Analysis
-
max time kernel
152s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:57
Static task
static1
Behavioral task
behavioral1
Sample
44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe
Resource
win10v2004-20220812-en
General
-
Target
44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe
-
Size
447KB
-
MD5
888f349d7b078c1754ea23eb96ebfd16
-
SHA1
3fbf7253a56b5a83c4a182b2e20671e200952912
-
SHA256
44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb
-
SHA512
24c3d9ec38506b4b02efd51cc73404f8d3201212cf533d8ca47b3fcd243ecef69e5b0488db1171a842fe9c75b6b645e79a1ca50ca15aa447262ec12087d87d71
-
SSDEEP
12288:opmp933mDUvcE60P+f/xXzJa3/4TLHhru:oSHmDEO/xXzGQTL9u
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exedescription ioc process File created C:\Windows\system32\drivers\nethfdrv.sys 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe -
Executes dropped EXE 5 IoCs
Processes:
installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exepid process 4764 installd.exe 1600 nethtsrv.exe 1072 netupdsrv.exe 2144 nethtsrv.exe 3180 netupdsrv.exe -
Loads dropped DLL 14 IoCs
Processes:
44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exeinstalld.exenethtsrv.exenethtsrv.exepid process 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe 4764 installd.exe 1600 nethtsrv.exe 1600 nethtsrv.exe 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe 2144 nethtsrv.exe 2144 nethtsrv.exe 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exedescription ioc process File created C:\Windows\SysWOW64\hfnapi.dll 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe File created C:\Windows\SysWOW64\hfpapi.dll 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe File created C:\Windows\SysWOW64\installd.exe 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe File created C:\Windows\SysWOW64\nethtsrv.exe 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe File created C:\Windows\SysWOW64\netupdsrv.exe 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe -
Drops file in Program Files directory 3 IoCs
Processes:
44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exedescription ioc process File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe File created C:\Program Files (x86)\Common Files\Config\data.xml 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
Processes:
nethtsrv.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 636 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nethtsrv.exedescription pid process Token: SeDebugPrivilege 2144 nethtsrv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exenet.exenet.exenet.exenet.exedescription pid process target process PID 5112 wrote to memory of 2212 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe net.exe PID 5112 wrote to memory of 2212 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe net.exe PID 5112 wrote to memory of 2212 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe net.exe PID 2212 wrote to memory of 4832 2212 net.exe net1.exe PID 2212 wrote to memory of 4832 2212 net.exe net1.exe PID 2212 wrote to memory of 4832 2212 net.exe net1.exe PID 5112 wrote to memory of 4580 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe net.exe PID 5112 wrote to memory of 4580 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe net.exe PID 5112 wrote to memory of 4580 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe net.exe PID 4580 wrote to memory of 4680 4580 net.exe net1.exe PID 4580 wrote to memory of 4680 4580 net.exe net1.exe PID 4580 wrote to memory of 4680 4580 net.exe net1.exe PID 5112 wrote to memory of 4764 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe installd.exe PID 5112 wrote to memory of 4764 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe installd.exe PID 5112 wrote to memory of 4764 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe installd.exe PID 5112 wrote to memory of 1600 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe nethtsrv.exe PID 5112 wrote to memory of 1600 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe nethtsrv.exe PID 5112 wrote to memory of 1600 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe nethtsrv.exe PID 5112 wrote to memory of 1072 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe netupdsrv.exe PID 5112 wrote to memory of 1072 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe netupdsrv.exe PID 5112 wrote to memory of 1072 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe netupdsrv.exe PID 5112 wrote to memory of 1772 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe net.exe PID 5112 wrote to memory of 1772 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe net.exe PID 5112 wrote to memory of 1772 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe net.exe PID 1772 wrote to memory of 4676 1772 net.exe net1.exe PID 1772 wrote to memory of 4676 1772 net.exe net1.exe PID 1772 wrote to memory of 4676 1772 net.exe net1.exe PID 5112 wrote to memory of 208 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe net.exe PID 5112 wrote to memory of 208 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe net.exe PID 5112 wrote to memory of 208 5112 44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe net.exe PID 208 wrote to memory of 2308 208 net.exe net1.exe PID 208 wrote to memory of 2308 208 net.exe net1.exe PID 208 wrote to memory of 2308 208 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe"C:\Users\Admin\AppData\Local\Temp\44a1dedd4bf5cb38db96459c37760bee28b71bf2eb91ee3840434a8336087deb.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:4832
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:4680
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4764 -
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:1072 -
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:4676
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:2308
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2144
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:3180
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5fcef1fbdbce894af0130a50b70d13ef9
SHA1e60eb9a9f10fdfa362219ee949e45864293a83bc
SHA25668bbec4a17d2a365efd18465be49b447c844771a3e062ec5e213e5c6eabdd49f
SHA512bc4a1d208821f7812ab4fafea73c3c262c3642b49c2778ad1188a9d4fcf1f69f44ab4ba8e2441bb88927ab01f408292f84f3dfd1ac44510f9752dcabb9f0f3f3
-
Filesize
106KB
MD5fcef1fbdbce894af0130a50b70d13ef9
SHA1e60eb9a9f10fdfa362219ee949e45864293a83bc
SHA25668bbec4a17d2a365efd18465be49b447c844771a3e062ec5e213e5c6eabdd49f
SHA512bc4a1d208821f7812ab4fafea73c3c262c3642b49c2778ad1188a9d4fcf1f69f44ab4ba8e2441bb88927ab01f408292f84f3dfd1ac44510f9752dcabb9f0f3f3
-
Filesize
106KB
MD5fcef1fbdbce894af0130a50b70d13ef9
SHA1e60eb9a9f10fdfa362219ee949e45864293a83bc
SHA25668bbec4a17d2a365efd18465be49b447c844771a3e062ec5e213e5c6eabdd49f
SHA512bc4a1d208821f7812ab4fafea73c3c262c3642b49c2778ad1188a9d4fcf1f69f44ab4ba8e2441bb88927ab01f408292f84f3dfd1ac44510f9752dcabb9f0f3f3
-
Filesize
106KB
MD5fcef1fbdbce894af0130a50b70d13ef9
SHA1e60eb9a9f10fdfa362219ee949e45864293a83bc
SHA25668bbec4a17d2a365efd18465be49b447c844771a3e062ec5e213e5c6eabdd49f
SHA512bc4a1d208821f7812ab4fafea73c3c262c3642b49c2778ad1188a9d4fcf1f69f44ab4ba8e2441bb88927ab01f408292f84f3dfd1ac44510f9752dcabb9f0f3f3
-
Filesize
244KB
MD5a80c38ad9f5c8967c2180b95f8fe04bc
SHA151ba1374dcc5ef07f64ce0f379c8ea876e7e165f
SHA256a49db760807345a65291131c0c82937fd638d887bad3b7608ba182f176056fe8
SHA5120b3c7a4be3642dd60b07e59ecd402f9ddcfa8670635373e2c9d275543c71558194cdcd7dc8f7e6194fcb9b7f41c6f5cde68f061afad50d7b8408f878fd7e578d
-
Filesize
244KB
MD5a80c38ad9f5c8967c2180b95f8fe04bc
SHA151ba1374dcc5ef07f64ce0f379c8ea876e7e165f
SHA256a49db760807345a65291131c0c82937fd638d887bad3b7608ba182f176056fe8
SHA5120b3c7a4be3642dd60b07e59ecd402f9ddcfa8670635373e2c9d275543c71558194cdcd7dc8f7e6194fcb9b7f41c6f5cde68f061afad50d7b8408f878fd7e578d
-
Filesize
244KB
MD5a80c38ad9f5c8967c2180b95f8fe04bc
SHA151ba1374dcc5ef07f64ce0f379c8ea876e7e165f
SHA256a49db760807345a65291131c0c82937fd638d887bad3b7608ba182f176056fe8
SHA5120b3c7a4be3642dd60b07e59ecd402f9ddcfa8670635373e2c9d275543c71558194cdcd7dc8f7e6194fcb9b7f41c6f5cde68f061afad50d7b8408f878fd7e578d
-
Filesize
108KB
MD5ac72854074bab05daa5dab9d4a871b00
SHA118b68062d55fbecf9d692291666ebe797f1ff2bf
SHA256d9f32ee56498f0816843c641a131d293a36c7398a75a73ca8a59bf467b7770d5
SHA5121be232c418806eea79746aee40f272befebd1a372040c5a66bf4538d6afcae1febcb8522a7de17e2881337ab9c492351fbc3bb7b7cf2e523bc3882ff018996e4
-
Filesize
108KB
MD5ac72854074bab05daa5dab9d4a871b00
SHA118b68062d55fbecf9d692291666ebe797f1ff2bf
SHA256d9f32ee56498f0816843c641a131d293a36c7398a75a73ca8a59bf467b7770d5
SHA5121be232c418806eea79746aee40f272befebd1a372040c5a66bf4538d6afcae1febcb8522a7de17e2881337ab9c492351fbc3bb7b7cf2e523bc3882ff018996e4
-
Filesize
176KB
MD5043b6ae7c6fc014315f55f11a6bfc7af
SHA16f4ed2c230f3d35ded3c4cbefbdd9b8a5ad70c46
SHA25637df66fdb07c084cd4e882a7fdaeef9a9134cfdb1fdaa622f08864be0880810d
SHA512d4833d1b4ad053eef32cc15a213e6103e681235d9e85d45a6c56fd5de6802d4dd07845596cb790585af8eba021a1cea5a1b4ef5e92f0e64adfea1d73ad9f0904
-
Filesize
176KB
MD5043b6ae7c6fc014315f55f11a6bfc7af
SHA16f4ed2c230f3d35ded3c4cbefbdd9b8a5ad70c46
SHA25637df66fdb07c084cd4e882a7fdaeef9a9134cfdb1fdaa622f08864be0880810d
SHA512d4833d1b4ad053eef32cc15a213e6103e681235d9e85d45a6c56fd5de6802d4dd07845596cb790585af8eba021a1cea5a1b4ef5e92f0e64adfea1d73ad9f0904
-
Filesize
176KB
MD5043b6ae7c6fc014315f55f11a6bfc7af
SHA16f4ed2c230f3d35ded3c4cbefbdd9b8a5ad70c46
SHA25637df66fdb07c084cd4e882a7fdaeef9a9134cfdb1fdaa622f08864be0880810d
SHA512d4833d1b4ad053eef32cc15a213e6103e681235d9e85d45a6c56fd5de6802d4dd07845596cb790585af8eba021a1cea5a1b4ef5e92f0e64adfea1d73ad9f0904
-
Filesize
158KB
MD5179dfefab9aae8bc13fd2974e86293cf
SHA1966700bced4ef3568190f4d1643596eeae7ace8a
SHA256542cbafc02c83ff915371d9df2c48ead1c48a80bed89e7465b72a1f306cd5263
SHA512007e47a52000563a5f4f50a56f47cfa0323faa878e1f17189e239c115bbc9391cdf4408959510375222963ad24bb1cdda5b2f843e7616928a127a1b4877711e3
-
Filesize
158KB
MD5179dfefab9aae8bc13fd2974e86293cf
SHA1966700bced4ef3568190f4d1643596eeae7ace8a
SHA256542cbafc02c83ff915371d9df2c48ead1c48a80bed89e7465b72a1f306cd5263
SHA512007e47a52000563a5f4f50a56f47cfa0323faa878e1f17189e239c115bbc9391cdf4408959510375222963ad24bb1cdda5b2f843e7616928a127a1b4877711e3
-
Filesize
158KB
MD5179dfefab9aae8bc13fd2974e86293cf
SHA1966700bced4ef3568190f4d1643596eeae7ace8a
SHA256542cbafc02c83ff915371d9df2c48ead1c48a80bed89e7465b72a1f306cd5263
SHA512007e47a52000563a5f4f50a56f47cfa0323faa878e1f17189e239c115bbc9391cdf4408959510375222963ad24bb1cdda5b2f843e7616928a127a1b4877711e3