J8D-36JN0-04VF4-WWSRE-UCQ1K-P5Q2G-NSBST-HKW2H-T5U6W
J3DFC-EFQU1-FCQNF-DYK53-GRPCD-3XZ6E-WQ7D5-8467E-QW007-SC0Z5-C0ZFJ-E5U4U-FTG71-5QJAZ
KHK5R-JKK0K-2JUVU-GEXSC-GQ1GQ-SEQA3-X7DPH-SJTG1-MAA11-YMVBB-DTFZY-0C4UF-U4AY7-HRDS4
XVN7N-Q4S4T-38KM4-TW75T-YCVQH-28PGM-CC2CS-2K658-APA6Y-UXH53-7J51H-NVC12-UST2A-HHZ8S
CJ80U-2RX33-BEM87-J1PV5-PEFQM-SFVYE-PV4UJ-HJMS2-50BP1-V1Z36-MCEPU-53GAQ
</textarea>
<br />
</div>
<br />
<br />
<br />
</div>
</td>
</tr>
</table></td>
</tr>
</table>
</div>
</body>
</html>
URLs
http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
http-equiv='Content-Type
Extracted
Path
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\_DECRYPT_INFO_uhoftmy.html
Ransom Note
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
<!-- saved from url=(0014)about:internet -->
<html xmlns='http://www.w3.org/1999/xhtml'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=UTF-8' />
<title>uhoftmy decrypt</title>
<style type='text/css'>
<!--
html, body {margin: 0;padding: 0;margin-left: 0px;margin-top: 0px;margin-right: 0px;margin-bottom: 0px; background-color: #bfbfbf; height: 100%;}
a {color:426BBD; font-family:Tahoma, Verdana, Arial, Helvetica; font-size:12px;}
td {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f0f0f0;
font-size: 14px;
}
.style1 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #d7001e;
font-size: 48px;
}
.style3 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f5e700;
font-size: 60px;
}
.style4 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #28caf9;
font-size: 14px;
}
.style5 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f5e700;
font-size: 14px;
}
.style6 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #d7001e;
font-size: 14px;
}
.style7 {
width:685px;
height:120px;
background-color:#393838;
border:1px solid #565656;
font-family: Courier New;
font-weight: bold;
color: #f0f0f0;
font-size: 13px;
}
.styled-select select {
background-color:#393838;
font-weight: bold;
color: #f0f0f0;
width: 178px;
padding: 5px;
font-size: 16px;
line-height: 1;
border: 0;
border-radius: 0;
height: 34px;
-webkit-appearance: none;
}
-->
</style>
<script type='text/javascript'>
function init()
{
var xtime;
document.getElementById('fe_text').innerHTML = '00:00:00';
var language = window.navigator.userLanguage || window.navigator.language;
if (language.indexOf('-') !== -1)
language = language.split('-')[0];
if (language.indexOf('_') !== -1)
language = language.split('_')[0];
change_lang(language);
var ua = window.navigator.userAgent;
var msie = ua.indexOf('MSIE ');
xtime = Math.floor( (1713419032+(12*60*60)) - (Date.now()/1000));
if (msie == 0)
window.setTimeout('update_timestamp('+xtime+')',1000);
else
update_timestamp(xtime);
}
function component(x, y, z)
{
var res
if (z == 1)
res = Math.floor(x / y);
else
res = Math.floor(x / y) % z;
if (res < 10)
res = '0'+res;
return res;
}
function update_timestamp(tstamp)
{
if (tstamp < 1)
{
document.getElementById('fe_text').innerHTML = '00:00:00';
}
else
{
var hours = component(tstamp, 60*60, 1),
minutes = component(tstamp, 60, 60),
seconds = component(tstamp, 1, 60);
document.getElementById('fe_text').innerHTML = hours+':'+minutes+':'+seconds;
tstamp-=1;
window.setTimeout('update_timestamp('+tstamp+')',1000);
}
}
function change_lang(lang)
{
if (lang == "de")
show_de();
else if (lang == "es")
show_es();
else if (lang == "fr")
show_fr();
else if (lang == "it")
show_it();
else if (lang == "nl")
show_nl();
else
show_en();
}
function show_en()
{
document.getElementById('text_01').innerHTML = 'WARNING!';
document.getElementById('text_02').innerHTML = 'Your personal files are encrypted.';
document.getElementById('text_03').innerHTML = 'Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.';
document.getElementById('text_09').innerHTML = 'Download TOR Browser from';
document.getElementById('text_10').innerHTML = 'In the Tor Browser open the';
document.getElementById('text_11').innerHTML = '(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).';
document.getElementById('text_12').innerHTML = 'Write in the following public key in the input from on server:';
}
function show_de()
{
document.getElementById('text_01').innerHTML = 'WARNUNG!';
document.getElementById('text_02').innerHTML = 'Ihre persönlichen Dateien sind verschlüsselt!';
document.getElementById('text_03').innerHTML = 'Ihre Dokumente, Fotos, Datenbanken und andere wichtige Dateien wurden mit der stärkste Verschlüsselung und einem einzigartigen Schlüssel verschlüsselt, der für diesen Computer generiert wurde. Der Dechiffrierschlüssel ist auf einem geheimen Internet-Server gespeichert und niemand kann Ihre Dateien entschlüsseln, bis Sie bezahlen und den privaten Schlüssel erhalten. Der Server wird den Schlüssel nach einer bestimmten Zeit löschen, die in diesem Fenster angezeigt wird.';
document.getElementById('text_09').innerHTML = 'Laden Sie TOR-Browser von';
document.getElementById('text_10').innerHTML = 'Im Tor-Browser öffnen Sie';
document.getElementById('text_11').innerHTML = '(Beachten Sie, dass dieser Server nur über den Tor-Browser verfügbar ist. Wiederholen Sie den Vorgang nach 1 Stunde, wenn die Website nicht erreichbar ist).';
document.getElementById('text_12').innerHTML = 'Schreiben Sie den folgenden öffentlichen Schlüssel in die Eingabemaske auf dem Server:';
}
function show_es()
{
document.getElementById('text_01').innerHTML = '¡PELIGRO!';
document.getElementById('text_02').innerHTML = '¡Tus archivos personales han sido encriptados!';
document.getElementById('text_03').innerHTML = 'Tus documentos, fotos, bases de datos y otros archivos importantes han sido encriptados con una encriptación extremadamente fuerte y una clave única, generada para este computador. La clave de desencriptación privada está almacenada en un servidor de internet secreto. El servidor eliminará la clave luego del tiempo especificado en esta ventana.';
document.getElementById('text_09').innerHTML = 'Descarga el navegador TOR desde';
document.getElementById('text_10').innerHTML = 'En el navegador TOR abre';
document.getElementById('text_11').innerHTML = '(Nota que este servidor solo es accesible desde el navegador TOR. Intenta nuevamente en 1 hora si no puedes acceder).';
document.getElementById('text_12').innerHTML = 'Escribe la siguiente clave publica en la forma de ingreso del servidor:';
}
function show_fr()
{
document.getElementById('text_01').innerHTML = 'ATTENTION!';
document.getElementById('text_02').innerHTML = 'Vos fichiers personnels ont été cryptés !';
document.getElementById('text_03').innerHTML = 'Vos documents, photos, bases de données, et autres fichiers importants ont été cryptées avec le meilleur processus de cryptage et une clé unique générée pour cet ordinateur. La clé privée de cryptage est accessible sur un serveur Internet secret et personne ne peut décrypter vos fichiers à moins que vous ne payiez et obtenez cette clé. Le serveur éliminera la clé après le compte à rebours affiché sur cette fenêtre.';
document.getElementById('text_09').innerHTML = 'Télécharger le navigateur TOR de';
document.getElementById('text_10').innerHTML = 'Dans le navigateur, ouvrez ';
document.getElementById('text_11').innerHTML = '(Veuillez noter que ce serveur est disponible via le navigateur Tor uniquement. Réessayez dans 1 heure si le site n’est pas accessible).';
document.getElementById('text_12').innerHTML = 'Ecrivez les clés publiques suivantes sur le portail d’entrée du serveur :';
}
function show_it()
{
document.getElementById('text_01').innerHTML = 'ATTENZIONE!';
document.getElementById('text_02').innerHTML = 'I tuoi file personali sono criptati!';
document.getElementById('text_03').innerHTML = 'I tuoi documenti, le tue foto, database e altri file importanti sono stati criptati con forte codificazione ed una chiave unica, generata appositamente per questo computer. La chiave segreta di decriptazione è conservata su un server Internet segreto e nessuno può decriptare i tuoi file finché non paghi per ottenere la chiave. Il server eliminerà la chiave dopo il tempo indicato in questa finestra.';
document.getElementById('text_09').innerHTML = 'Scarica il Browser TOR da';
document.getElementById('text_10').innerHTML = 'Nel Browser TOR apri il link';
document.getElementById('text_11').innerHTML = '(Nota che questo server è disponibile solo tramite il Browser TOR. Riprova tra un’ora se il sito non è raggiungibile).';
document.getElementById('text_12').innerHTML = 'Scrivi la seguente chiave pubblica nel modulo di input sul server:';
}
function show_nl()
{
document.getElementById('text_01').innerHTML = 'WAARSCHUWING!';
document.getElementById('text_02').innerHTML = 'Uw persoonlijke bestanden zijn gecodeerd!';
document.getElementById('text_03').innerHTML = 'Uw documenten, foto’s, databases en andere belangrijke bestanden zijn gecodeerd met de sterkste encryptie en een unieke sleutel, gegenereerd voor deze computer. De persoonlijke decoderingssleutel is te vinden op een geheime Internet server en niemand kan uw bestanden decoderen totdat u betaalt en de persoonlijke sleutel heeft. De server zal de sleutel elimineren na de tijdsperiode genoemd in dit venster.';
document.getElementById('text_09').innerHTML = 'Download de TOR Browser van';
document.getElementById('text_10').innerHTML = 'In de Tor Browser, open';
document.getElementById('text_11').innerHTML = '(Let op dat deze server alleen via de Tor Browser te bereiken is. Probeer het na een uur weer als de site niet werkt).';
document.getElementById('text_12').innerHTML = 'Schrijf in de volgende openbare sleutel in het invoerformulier op de server:';
}
//var language = window.navigator.userLanguage || window.navigator.language;
//alert(language);
</script>
</head>
<body onload='init();'>
<div align='center'>
<table width='700' height='100%' border='0' cellpadding='0' cellspacing='0' bgcolor='#000000'>
<tr>
<td width='225' align='left'><img src='file:///C:/Users/Admin/AppData/Local/Temp/uhoftmy.gif' width='225' height='221' /></td>
<td width='415' valign='top'><div align='center' class='style1' id='text_01'>WARNING!</div><br />
<div align='center' id='text_02'>Your personal files are encrypted.<br />
<br />
<br />
</div>
<div align='center' class='style3' id='fe_text'></div></p>
<div class="styled-select" align='center'>
<select id ="ddl" name="ddl" onmousedown="this.value='';" onchange="change_lang(this.value);">
<option selected disabled value="" style="display:none;">Select language</option>
<option value='en'> ENGLISH</option>
<option value='de'> GERMAN</option>
<option value='es'> SPANISH</option>
<option value='fr'> FRENCH</option>
<option value='it'> ITALIAN</option>
<option value='nl'> DUTCH</option>
</select>
</div>
</td>
</tr>
<tr>
<td colspan='2' align='center'><table width='97%' border='0' cellpadding='0' cellspacing='0'>
<tr>
<td colspan='2' align='left'>
<br />
<div id='text_03'>Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.</div><br />
<br />
</td>
</tr>
<tr>
<td colspan='2' align='left'>
1) <span id='text_09'>Download TOR Browser from</span> <a href='http://torproject.org' class='style4'>http://torproject.org</a><br />
2) <span id='text_10'>In the Tor Browser open the</span> <span class='style6'>http://maktubmpcxqmo6gi.onion</span><br /><br />
<span id='text_11'>(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).</span><br />
<br />
<span class='style5' id='text_12'>Write in the following public key in the input from on server:</span><br /><br />
<div align='center'><textarea class='style7'>
PDED3-XJ2NC-DGF4G-540VZ-B5XWX-BMG0N-CJEZV-MY81T-KK704-RM5CC-XA7A5-1Z5ZA-7364T-4WG7W
UKSEC-UW4W5-YNJTZ-5X2UJ-4GW32-A8J8D-36JN0-04VF4-WWSRE-UCQ1K-P5Q2G-NSBST-HKW2H-T5U6W
J3DFC-EFQU1-FCQNF-DYK53-GRPCD-3XZ6E-WQ7D5-8467E-QW007-SC0Z5-C0ZFJ-E5U4U-FTG71-5QJAZ
KHK5R-JKK0K-2JUVU-GEXSC-GQ1GQ-SEQA3-X7DPH-SJTG1-MAA11-YMVBB-DTFZY-0C4UF-U4AY7-HRDS4
XVN7N-Q4S4T-38KM4-TW75T-YCVQH-28PGM-CC2CS-2K658-APA6Y-UXH53-7J51H-NVC12-UST2A-HHZ8S
CJ80U-2RX33-BEM87-J1PV5-PEFQM-SFVYE-PV4UJ-HJMS2-50BP1-V1Z36-MCEPU-53GAQ
</textarea>
<br />
</div>
<br />
<br />
<br />
</div>
</td>
</tr>
</table></td>
</tr>
</table>
</div>
</body>
</html>
URLs
http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
http-equiv='Content-Type
Extracted
Path
C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\_DECRYPT_INFO_uhoftmy.html
Ransom Note
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
<!-- saved from url=(0014)about:internet -->
<html xmlns='http://www.w3.org/1999/xhtml'>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=UTF-8' />
<title>uhoftmy decrypt</title>
<style type='text/css'>
<!--
html, body {margin: 0;padding: 0;margin-left: 0px;margin-top: 0px;margin-right: 0px;margin-bottom: 0px; background-color: #bfbfbf; height: 100%;}
a {color:426BBD; font-family:Tahoma, Verdana, Arial, Helvetica; font-size:12px;}
td {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f0f0f0;
font-size: 14px;
}
.style1 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #d7001e;
font-size: 48px;
}
.style3 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f5e700;
font-size: 60px;
}
.style4 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #28caf9;
font-size: 14px;
}
.style5 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #f5e700;
font-size: 14px;
}
.style6 {
font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight: bold;
color: #d7001e;
font-size: 14px;
}
.style7 {
width:685px;
height:120px;
background-color:#393838;
border:1px solid #565656;
font-family: Courier New;
font-weight: bold;
color: #f0f0f0;
font-size: 13px;
}
.styled-select select {
background-color:#393838;
font-weight: bold;
color: #f0f0f0;
width: 178px;
padding: 5px;
font-size: 16px;
line-height: 1;
border: 0;
border-radius: 0;
height: 34px;
-webkit-appearance: none;
}
-->
</style>
<script type='text/javascript'>
function init()
{
var xtime;
document.getElementById('fe_text').innerHTML = '00:00:00';
var language = window.navigator.userLanguage || window.navigator.language;
if (language.indexOf('-') !== -1)
language = language.split('-')[0];
if (language.indexOf('_') !== -1)
language = language.split('_')[0];
change_lang(language);
var ua = window.navigator.userAgent;
var msie = ua.indexOf('MSIE ');
xtime = Math.floor( (1713419033+(12*60*60)) - (Date.now()/1000));
if (msie == 0)
window.setTimeout('update_timestamp('+xtime+')',1000);
else
update_timestamp(xtime);
}
function component(x, y, z)
{
var res
if (z == 1)
res = Math.floor(x / y);
else
res = Math.floor(x / y) % z;
if (res < 10)
res = '0'+res;
return res;
}
function update_timestamp(tstamp)
{
if (tstamp < 1)
{
document.getElementById('fe_text').innerHTML = '00:00:00';
}
else
{
var hours = component(tstamp, 60*60, 1),
minutes = component(tstamp, 60, 60),
seconds = component(tstamp, 1, 60);
document.getElementById('fe_text').innerHTML = hours+':'+minutes+':'+seconds;
tstamp-=1;
window.setTimeout('update_timestamp('+tstamp+')',1000);
}
}
function change_lang(lang)
{
if (lang == "de")
show_de();
else if (lang == "es")
show_es();
else if (lang == "fr")
show_fr();
else if (lang == "it")
show_it();
else if (lang == "nl")
show_nl();
else
show_en();
}
function show_en()
{
document.getElementById('text_01').innerHTML = 'WARNING!';
document.getElementById('text_02').innerHTML = 'Your personal files are encrypted.';
document.getElementById('text_03').innerHTML = 'Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.';
document.getElementById('text_09').innerHTML = 'Download TOR Browser from';
document.getElementById('text_10').innerHTML = 'In the Tor Browser open the';
document.getElementById('text_11').innerHTML = '(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).';
document.getElementById('text_12').innerHTML = 'Write in the following public key in the input from on server:';
}
function show_de()
{
document.getElementById('text_01').innerHTML = 'WARNUNG!';
document.getElementById('text_02').innerHTML = 'Ihre persönlichen Dateien sind verschlüsselt!';
document.getElementById('text_03').innerHTML = 'Ihre Dokumente, Fotos, Datenbanken und andere wichtige Dateien wurden mit der stärkste Verschlüsselung und einem einzigartigen Schlüssel verschlüsselt, der für diesen Computer generiert wurde. Der Dechiffrierschlüssel ist auf einem geheimen Internet-Server gespeichert und niemand kann Ihre Dateien entschlüsseln, bis Sie bezahlen und den privaten Schlüssel erhalten. Der Server wird den Schlüssel nach einer bestimmten Zeit löschen, die in diesem Fenster angezeigt wird.';
document.getElementById('text_09').innerHTML = 'Laden Sie TOR-Browser von';
document.getElementById('text_10').innerHTML = 'Im Tor-Browser öffnen Sie';
document.getElementById('text_11').innerHTML = '(Beachten Sie, dass dieser Server nur über den Tor-Browser verfügbar ist. Wiederholen Sie den Vorgang nach 1 Stunde, wenn die Website nicht erreichbar ist).';
document.getElementById('text_12').innerHTML = 'Schreiben Sie den folgenden öffentlichen Schlüssel in die Eingabemaske auf dem Server:';
}
function show_es()
{
document.getElementById('text_01').innerHTML = '¡PELIGRO!';
document.getElementById('text_02').innerHTML = '¡Tus archivos personales han sido encriptados!';
document.getElementById('text_03').innerHTML = 'Tus documentos, fotos, bases de datos y otros archivos importantes han sido encriptados con una encriptación extremadamente fuerte y una clave única, generada para este computador. La clave de desencriptación privada está almacenada en un servidor de internet secreto. El servidor eliminará la clave luego del tiempo especificado en esta ventana.';
document.getElementById('text_09').innerHTML = 'Descarga el navegador TOR desde';
document.getElementById('text_10').innerHTML = 'En el navegador TOR abre';
document.getElementById('text_11').innerHTML = '(Nota que este servidor solo es accesible desde el navegador TOR. Intenta nuevamente en 1 hora si no puedes acceder).';
document.getElementById('text_12').innerHTML = 'Escribe la siguiente clave publica en la forma de ingreso del servidor:';
}
function show_fr()
{
document.getElementById('text_01').innerHTML = 'ATTENTION!';
document.getElementById('text_02').innerHTML = 'Vos fichiers personnels ont été cryptés !';
document.getElementById('text_03').innerHTML = 'Vos documents, photos, bases de données, et autres fichiers importants ont été cryptées avec le meilleur processus de cryptage et une clé unique générée pour cet ordinateur. La clé privée de cryptage est accessible sur un serveur Internet secret et personne ne peut décrypter vos fichiers à moins que vous ne payiez et obtenez cette clé. Le serveur éliminera la clé après le compte à rebours affiché sur cette fenêtre.';
document.getElementById('text_09').innerHTML = 'Télécharger le navigateur TOR de';
document.getElementById('text_10').innerHTML = 'Dans le navigateur, ouvrez ';
document.getElementById('text_11').innerHTML = '(Veuillez noter que ce serveur est disponible via le navigateur Tor uniquement. Réessayez dans 1 heure si le site n’est pas accessible).';
document.getElementById('text_12').innerHTML = 'Ecrivez les clés publiques suivantes sur le portail d’entrée du serveur :';
}
function show_it()
{
document.getElementById('text_01').innerHTML = 'ATTENZIONE!';
document.getElementById('text_02').innerHTML = 'I tuoi file personali sono criptati!';
document.getElementById('text_03').innerHTML = 'I tuoi documenti, le tue foto, database e altri file importanti sono stati criptati con forte codificazione ed una chiave unica, generata appositamente per questo computer. La chiave segreta di decriptazione è conservata su un server Internet segreto e nessuno può decriptare i tuoi file finché non paghi per ottenere la chiave. Il server eliminerà la chiave dopo il tempo indicato in questa finestra.';
document.getElementById('text_09').innerHTML = 'Scarica il Browser TOR da';
document.getElementById('text_10').innerHTML = 'Nel Browser TOR apri il link';
document.getElementById('text_11').innerHTML = '(Nota che questo server è disponibile solo tramite il Browser TOR. Riprova tra un’ora se il sito non è raggiungibile).';
document.getElementById('text_12').innerHTML = 'Scrivi la seguente chiave pubblica nel modulo di input sul server:';
}
function show_nl()
{
document.getElementById('text_01').innerHTML = 'WAARSCHUWING!';
document.getElementById('text_02').innerHTML = 'Uw persoonlijke bestanden zijn gecodeerd!';
document.getElementById('text_03').innerHTML = 'Uw documenten, foto’s, databases en andere belangrijke bestanden zijn gecodeerd met de sterkste encryptie en een unieke sleutel, gegenereerd voor deze computer. De persoonlijke decoderingssleutel is te vinden op een geheime Internet server en niemand kan uw bestanden decoderen totdat u betaalt en de persoonlijke sleutel heeft. De server zal de sleutel elimineren na de tijdsperiode genoemd in dit venster.';
document.getElementById('text_09').innerHTML = 'Download de TOR Browser van';
document.getElementById('text_10').innerHTML = 'In de Tor Browser, open';
document.getElementById('text_11').innerHTML = '(Let op dat deze server alleen via de Tor Browser te bereiken is. Probeer het na een uur weer als de site niet werkt).';
document.getElementById('text_12').innerHTML = 'Schrijf in de volgende openbare sleutel in het invoerformulier op de server:';
}
//var language = window.navigator.userLanguage || window.navigator.language;
//alert(language);
</script>
</head>
<body onload='init();'>
<div align='center'>
<table width='700' height='100%' border='0' cellpadding='0' cellspacing='0' bgcolor='#000000'>
<tr>
<td width='225' align='left'><img src='file:///C:/Users/Admin/AppData/Local/Temp/uhoftmy.gif' width='225' height='221' /></td>
<td width='415' valign='top'><div align='center' class='style1' id='text_01'>WARNING!</div><br />
<div align='center' id='text_02'>Your personal files are encrypted.<br />
<br />
<br />
</div>
<div align='center' class='style3' id='fe_text'></div></p>
<div class="styled-select" align='center'>
<select id ="ddl" name="ddl" onmousedown="this.value='';" onchange="change_lang(this.value);">
<option selected disabled value="" style="display:none;">Select language</option>
<option value='en'> ENGLISH</option>
<option value='de'> GERMAN</option>
<option value='es'> SPANISH</option>
<option value='fr'> FRENCH</option>
<option value='it'> ITALIAN</option>
<option value='nl'> DUTCH</option>
</select>
</div>
</td>
</tr>
<tr>
<td colspan='2' align='center'><table width='97%' border='0' cellpadding='0' cellspacing='0'>
<tr>
<td colspan='2' align='left'>
<br />
<div id='text_03'>Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.</div><br />
<br />
</td>
</tr>
<tr>
<td colspan='2' align='left'>
1) <span id='text_09'>Download TOR Browser from</span> <a href='http://torproject.org' class='style4'>http://torproject.org</a><br />
2) <span id='text_10'>In the Tor Browser open the</span> <span class='style6'>http://maktubmpcxqmo6gi.onion</span><br /><br />
<span id='text_11'>(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).</span><br />
<br />
<span class='style5' id='text_12'>Write in the following public key in the input from on server:</span><br /><br />
<div align='center'><textarea class='style7'>
PDED3-XJ2NC-DGF4G-540VZ-B5XWX-BMG0N-CJEZV-MY81T-KK704-RM5CC-XA7A5-1Z5ZA-7364T-4WG7W
UKSEC-UW4W5-YNJTZ-5X2UJ-4GW32-A8J8D-36JN0-04VF4-WWSRE-UCQ1K-P5Q2G-NSBST-HKW2H-T5U6W
J3DFC-EFQU1-FCQNF-DYK53-GRPCD-3XZ6E-WQ7D5-8467E-QW007-SC0Z5-C0ZFJ-E5U4U-FTG71-5QJAZ
KHK5R-JKK0K-2JUVU-GEXSC-GQ1GQ-SEQA3-X7DPH-SJTG1-MAA11-YMVBB-DTFZY-0C4UF-U4AY7-HRDS4
XVN7N-Q4S4T-38KM4-TW75T-YCVQH-28PGM-CC2CS-2K658-APA6Y-UXH53-7J51H-NVC12-UST2A-HHZ8S
CJ80U-2RX33-BEM87-J1PV5-PEFQM-SFVYE-PV4UJ-HJMS2-50BP1-V1Z36-MCEPU-53GAQ
</textarea>
<br />
</div>
<br />
<br />
<br />
</div>
</td>
</tr>
</table></td>
</tr>
</table>
</div>
</body>
</html>
URLs
http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>
http-equiv='Content-Type
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (241) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe"C:\Users\Admin\AppData\Local\Temp\d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.rtf" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5c50f1090809febf901988f16d981c8f0
SHA1f665f8b0e241565b1a88f1eeb2712f7b2d97fa2f
SHA25636da24a727192a783fbf7171a61e4339d84b1818f58194f3042fd56b7ad53928
SHA512fc8e61e3a818ed58e9c806bc547ce2cab4894bb290b2bc8a827c569d1b76b248ae5312742538075b2cf83c6cd7733e93806bc7649a5da20827daae9b53ba188d
-
Filesize
12KB
MD51217ab9e4ed9344cc0a0430f89499e0d
SHA1695e6a95769034f0304186d54c3b1288033c92c0
SHA256051aeda1de9c4def7044cd0241b31d7acfa2ee73040d024543872fee89d025f7
SHA512b8116f6a066cb1483a7498bc891a0b69bff963a620a1e89a5e1a0e2e290e4e85f43c28ae6110f867a24c2f3a3a2f06c645f15e318901ed2cdc79406c53b9e207
-
Filesize
48B
MD521128fded1b078de65d3db8c6394c8e4
SHA10edbdad1d6b98860976d22298f372c81fca18fb4
SHA25652a0bf60b2ca4cceabb658b311360543f8a5f3aa1bf03cf0f8b90565a3864a83
SHA5127deb400ff07fb829d94e00c1bf9f6cdff341c75abca7d77fb10e74b3cbc904ad9be0a0f58a102193074107e0dcb075cc51533846cad8458ee02edf85d21051be
-
Filesize
48B
MD559fb1826eb26f99e46221399d7ec3117
SHA1b7b659e1024034087613b5c920715afbf55b47c6
SHA256abb6df49cd486c338c81c172346dad2a71053041541821d500216686605541a0
SHA512d8aa9ef1d1da720493ab1a11aa35f61640e18fcf7481d786420178eadf9c48b983246f3fcf2d835d3bb603dbdb2c09163b16bd469293b9d94988979ba33a9a0c
-
Filesize
12KB
MD58c5b229f6ca2c0b1fe15da93074f5d15
SHA1218e691e16d26458e8df6e21b68ad914108a41cb
SHA256716ebdbfa7a80c570a3b3a879cc3c9363706eb05d76ff8e29e2e82555850e589
SHA512a69cfe5c524ae0f3dda52c80e55cf881037530a29fed386195e8b82823dd7ddd7545dc6f168fa7626549460c52d1f062f3da66f105a0483d717cb527dd7c2f16
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
4KB
MD52d5020c82de674b48cfd17cc20fcbba2
SHA14e317eaeebd839ee5f6eb3925a9fbee819c5349c
SHA256120becd55248f4a2ccbbc99ba9d3c2932223264a95cd72e9ae7568be61277e9a
SHA512ffbbdda009237d6825f6cd6f751a41f4f9d716186901ffdbeed56c2d1410245771decd07f591cf56cafdd4bbebd4e4c74f009ff15736d5321635e34ff17d0d8d
-
Filesize
160KB
-
Filesize
72KB
-
Filesize
352KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
352KB
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
4KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
32KB
-
Filesize
160KB
-
Filesize
388KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
388KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
72KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB