Analysis
-
max time kernel
62s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 10:19
Static task
static1
Behavioral task
behavioral1
Sample
8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe
Resource
win10v2004-20221111-en
General
-
Target
8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe
-
Size
602KB
-
MD5
b361740869d6ab415bc0e6f2c06b33b1
-
SHA1
9808079f3f272dd6e1be528f59602f2519d9ab52
-
SHA256
8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67
-
SHA512
647833655d5dc233e28aa0b9131e964f2fb1ff8c6f425ac677d774a8a0144455c73b4bb5f7c8127e019ff195e785b03170f01fcf33e5c1fb14e7577e781e7146
-
SSDEEP
12288:9Iny5DYTt84TLLLhWS7ziU2ldzog85+HfCJaqMN1Xbir6ryvk9u:pUTt8KPLhWYN2l53U+Hea3N1Xbd2vk9
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exedescription ioc process File created C:\Windows\system32\drivers\nethfdrv.sys 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe -
Executes dropped EXE 5 IoCs
Processes:
installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exepid process 468 installd.exe 1912 nethtsrv.exe 1944 netupdsrv.exe 1364 nethtsrv.exe 1308 netupdsrv.exe -
Loads dropped DLL 13 IoCs
Processes:
8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exeinstalld.exenethtsrv.exenethtsrv.exepid process 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe 468 installd.exe 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe 1912 nethtsrv.exe 1912 nethtsrv.exe 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe 1364 nethtsrv.exe 1364 nethtsrv.exe 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exedescription ioc process File created C:\Windows\SysWOW64\hfnapi.dll 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe File created C:\Windows\SysWOW64\hfpapi.dll 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe File created C:\Windows\SysWOW64\installd.exe 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe File created C:\Windows\SysWOW64\nethtsrv.exe 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe File created C:\Windows\SysWOW64\netupdsrv.exe 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe -
Drops file in Program Files directory 3 IoCs
Processes:
8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exedescription ioc process File created C:\Program Files (x86)\Common Files\Config\data.xml 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 460 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nethtsrv.exedescription pid process Token: SeDebugPrivilege 1364 nethtsrv.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exenet.exenet.exenet.exenet.exedescription pid process target process PID 1248 wrote to memory of 2020 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe net.exe PID 1248 wrote to memory of 2020 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe net.exe PID 1248 wrote to memory of 2020 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe net.exe PID 1248 wrote to memory of 2020 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe net.exe PID 2020 wrote to memory of 636 2020 net.exe net1.exe PID 2020 wrote to memory of 636 2020 net.exe net1.exe PID 2020 wrote to memory of 636 2020 net.exe net1.exe PID 2020 wrote to memory of 636 2020 net.exe net1.exe PID 1248 wrote to memory of 432 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe net.exe PID 1248 wrote to memory of 432 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe net.exe PID 1248 wrote to memory of 432 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe net.exe PID 1248 wrote to memory of 432 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe net.exe PID 432 wrote to memory of 580 432 net.exe net1.exe PID 432 wrote to memory of 580 432 net.exe net1.exe PID 432 wrote to memory of 580 432 net.exe net1.exe PID 432 wrote to memory of 580 432 net.exe net1.exe PID 1248 wrote to memory of 468 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe installd.exe PID 1248 wrote to memory of 468 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe installd.exe PID 1248 wrote to memory of 468 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe installd.exe PID 1248 wrote to memory of 468 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe installd.exe PID 1248 wrote to memory of 468 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe installd.exe PID 1248 wrote to memory of 468 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe installd.exe PID 1248 wrote to memory of 468 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe installd.exe PID 1248 wrote to memory of 1912 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe nethtsrv.exe PID 1248 wrote to memory of 1912 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe nethtsrv.exe PID 1248 wrote to memory of 1912 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe nethtsrv.exe PID 1248 wrote to memory of 1912 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe nethtsrv.exe PID 1248 wrote to memory of 1944 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe netupdsrv.exe PID 1248 wrote to memory of 1944 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe netupdsrv.exe PID 1248 wrote to memory of 1944 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe netupdsrv.exe PID 1248 wrote to memory of 1944 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe netupdsrv.exe PID 1248 wrote to memory of 1944 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe netupdsrv.exe PID 1248 wrote to memory of 1944 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe netupdsrv.exe PID 1248 wrote to memory of 1944 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe netupdsrv.exe PID 1248 wrote to memory of 916 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe net.exe PID 1248 wrote to memory of 916 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe net.exe PID 1248 wrote to memory of 916 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe net.exe PID 1248 wrote to memory of 916 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe net.exe PID 916 wrote to memory of 480 916 net.exe net1.exe PID 916 wrote to memory of 480 916 net.exe net1.exe PID 916 wrote to memory of 480 916 net.exe net1.exe PID 916 wrote to memory of 480 916 net.exe net1.exe PID 1248 wrote to memory of 428 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe net.exe PID 1248 wrote to memory of 428 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe net.exe PID 1248 wrote to memory of 428 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe net.exe PID 1248 wrote to memory of 428 1248 8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe net.exe PID 428 wrote to memory of 1660 428 net.exe net1.exe PID 428 wrote to memory of 1660 428 net.exe net1.exe PID 428 wrote to memory of 1660 428 net.exe net1.exe PID 428 wrote to memory of 1660 428 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe"C:\Users\Admin\AppData\Local\Temp\8ca05eb24fd0d810f77ea2c49deb631e72bd8a5e6df27253b37378a087efbd67.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:636
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:580
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:468 -
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:1944 -
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:480
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:1660
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1364
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:1308
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD5bc812f098df521f0f683ad644486ef65
SHA17eff484f6b11cea5b0b128208c709bfa771d281d
SHA256e7c8cc8c62d71934197d9e0fb8e18c2682a13ba9701d403f24b0f316b05842c1
SHA51276320a0d8db869c36eec8053982da482d412f76704f083086aef904ece0b4da66abbf21f320210d192f2ba41574b9f71ecc5c9f22325f97cc6d5c97ec5f1408d
-
Filesize
241KB
MD5061a8c137c8419da3c624452b4c39f0e
SHA11afb086b67394d0a3ec0f7cf63a94a0789d028b4
SHA256360cdd5cc1703b80f4c4b2e0a66fd22d7acac8af14177725f7453bac92e1d0e6
SHA512809d0289b35569da1a88b8eaea911506564fd8a76ac459dee0d70794445079b908a6a9b94a5544e29c94173fd32f4acf29db1c462ced346dfc221305bedee022
-
Filesize
108KB
MD582c5677317ab76d9f135209319e30990
SHA119834a725ab889954b2632194f30bd8739e2fcc7
SHA256127bdf6275b03467cce335768f6d0026e1e60f4545dbb2f6076097f20623ac2e
SHA512ed3e4ba26d64a31595dca2f281bf7b452e35dcd94498246592b51806bb04ed39e0c0f041b0d2daa1f0e90507bc05ef205f4fd80c6045408df52ad8f2dedeed57
-
Filesize
176KB
MD5a9ce9e520e3a51732a559301340b304d
SHA1025e33cf8d41b78a0d5713c9fc2a1330f43f4b7f
SHA25617c319b10b8780c96b75b4efd278c819559c691c77489ff72954bbac594fff04
SHA51260f8d37250ae21f522c1460678e61e50b1b02ddc2a5b1dfb05836fe0d6fba88402ed6f8f339829f3a6097c518e2dfdc36864fce7d309090725214737ad82e8bd
-
Filesize
176KB
MD5a9ce9e520e3a51732a559301340b304d
SHA1025e33cf8d41b78a0d5713c9fc2a1330f43f4b7f
SHA25617c319b10b8780c96b75b4efd278c819559c691c77489ff72954bbac594fff04
SHA51260f8d37250ae21f522c1460678e61e50b1b02ddc2a5b1dfb05836fe0d6fba88402ed6f8f339829f3a6097c518e2dfdc36864fce7d309090725214737ad82e8bd
-
Filesize
159KB
MD5c101cf8feaaec6a6a9c63a5c780d073d
SHA1b6753dfe911eaeb79d08e30fdd962d4c32301273
SHA25608ae335e9ac8c641531c195a54eb356c3ce8b70e919e383adbf1a185ac12dbdb
SHA512041120413a6d51237d1b2557a29114a2f6da435cdbcf07bccf82491add411dc88408fbbc1cb96728331dae9614c78654e95b7e5334497e87c2247ac55c6b9542
-
Filesize
159KB
MD5c101cf8feaaec6a6a9c63a5c780d073d
SHA1b6753dfe911eaeb79d08e30fdd962d4c32301273
SHA25608ae335e9ac8c641531c195a54eb356c3ce8b70e919e383adbf1a185ac12dbdb
SHA512041120413a6d51237d1b2557a29114a2f6da435cdbcf07bccf82491add411dc88408fbbc1cb96728331dae9614c78654e95b7e5334497e87c2247ac55c6b9542
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5bc812f098df521f0f683ad644486ef65
SHA17eff484f6b11cea5b0b128208c709bfa771d281d
SHA256e7c8cc8c62d71934197d9e0fb8e18c2682a13ba9701d403f24b0f316b05842c1
SHA51276320a0d8db869c36eec8053982da482d412f76704f083086aef904ece0b4da66abbf21f320210d192f2ba41574b9f71ecc5c9f22325f97cc6d5c97ec5f1408d
-
Filesize
106KB
MD5bc812f098df521f0f683ad644486ef65
SHA17eff484f6b11cea5b0b128208c709bfa771d281d
SHA256e7c8cc8c62d71934197d9e0fb8e18c2682a13ba9701d403f24b0f316b05842c1
SHA51276320a0d8db869c36eec8053982da482d412f76704f083086aef904ece0b4da66abbf21f320210d192f2ba41574b9f71ecc5c9f22325f97cc6d5c97ec5f1408d
-
Filesize
106KB
MD5bc812f098df521f0f683ad644486ef65
SHA17eff484f6b11cea5b0b128208c709bfa771d281d
SHA256e7c8cc8c62d71934197d9e0fb8e18c2682a13ba9701d403f24b0f316b05842c1
SHA51276320a0d8db869c36eec8053982da482d412f76704f083086aef904ece0b4da66abbf21f320210d192f2ba41574b9f71ecc5c9f22325f97cc6d5c97ec5f1408d
-
Filesize
241KB
MD5061a8c137c8419da3c624452b4c39f0e
SHA11afb086b67394d0a3ec0f7cf63a94a0789d028b4
SHA256360cdd5cc1703b80f4c4b2e0a66fd22d7acac8af14177725f7453bac92e1d0e6
SHA512809d0289b35569da1a88b8eaea911506564fd8a76ac459dee0d70794445079b908a6a9b94a5544e29c94173fd32f4acf29db1c462ced346dfc221305bedee022
-
Filesize
241KB
MD5061a8c137c8419da3c624452b4c39f0e
SHA11afb086b67394d0a3ec0f7cf63a94a0789d028b4
SHA256360cdd5cc1703b80f4c4b2e0a66fd22d7acac8af14177725f7453bac92e1d0e6
SHA512809d0289b35569da1a88b8eaea911506564fd8a76ac459dee0d70794445079b908a6a9b94a5544e29c94173fd32f4acf29db1c462ced346dfc221305bedee022
-
Filesize
108KB
MD582c5677317ab76d9f135209319e30990
SHA119834a725ab889954b2632194f30bd8739e2fcc7
SHA256127bdf6275b03467cce335768f6d0026e1e60f4545dbb2f6076097f20623ac2e
SHA512ed3e4ba26d64a31595dca2f281bf7b452e35dcd94498246592b51806bb04ed39e0c0f041b0d2daa1f0e90507bc05ef205f4fd80c6045408df52ad8f2dedeed57
-
Filesize
176KB
MD5a9ce9e520e3a51732a559301340b304d
SHA1025e33cf8d41b78a0d5713c9fc2a1330f43f4b7f
SHA25617c319b10b8780c96b75b4efd278c819559c691c77489ff72954bbac594fff04
SHA51260f8d37250ae21f522c1460678e61e50b1b02ddc2a5b1dfb05836fe0d6fba88402ed6f8f339829f3a6097c518e2dfdc36864fce7d309090725214737ad82e8bd
-
Filesize
159KB
MD5c101cf8feaaec6a6a9c63a5c780d073d
SHA1b6753dfe911eaeb79d08e30fdd962d4c32301273
SHA25608ae335e9ac8c641531c195a54eb356c3ce8b70e919e383adbf1a185ac12dbdb
SHA512041120413a6d51237d1b2557a29114a2f6da435cdbcf07bccf82491add411dc88408fbbc1cb96728331dae9614c78654e95b7e5334497e87c2247ac55c6b9542