Analysis
-
max time kernel
147s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:11
Static task
static1
Behavioral task
behavioral1
Sample
cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe
Resource
win10v2004-20220812-en
General
-
Target
cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe
-
Size
602KB
-
MD5
4984dc93f2d86dfbf77d7e13aaaff7a7
-
SHA1
1ee4eb8310bf5036e861f6e416526876fde945db
-
SHA256
cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67
-
SHA512
3b1d60ef5f4dd1fa6c627d26c02866de20449fb1a67733312bb30339562ef00fd2a2dc23fd3afaaeec594cb2d35dabb6d89470b76ce79ca05556fbb718a4e848
-
SSDEEP
12288:2Iny5DYTjUWxjnv99gXLWSS/50laCsDAjvSsmbDd7:4UTjUajnv99KWSS/50laCsDuvS5bDd7
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exedescription ioc process File created C:\Windows\system32\drivers\nethfdrv.sys cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe -
Executes dropped EXE 5 IoCs
Processes:
installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exepid process 5028 installd.exe 1876 nethtsrv.exe 1656 netupdsrv.exe 4576 nethtsrv.exe 4288 netupdsrv.exe -
Loads dropped DLL 14 IoCs
Processes:
cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exeinstalld.exenethtsrv.exenethtsrv.exepid process 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe 5028 installd.exe 1876 nethtsrv.exe 1876 nethtsrv.exe 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe 4576 nethtsrv.exe 4576 nethtsrv.exe 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exedescription ioc process File created C:\Windows\SysWOW64\hfpapi.dll cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe File created C:\Windows\SysWOW64\installd.exe cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe File created C:\Windows\SysWOW64\nethtsrv.exe cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe File created C:\Windows\SysWOW64\netupdsrv.exe cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe File created C:\Windows\SysWOW64\hfnapi.dll cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe -
Drops file in Program Files directory 3 IoCs
Processes:
cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exedescription ioc process File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe File created C:\Program Files (x86)\Common Files\Config\data.xml cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
Processes:
nethtsrv.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 652 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nethtsrv.exedescription pid process Token: SeDebugPrivilege 4576 nethtsrv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exenet.exenet.exenet.exenet.exedescription pid process target process PID 5024 wrote to memory of 4352 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe net.exe PID 5024 wrote to memory of 4352 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe net.exe PID 5024 wrote to memory of 4352 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe net.exe PID 4352 wrote to memory of 1768 4352 net.exe net1.exe PID 4352 wrote to memory of 1768 4352 net.exe net1.exe PID 4352 wrote to memory of 1768 4352 net.exe net1.exe PID 5024 wrote to memory of 2424 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe net.exe PID 5024 wrote to memory of 2424 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe net.exe PID 5024 wrote to memory of 2424 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe net.exe PID 2424 wrote to memory of 3588 2424 net.exe net1.exe PID 2424 wrote to memory of 3588 2424 net.exe net1.exe PID 2424 wrote to memory of 3588 2424 net.exe net1.exe PID 5024 wrote to memory of 5028 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe installd.exe PID 5024 wrote to memory of 5028 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe installd.exe PID 5024 wrote to memory of 5028 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe installd.exe PID 5024 wrote to memory of 1876 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe nethtsrv.exe PID 5024 wrote to memory of 1876 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe nethtsrv.exe PID 5024 wrote to memory of 1876 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe nethtsrv.exe PID 5024 wrote to memory of 1656 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe netupdsrv.exe PID 5024 wrote to memory of 1656 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe netupdsrv.exe PID 5024 wrote to memory of 1656 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe netupdsrv.exe PID 5024 wrote to memory of 1688 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe net.exe PID 5024 wrote to memory of 1688 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe net.exe PID 5024 wrote to memory of 1688 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe net.exe PID 1688 wrote to memory of 3096 1688 net.exe net1.exe PID 1688 wrote to memory of 3096 1688 net.exe net1.exe PID 1688 wrote to memory of 3096 1688 net.exe net1.exe PID 5024 wrote to memory of 4584 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe net.exe PID 5024 wrote to memory of 4584 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe net.exe PID 5024 wrote to memory of 4584 5024 cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe net.exe PID 4584 wrote to memory of 340 4584 net.exe net1.exe PID 4584 wrote to memory of 340 4584 net.exe net1.exe PID 4584 wrote to memory of 340 4584 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe"C:\Users\Admin\AppData\Local\Temp\cfc3e6113bb717c62b053e499366debabc42f746e8aa6a96121632d26b5ddd67.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:1768
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:3588
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5028 -
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:1656 -
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:3096
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:340
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:4288
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5691e939467a95777695a0df8ca7abb94
SHA1c686ba59e887a773d906f46f0611ff053d430d0a
SHA25660f9a631a6a1d12841ad6eac718de5602cdfe197a0dee70401effb886c74324b
SHA5120e416319718a1e7c14d7a08ebc711bc6a62c38bfc0395c25e21c2b72d190aa994112c1fc0c09a94b50d7f1b9e6112597b33a51a3f9c59213567ffeaf6f8c3464
-
Filesize
106KB
MD5691e939467a95777695a0df8ca7abb94
SHA1c686ba59e887a773d906f46f0611ff053d430d0a
SHA25660f9a631a6a1d12841ad6eac718de5602cdfe197a0dee70401effb886c74324b
SHA5120e416319718a1e7c14d7a08ebc711bc6a62c38bfc0395c25e21c2b72d190aa994112c1fc0c09a94b50d7f1b9e6112597b33a51a3f9c59213567ffeaf6f8c3464
-
Filesize
106KB
MD5691e939467a95777695a0df8ca7abb94
SHA1c686ba59e887a773d906f46f0611ff053d430d0a
SHA25660f9a631a6a1d12841ad6eac718de5602cdfe197a0dee70401effb886c74324b
SHA5120e416319718a1e7c14d7a08ebc711bc6a62c38bfc0395c25e21c2b72d190aa994112c1fc0c09a94b50d7f1b9e6112597b33a51a3f9c59213567ffeaf6f8c3464
-
Filesize
106KB
MD5691e939467a95777695a0df8ca7abb94
SHA1c686ba59e887a773d906f46f0611ff053d430d0a
SHA25660f9a631a6a1d12841ad6eac718de5602cdfe197a0dee70401effb886c74324b
SHA5120e416319718a1e7c14d7a08ebc711bc6a62c38bfc0395c25e21c2b72d190aa994112c1fc0c09a94b50d7f1b9e6112597b33a51a3f9c59213567ffeaf6f8c3464
-
Filesize
241KB
MD5cca4b94b829f812f5ec3a4429231e5ec
SHA1212a6eafc250b2ab214d44a535099dd071dfa0e3
SHA256d8321cff6d1e3fb6527f6f3496488dc8c752cafe61b0de66c54a1dd39f20a384
SHA512f38afe3fc503dbec9bd549168b60a2314f647ddedcc09b91d440ac0664df6fa233ffe58de371e936901ce9c1d6816a62ec4795695c2e2d5c4db5c178db0e9b41
-
Filesize
241KB
MD5cca4b94b829f812f5ec3a4429231e5ec
SHA1212a6eafc250b2ab214d44a535099dd071dfa0e3
SHA256d8321cff6d1e3fb6527f6f3496488dc8c752cafe61b0de66c54a1dd39f20a384
SHA512f38afe3fc503dbec9bd549168b60a2314f647ddedcc09b91d440ac0664df6fa233ffe58de371e936901ce9c1d6816a62ec4795695c2e2d5c4db5c178db0e9b41
-
Filesize
241KB
MD5cca4b94b829f812f5ec3a4429231e5ec
SHA1212a6eafc250b2ab214d44a535099dd071dfa0e3
SHA256d8321cff6d1e3fb6527f6f3496488dc8c752cafe61b0de66c54a1dd39f20a384
SHA512f38afe3fc503dbec9bd549168b60a2314f647ddedcc09b91d440ac0664df6fa233ffe58de371e936901ce9c1d6816a62ec4795695c2e2d5c4db5c178db0e9b41
-
Filesize
108KB
MD552b1192640523f09212cd03bd238c1ae
SHA1e8c5c6f78afcd2baad2ea3416a3d2ce1c38f7b55
SHA2563c13bd25b2de475acdc4e8017c8d9a319195e9e5e6d463ac6a9e46767da6bfe6
SHA51240fcfb038b13885ea709469a9d9fc0fc08c7b71f548471551a90ee2e5f83cf62f386a246bf92afec24ffb64dc02c005d29cc45b5ca6101dcb91d9fd7934b53b6
-
Filesize
108KB
MD552b1192640523f09212cd03bd238c1ae
SHA1e8c5c6f78afcd2baad2ea3416a3d2ce1c38f7b55
SHA2563c13bd25b2de475acdc4e8017c8d9a319195e9e5e6d463ac6a9e46767da6bfe6
SHA51240fcfb038b13885ea709469a9d9fc0fc08c7b71f548471551a90ee2e5f83cf62f386a246bf92afec24ffb64dc02c005d29cc45b5ca6101dcb91d9fd7934b53b6
-
Filesize
176KB
MD527fa718f23f60cdbc47b88a0135776af
SHA11008c89e7f5f7954b370671e3cd1306efd02ef63
SHA2562fad6d91ffc6236e603e1dbe4834f20c978eae82e2e44b67db561df01238760a
SHA512cfd4a6e0a9e1f3407b1dc9dbbdbedb1727091df23048ba0dc83d720842c7e8f24df8c9c09eef2d8e63eb566691a56cd5f558a6c20755df3dbe24d34f2a6bd61d
-
Filesize
176KB
MD527fa718f23f60cdbc47b88a0135776af
SHA11008c89e7f5f7954b370671e3cd1306efd02ef63
SHA2562fad6d91ffc6236e603e1dbe4834f20c978eae82e2e44b67db561df01238760a
SHA512cfd4a6e0a9e1f3407b1dc9dbbdbedb1727091df23048ba0dc83d720842c7e8f24df8c9c09eef2d8e63eb566691a56cd5f558a6c20755df3dbe24d34f2a6bd61d
-
Filesize
176KB
MD527fa718f23f60cdbc47b88a0135776af
SHA11008c89e7f5f7954b370671e3cd1306efd02ef63
SHA2562fad6d91ffc6236e603e1dbe4834f20c978eae82e2e44b67db561df01238760a
SHA512cfd4a6e0a9e1f3407b1dc9dbbdbedb1727091df23048ba0dc83d720842c7e8f24df8c9c09eef2d8e63eb566691a56cd5f558a6c20755df3dbe24d34f2a6bd61d
-
Filesize
158KB
MD53d8e797e2a92646782f70a2ca6fc60bc
SHA17718d0bafe205cf4c86383e1b10b610cd763f01f
SHA256f2149bf8ae04cd815bceebcaa5f7e9e132d0bedf2d418a2e34e45b60210452dc
SHA512fa1bc471c5df78921eec4ba1d350d98805cb34995424f44a3ab5db1ef30c9ddf11b6e1095485b693c39acd05c41233c4f8a8d0573448c69d3becfc38c9f822f9
-
Filesize
158KB
MD53d8e797e2a92646782f70a2ca6fc60bc
SHA17718d0bafe205cf4c86383e1b10b610cd763f01f
SHA256f2149bf8ae04cd815bceebcaa5f7e9e132d0bedf2d418a2e34e45b60210452dc
SHA512fa1bc471c5df78921eec4ba1d350d98805cb34995424f44a3ab5db1ef30c9ddf11b6e1095485b693c39acd05c41233c4f8a8d0573448c69d3becfc38c9f822f9
-
Filesize
158KB
MD53d8e797e2a92646782f70a2ca6fc60bc
SHA17718d0bafe205cf4c86383e1b10b610cd763f01f
SHA256f2149bf8ae04cd815bceebcaa5f7e9e132d0bedf2d418a2e34e45b60210452dc
SHA512fa1bc471c5df78921eec4ba1d350d98805cb34995424f44a3ab5db1ef30c9ddf11b6e1095485b693c39acd05c41233c4f8a8d0573448c69d3becfc38c9f822f9