Analysis
-
max time kernel
62s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 10:56
Static task
static1
Behavioral task
behavioral1
Sample
6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe
Resource
win10v2004-20220812-en
General
-
Target
6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe
-
Size
446KB
-
MD5
ba573a7eb68a65726de1b77ae4f51b46
-
SHA1
cba409b3774836fdb9217ce254070485d0a75e78
-
SHA256
6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a
-
SHA512
d25762efe9817ee809d7d8ab6f9d60f851ef35d1e8f173bc67987ac0da0bac1d0fc78636a6602fc74ef3c73bbc0fd19f5465f9595f6b56eaa71f012a67c7bfc2
-
SSDEEP
12288:kc5sI5AyR8Z3ZtvOZmB8RNt2rCAA1fuVsRCY0:kc5f4ZJtW8B8Rf2rQJup
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exedescription ioc process File created C:\Windows\system32\drivers\nethfdrv.sys 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe -
Executes dropped EXE 5 IoCs
Processes:
installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exepid process 1020 installd.exe 1932 nethtsrv.exe 1524 netupdsrv.exe 1408 nethtsrv.exe 1752 netupdsrv.exe -
Loads dropped DLL 13 IoCs
Processes:
6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exeinstalld.exenethtsrv.exenethtsrv.exepid process 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe 1020 installd.exe 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe 1932 nethtsrv.exe 1932 nethtsrv.exe 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe 1408 nethtsrv.exe 1408 nethtsrv.exe 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exedescription ioc process File created C:\Windows\SysWOW64\nethtsrv.exe 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe File created C:\Windows\SysWOW64\netupdsrv.exe 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe File created C:\Windows\SysWOW64\hfnapi.dll 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe File created C:\Windows\SysWOW64\hfpapi.dll 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe File created C:\Windows\SysWOW64\installd.exe 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe -
Drops file in Program Files directory 3 IoCs
Processes:
6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exedescription ioc process File created C:\Program Files (x86)\Common Files\Config\data.xml 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 460 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nethtsrv.exedescription pid process Token: SeDebugPrivilege 1408 nethtsrv.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2012 wrote to memory of 1148 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe net.exe PID 2012 wrote to memory of 1148 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe net.exe PID 2012 wrote to memory of 1148 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe net.exe PID 2012 wrote to memory of 1148 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe net.exe PID 1148 wrote to memory of 572 1148 net.exe net1.exe PID 1148 wrote to memory of 572 1148 net.exe net1.exe PID 1148 wrote to memory of 572 1148 net.exe net1.exe PID 1148 wrote to memory of 572 1148 net.exe net1.exe PID 2012 wrote to memory of 788 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe net.exe PID 2012 wrote to memory of 788 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe net.exe PID 2012 wrote to memory of 788 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe net.exe PID 2012 wrote to memory of 788 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe net.exe PID 788 wrote to memory of 1488 788 net.exe net1.exe PID 788 wrote to memory of 1488 788 net.exe net1.exe PID 788 wrote to memory of 1488 788 net.exe net1.exe PID 788 wrote to memory of 1488 788 net.exe net1.exe PID 2012 wrote to memory of 1020 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe installd.exe PID 2012 wrote to memory of 1020 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe installd.exe PID 2012 wrote to memory of 1020 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe installd.exe PID 2012 wrote to memory of 1020 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe installd.exe PID 2012 wrote to memory of 1020 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe installd.exe PID 2012 wrote to memory of 1020 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe installd.exe PID 2012 wrote to memory of 1020 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe installd.exe PID 2012 wrote to memory of 1932 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe nethtsrv.exe PID 2012 wrote to memory of 1932 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe nethtsrv.exe PID 2012 wrote to memory of 1932 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe nethtsrv.exe PID 2012 wrote to memory of 1932 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe nethtsrv.exe PID 2012 wrote to memory of 1524 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe netupdsrv.exe PID 2012 wrote to memory of 1524 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe netupdsrv.exe PID 2012 wrote to memory of 1524 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe netupdsrv.exe PID 2012 wrote to memory of 1524 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe netupdsrv.exe PID 2012 wrote to memory of 1524 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe netupdsrv.exe PID 2012 wrote to memory of 1524 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe netupdsrv.exe PID 2012 wrote to memory of 1524 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe netupdsrv.exe PID 2012 wrote to memory of 1620 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe net.exe PID 2012 wrote to memory of 1620 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe net.exe PID 2012 wrote to memory of 1620 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe net.exe PID 2012 wrote to memory of 1620 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe net.exe PID 1620 wrote to memory of 964 1620 net.exe net1.exe PID 1620 wrote to memory of 964 1620 net.exe net1.exe PID 1620 wrote to memory of 964 1620 net.exe net1.exe PID 1620 wrote to memory of 964 1620 net.exe net1.exe PID 2012 wrote to memory of 1852 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe net.exe PID 2012 wrote to memory of 1852 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe net.exe PID 2012 wrote to memory of 1852 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe net.exe PID 2012 wrote to memory of 1852 2012 6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe net.exe PID 1852 wrote to memory of 1664 1852 net.exe net1.exe PID 1852 wrote to memory of 1664 1852 net.exe net1.exe PID 1852 wrote to memory of 1664 1852 net.exe net1.exe PID 1852 wrote to memory of 1664 1852 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe"C:\Users\Admin\AppData\Local\Temp\6375fd940b70b2b8acfbc717842c27cee5d59cab3e471d6f0faa0e4b1face09a.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:572
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:1488
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020 -
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:1524 -
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:964
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:1664
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1408
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:1752
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD5d9ce6523460be6b9480caf83d9e418b1
SHA14c9814563e2c9d8d9d28e79b033924ca1073c83b
SHA256dbd5ced3d17a277f09bc1b1095fc8cb4a4cad588697152673447367407e1adf4
SHA512a54570847835050c3bfab6746e1b6299164af41ea589cb49ed0848e27f3bae4e2447b5568d3cfb796175bd533332eb8c2e81d3a204adc77d8a105345d936d5da
-
Filesize
244KB
MD52507424828669a878c7743fd903bfa49
SHA198fd33ad2d8c4ace0dd0ff732a008f300da09c04
SHA2561cc13ebc5235a9d6c11d26c14ef797831dbe1aacde09bec651d3aef1b0670493
SHA5127601da66130fe76434c34ce1b447816789d068336713a75add633a8abf1158a66ebb479a4dcf9878fe98c8869bce30c17358ef4503da7e16f9fc395539304e5f
-
Filesize
108KB
MD5cce273f9a476e763284da6e106c8cb7d
SHA13a0e68aad9d04cbd12aeca2d64d846731b19eeb1
SHA25637006453db3d2bd7c574e23b0732ad582264d68db5f77ccd0cc792ea93c324ec
SHA512e114443988a73988ec1d8567332c0049f4c9c0d87dd441a045f58d7c5e96530f36878296c3b77487bbed244afeedec542d4fb2e1eab12686b6e3d8ecbdc5e04b
-
Filesize
176KB
MD50ff8b380116398792da8344b3884f1ba
SHA1e62aaed4cc7deeb3bdb6a5b2c5654d4f89655879
SHA256cb72c8b875ec63f64ac946f1d856c9291927ef8e617b5a369ed2d7f61d78889d
SHA512f0337b3223e49edfa16187feef30a5c600d48d04341076bd2128d34023619fc34af2f094a44cd00c9a8bfaa6f7b4216299af3ef941a5ef4156839978707b104b
-
Filesize
176KB
MD50ff8b380116398792da8344b3884f1ba
SHA1e62aaed4cc7deeb3bdb6a5b2c5654d4f89655879
SHA256cb72c8b875ec63f64ac946f1d856c9291927ef8e617b5a369ed2d7f61d78889d
SHA512f0337b3223e49edfa16187feef30a5c600d48d04341076bd2128d34023619fc34af2f094a44cd00c9a8bfaa6f7b4216299af3ef941a5ef4156839978707b104b
-
Filesize
159KB
MD5975314a75a48e58f2df76570fbcd6330
SHA17defe89695afc1514926ea8b941f9d8f9d1b5615
SHA256ace1d78a5f0664c2d3d62459df09ef682fae05ffff1e71d0ba4b5abd4aa78aa2
SHA512b29244e909321b4c5f883c8179fe0db83e4ea2ae9d5ef9ee8d5d2d767287b06261a61c503bc91d909a9e9d486b845e34a9fcad7ee4e0d35b068353c63a7620a9
-
Filesize
159KB
MD5975314a75a48e58f2df76570fbcd6330
SHA17defe89695afc1514926ea8b941f9d8f9d1b5615
SHA256ace1d78a5f0664c2d3d62459df09ef682fae05ffff1e71d0ba4b5abd4aa78aa2
SHA512b29244e909321b4c5f883c8179fe0db83e4ea2ae9d5ef9ee8d5d2d767287b06261a61c503bc91d909a9e9d486b845e34a9fcad7ee4e0d35b068353c63a7620a9
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5d9ce6523460be6b9480caf83d9e418b1
SHA14c9814563e2c9d8d9d28e79b033924ca1073c83b
SHA256dbd5ced3d17a277f09bc1b1095fc8cb4a4cad588697152673447367407e1adf4
SHA512a54570847835050c3bfab6746e1b6299164af41ea589cb49ed0848e27f3bae4e2447b5568d3cfb796175bd533332eb8c2e81d3a204adc77d8a105345d936d5da
-
Filesize
106KB
MD5d9ce6523460be6b9480caf83d9e418b1
SHA14c9814563e2c9d8d9d28e79b033924ca1073c83b
SHA256dbd5ced3d17a277f09bc1b1095fc8cb4a4cad588697152673447367407e1adf4
SHA512a54570847835050c3bfab6746e1b6299164af41ea589cb49ed0848e27f3bae4e2447b5568d3cfb796175bd533332eb8c2e81d3a204adc77d8a105345d936d5da
-
Filesize
106KB
MD5d9ce6523460be6b9480caf83d9e418b1
SHA14c9814563e2c9d8d9d28e79b033924ca1073c83b
SHA256dbd5ced3d17a277f09bc1b1095fc8cb4a4cad588697152673447367407e1adf4
SHA512a54570847835050c3bfab6746e1b6299164af41ea589cb49ed0848e27f3bae4e2447b5568d3cfb796175bd533332eb8c2e81d3a204adc77d8a105345d936d5da
-
Filesize
244KB
MD52507424828669a878c7743fd903bfa49
SHA198fd33ad2d8c4ace0dd0ff732a008f300da09c04
SHA2561cc13ebc5235a9d6c11d26c14ef797831dbe1aacde09bec651d3aef1b0670493
SHA5127601da66130fe76434c34ce1b447816789d068336713a75add633a8abf1158a66ebb479a4dcf9878fe98c8869bce30c17358ef4503da7e16f9fc395539304e5f
-
Filesize
244KB
MD52507424828669a878c7743fd903bfa49
SHA198fd33ad2d8c4ace0dd0ff732a008f300da09c04
SHA2561cc13ebc5235a9d6c11d26c14ef797831dbe1aacde09bec651d3aef1b0670493
SHA5127601da66130fe76434c34ce1b447816789d068336713a75add633a8abf1158a66ebb479a4dcf9878fe98c8869bce30c17358ef4503da7e16f9fc395539304e5f
-
Filesize
108KB
MD5cce273f9a476e763284da6e106c8cb7d
SHA13a0e68aad9d04cbd12aeca2d64d846731b19eeb1
SHA25637006453db3d2bd7c574e23b0732ad582264d68db5f77ccd0cc792ea93c324ec
SHA512e114443988a73988ec1d8567332c0049f4c9c0d87dd441a045f58d7c5e96530f36878296c3b77487bbed244afeedec542d4fb2e1eab12686b6e3d8ecbdc5e04b
-
Filesize
176KB
MD50ff8b380116398792da8344b3884f1ba
SHA1e62aaed4cc7deeb3bdb6a5b2c5654d4f89655879
SHA256cb72c8b875ec63f64ac946f1d856c9291927ef8e617b5a369ed2d7f61d78889d
SHA512f0337b3223e49edfa16187feef30a5c600d48d04341076bd2128d34023619fc34af2f094a44cd00c9a8bfaa6f7b4216299af3ef941a5ef4156839978707b104b
-
Filesize
159KB
MD5975314a75a48e58f2df76570fbcd6330
SHA17defe89695afc1514926ea8b941f9d8f9d1b5615
SHA256ace1d78a5f0664c2d3d62459df09ef682fae05ffff1e71d0ba4b5abd4aa78aa2
SHA512b29244e909321b4c5f883c8179fe0db83e4ea2ae9d5ef9ee8d5d2d767287b06261a61c503bc91d909a9e9d486b845e34a9fcad7ee4e0d35b068353c63a7620a9