Analysis
-
max time kernel
47s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 10:14
Static task
static1
Behavioral task
behavioral1
Sample
b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe
Resource
win10v2004-20220901-en
General
-
Target
b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe
-
Size
601KB
-
MD5
3340fa12bc7a8ee3e0eaa6b042739c27
-
SHA1
ab51b20927a104e2a904e037b8f80ed2a910eb73
-
SHA256
b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75
-
SHA512
65520e6f26997885e3107d68feb1563e2813d8837979c3562e6151dca761c1667e7cc76b8da777b4d0d71afbc6cc4a0aaeeffbe4ab687fc90fa0cd3c0327eff4
-
SSDEEP
12288:DIny5DYTe9hdCKd47lZ8T0omzMxRJMaBGeZ/57X2HSw:LUTe9Ld08NmYJMaBrZJ2
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exedescription ioc process File created C:\Windows\system32\drivers\nethfdrv.sys b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe -
Executes dropped EXE 5 IoCs
Processes:
installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exepid process 1428 installd.exe 1692 nethtsrv.exe 828 netupdsrv.exe 1284 nethtsrv.exe 2000 netupdsrv.exe -
Loads dropped DLL 13 IoCs
Processes:
b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exeinstalld.exenethtsrv.exenethtsrv.exepid process 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe 1428 installd.exe 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe 1692 nethtsrv.exe 1692 nethtsrv.exe 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe 1284 nethtsrv.exe 1284 nethtsrv.exe 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exedescription ioc process File created C:\Windows\SysWOW64\hfnapi.dll b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe File created C:\Windows\SysWOW64\hfpapi.dll b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe File created C:\Windows\SysWOW64\installd.exe b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe File created C:\Windows\SysWOW64\nethtsrv.exe b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe File created C:\Windows\SysWOW64\netupdsrv.exe b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe -
Drops file in Program Files directory 3 IoCs
Processes:
b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exedescription ioc process File created C:\Program Files (x86)\Common Files\Config\ver.xml b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe File created C:\Program Files (x86)\Common Files\Config\data.xml b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 460 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nethtsrv.exedescription pid process Token: SeDebugPrivilege 1284 nethtsrv.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2028 wrote to memory of 948 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe net.exe PID 2028 wrote to memory of 948 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe net.exe PID 2028 wrote to memory of 948 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe net.exe PID 2028 wrote to memory of 948 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe net.exe PID 948 wrote to memory of 1648 948 net.exe net1.exe PID 948 wrote to memory of 1648 948 net.exe net1.exe PID 948 wrote to memory of 1648 948 net.exe net1.exe PID 948 wrote to memory of 1648 948 net.exe net1.exe PID 2028 wrote to memory of 1548 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe net.exe PID 2028 wrote to memory of 1548 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe net.exe PID 2028 wrote to memory of 1548 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe net.exe PID 2028 wrote to memory of 1548 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe net.exe PID 1548 wrote to memory of 836 1548 net.exe net1.exe PID 1548 wrote to memory of 836 1548 net.exe net1.exe PID 1548 wrote to memory of 836 1548 net.exe net1.exe PID 1548 wrote to memory of 836 1548 net.exe net1.exe PID 2028 wrote to memory of 1428 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe installd.exe PID 2028 wrote to memory of 1428 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe installd.exe PID 2028 wrote to memory of 1428 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe installd.exe PID 2028 wrote to memory of 1428 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe installd.exe PID 2028 wrote to memory of 1428 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe installd.exe PID 2028 wrote to memory of 1428 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe installd.exe PID 2028 wrote to memory of 1428 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe installd.exe PID 2028 wrote to memory of 1692 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe nethtsrv.exe PID 2028 wrote to memory of 1692 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe nethtsrv.exe PID 2028 wrote to memory of 1692 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe nethtsrv.exe PID 2028 wrote to memory of 1692 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe nethtsrv.exe PID 2028 wrote to memory of 828 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe netupdsrv.exe PID 2028 wrote to memory of 828 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe netupdsrv.exe PID 2028 wrote to memory of 828 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe netupdsrv.exe PID 2028 wrote to memory of 828 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe netupdsrv.exe PID 2028 wrote to memory of 828 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe netupdsrv.exe PID 2028 wrote to memory of 828 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe netupdsrv.exe PID 2028 wrote to memory of 828 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe netupdsrv.exe PID 2028 wrote to memory of 580 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe net.exe PID 2028 wrote to memory of 580 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe net.exe PID 2028 wrote to memory of 580 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe net.exe PID 2028 wrote to memory of 580 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe net.exe PID 580 wrote to memory of 792 580 net.exe net1.exe PID 580 wrote to memory of 792 580 net.exe net1.exe PID 580 wrote to memory of 792 580 net.exe net1.exe PID 580 wrote to memory of 792 580 net.exe net1.exe PID 2028 wrote to memory of 1124 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe net.exe PID 2028 wrote to memory of 1124 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe net.exe PID 2028 wrote to memory of 1124 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe net.exe PID 2028 wrote to memory of 1124 2028 b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe net.exe PID 1124 wrote to memory of 568 1124 net.exe net1.exe PID 1124 wrote to memory of 568 1124 net.exe net1.exe PID 1124 wrote to memory of 568 1124 net.exe net1.exe PID 1124 wrote to memory of 568 1124 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe"C:\Users\Admin\AppData\Local\Temp\b7f8daa100122e5e484252eff3530e9c52f19fb25339f9f9a0c207143bcf6c75.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:1648
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:836
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428 -
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:828 -
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:792
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:568
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1284
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:2000
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD5296544d90798214c2abd6a6bf7d579a8
SHA1cd641d512223b38efcc4d99e8b01efbdae82553a
SHA256dbfcd5f7462aed7ea72d096b7c3320a52ad0e833ace99fba52d779d48713e96d
SHA51292964fc276bd278c4c4f9def3559c5c48d72b2c135b06fd74e21b975344ca5ac59628c69d07deab0ecd8f4d5efe67a0c02f84831a90e7e9c7894e1840b95c466
-
Filesize
241KB
MD579a6b6104e4f9391118af39ad8877b03
SHA177f50d26598b51eb8182d50c174f51fe5f510b04
SHA2569e6ac7857306bd05c4db385adf63aaffdc3f6e21e8048b1072433df83d8cb3ac
SHA51269f6fce6d888833b8189df51d89e24c88591d1f9ca3bf2e689b991ac51a2800e4a25efbb13d83d71b10aaf8113ee8815363a8ba97e343b50eb3cd5d074432112
-
Filesize
108KB
MD5da7262f906fa06a878073766aa347af8
SHA1720a2004efc12e402236a3f2bc75fd08e96f0ae0
SHA256f2bc8cc8f43a20a2fbccddf7be59a7eedbfc81192ba738ebe5e9850b4ebd057a
SHA5124989e4fd183094448a2fbc0850bbe1b669f275bfd6c86a23d61ff3fe0ba1a175aa3d71d983fceca12fd3f204716ff957695edea87eb39068e02cbfe10972b203
-
Filesize
176KB
MD5d80592d8396de7bb08e813997ddb5a08
SHA1c76d0bbd726ae71cc919fb33745888cceb1be431
SHA2562b8e8ca4572cd0f7aab6a8361129058d03fa7777866e29a655ed381555d03a4c
SHA51273d802ef5e97cddb8d2f1ad9f9c947df8dbda208830776d2a4aca8a132723372fb38eb940084981d378fb133b9d8a4fddccd0e1b597dcb116eebca060a10a991
-
Filesize
176KB
MD5d80592d8396de7bb08e813997ddb5a08
SHA1c76d0bbd726ae71cc919fb33745888cceb1be431
SHA2562b8e8ca4572cd0f7aab6a8361129058d03fa7777866e29a655ed381555d03a4c
SHA51273d802ef5e97cddb8d2f1ad9f9c947df8dbda208830776d2a4aca8a132723372fb38eb940084981d378fb133b9d8a4fddccd0e1b597dcb116eebca060a10a991
-
Filesize
158KB
MD556f1fe83a85025eeea2799a5b66f7e52
SHA13059543d1cbdd049f8903ac04ab7d1e3a3cc0161
SHA2568ff153c75c2d29af26f7bd61dff0d10d9c9f5314a5be1db0c24f399f0bb40b6a
SHA5128d81432f9d4ca074b87f0f1f20e1bad80904994f501d52c8af7c406834e35c8a3f76f5790b50f8e1ab2bf86b5c50490632055e0ef1bd93b35bc4f0203f208abc
-
Filesize
158KB
MD556f1fe83a85025eeea2799a5b66f7e52
SHA13059543d1cbdd049f8903ac04ab7d1e3a3cc0161
SHA2568ff153c75c2d29af26f7bd61dff0d10d9c9f5314a5be1db0c24f399f0bb40b6a
SHA5128d81432f9d4ca074b87f0f1f20e1bad80904994f501d52c8af7c406834e35c8a3f76f5790b50f8e1ab2bf86b5c50490632055e0ef1bd93b35bc4f0203f208abc
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5296544d90798214c2abd6a6bf7d579a8
SHA1cd641d512223b38efcc4d99e8b01efbdae82553a
SHA256dbfcd5f7462aed7ea72d096b7c3320a52ad0e833ace99fba52d779d48713e96d
SHA51292964fc276bd278c4c4f9def3559c5c48d72b2c135b06fd74e21b975344ca5ac59628c69d07deab0ecd8f4d5efe67a0c02f84831a90e7e9c7894e1840b95c466
-
Filesize
106KB
MD5296544d90798214c2abd6a6bf7d579a8
SHA1cd641d512223b38efcc4d99e8b01efbdae82553a
SHA256dbfcd5f7462aed7ea72d096b7c3320a52ad0e833ace99fba52d779d48713e96d
SHA51292964fc276bd278c4c4f9def3559c5c48d72b2c135b06fd74e21b975344ca5ac59628c69d07deab0ecd8f4d5efe67a0c02f84831a90e7e9c7894e1840b95c466
-
Filesize
106KB
MD5296544d90798214c2abd6a6bf7d579a8
SHA1cd641d512223b38efcc4d99e8b01efbdae82553a
SHA256dbfcd5f7462aed7ea72d096b7c3320a52ad0e833ace99fba52d779d48713e96d
SHA51292964fc276bd278c4c4f9def3559c5c48d72b2c135b06fd74e21b975344ca5ac59628c69d07deab0ecd8f4d5efe67a0c02f84831a90e7e9c7894e1840b95c466
-
Filesize
241KB
MD579a6b6104e4f9391118af39ad8877b03
SHA177f50d26598b51eb8182d50c174f51fe5f510b04
SHA2569e6ac7857306bd05c4db385adf63aaffdc3f6e21e8048b1072433df83d8cb3ac
SHA51269f6fce6d888833b8189df51d89e24c88591d1f9ca3bf2e689b991ac51a2800e4a25efbb13d83d71b10aaf8113ee8815363a8ba97e343b50eb3cd5d074432112
-
Filesize
241KB
MD579a6b6104e4f9391118af39ad8877b03
SHA177f50d26598b51eb8182d50c174f51fe5f510b04
SHA2569e6ac7857306bd05c4db385adf63aaffdc3f6e21e8048b1072433df83d8cb3ac
SHA51269f6fce6d888833b8189df51d89e24c88591d1f9ca3bf2e689b991ac51a2800e4a25efbb13d83d71b10aaf8113ee8815363a8ba97e343b50eb3cd5d074432112
-
Filesize
108KB
MD5da7262f906fa06a878073766aa347af8
SHA1720a2004efc12e402236a3f2bc75fd08e96f0ae0
SHA256f2bc8cc8f43a20a2fbccddf7be59a7eedbfc81192ba738ebe5e9850b4ebd057a
SHA5124989e4fd183094448a2fbc0850bbe1b669f275bfd6c86a23d61ff3fe0ba1a175aa3d71d983fceca12fd3f204716ff957695edea87eb39068e02cbfe10972b203
-
Filesize
176KB
MD5d80592d8396de7bb08e813997ddb5a08
SHA1c76d0bbd726ae71cc919fb33745888cceb1be431
SHA2562b8e8ca4572cd0f7aab6a8361129058d03fa7777866e29a655ed381555d03a4c
SHA51273d802ef5e97cddb8d2f1ad9f9c947df8dbda208830776d2a4aca8a132723372fb38eb940084981d378fb133b9d8a4fddccd0e1b597dcb116eebca060a10a991
-
Filesize
158KB
MD556f1fe83a85025eeea2799a5b66f7e52
SHA13059543d1cbdd049f8903ac04ab7d1e3a3cc0161
SHA2568ff153c75c2d29af26f7bd61dff0d10d9c9f5314a5be1db0c24f399f0bb40b6a
SHA5128d81432f9d4ca074b87f0f1f20e1bad80904994f501d52c8af7c406834e35c8a3f76f5790b50f8e1ab2bf86b5c50490632055e0ef1bd93b35bc4f0203f208abc