Analysis
-
max time kernel
90s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:24
Static task
static1
Behavioral task
behavioral1
Sample
696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe
Resource
win10v2004-20220901-en
General
-
Target
696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe
-
Size
602KB
-
MD5
29d7bedcea35c8557097c557542c1e40
-
SHA1
3ea4061e6b3e9bf93cd514500d62d9b4d20532e6
-
SHA256
696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e
-
SHA512
00f98975b6c61408b45528a1fe53af7cb4142b535374609a623d9bb9bf6264ae9651c73dedea69974bfe537fb7d2009c6eb560ff0e37e45cc9edbc1624de98e8
-
SSDEEP
12288:LIny5DYTSIWaadfl8xTgy/jS5sq8hRdt+aNJZATz3Kg+KFkDYSrg:zUTSthuTgy/j7hjtOXKg+IkDYSrg
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exedescription ioc process File created C:\Windows\system32\drivers\nethfdrv.sys 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe -
Executes dropped EXE 5 IoCs
Processes:
installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exepid process 1444 installd.exe 3748 nethtsrv.exe 4432 netupdsrv.exe 2420 nethtsrv.exe 4644 netupdsrv.exe -
Loads dropped DLL 14 IoCs
Processes:
696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exeinstalld.exenethtsrv.exenethtsrv.exepid process 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe 1444 installd.exe 3748 nethtsrv.exe 3748 nethtsrv.exe 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe 2420 nethtsrv.exe 2420 nethtsrv.exe 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exedescription ioc process File created C:\Windows\SysWOW64\nethtsrv.exe 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe File created C:\Windows\SysWOW64\netupdsrv.exe 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe File created C:\Windows\SysWOW64\hfnapi.dll 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe File created C:\Windows\SysWOW64\hfpapi.dll 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe File created C:\Windows\SysWOW64\installd.exe 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe -
Drops file in Program Files directory 3 IoCs
Processes:
696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exedescription ioc process File created C:\Program Files (x86)\Common Files\Config\data.xml 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
Processes:
nethtsrv.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 668 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nethtsrv.exedescription pid process Token: SeDebugPrivilege 2420 nethtsrv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exenet.exenet.exenet.exenet.exedescription pid process target process PID 3388 wrote to memory of 652 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe net.exe PID 3388 wrote to memory of 652 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe net.exe PID 3388 wrote to memory of 652 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe net.exe PID 652 wrote to memory of 524 652 net.exe net1.exe PID 652 wrote to memory of 524 652 net.exe net1.exe PID 652 wrote to memory of 524 652 net.exe net1.exe PID 3388 wrote to memory of 5088 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe net.exe PID 3388 wrote to memory of 5088 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe net.exe PID 3388 wrote to memory of 5088 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe net.exe PID 5088 wrote to memory of 2416 5088 net.exe net1.exe PID 5088 wrote to memory of 2416 5088 net.exe net1.exe PID 5088 wrote to memory of 2416 5088 net.exe net1.exe PID 3388 wrote to memory of 1444 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe installd.exe PID 3388 wrote to memory of 1444 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe installd.exe PID 3388 wrote to memory of 1444 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe installd.exe PID 3388 wrote to memory of 3748 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe nethtsrv.exe PID 3388 wrote to memory of 3748 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe nethtsrv.exe PID 3388 wrote to memory of 3748 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe nethtsrv.exe PID 3388 wrote to memory of 4432 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe netupdsrv.exe PID 3388 wrote to memory of 4432 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe netupdsrv.exe PID 3388 wrote to memory of 4432 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe netupdsrv.exe PID 3388 wrote to memory of 4536 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe net.exe PID 3388 wrote to memory of 4536 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe net.exe PID 3388 wrote to memory of 4536 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe net.exe PID 4536 wrote to memory of 4524 4536 net.exe net1.exe PID 4536 wrote to memory of 4524 4536 net.exe net1.exe PID 4536 wrote to memory of 4524 4536 net.exe net1.exe PID 3388 wrote to memory of 3684 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe net.exe PID 3388 wrote to memory of 3684 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe net.exe PID 3388 wrote to memory of 3684 3388 696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe net.exe PID 3684 wrote to memory of 4416 3684 net.exe net1.exe PID 3684 wrote to memory of 4416 3684 net.exe net1.exe PID 3684 wrote to memory of 4416 3684 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe"C:\Users\Admin\AppData\Local\Temp\696efaa29a7e3b751e074f12883ed1e00dd281641ef6878ea9ed43fb4f79af5e.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:524
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:2416
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3748 -
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:4432 -
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:4524
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:4416
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:4644
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD5c3022c6a1742633eb5f2b11eca29ad8f
SHA108256a58b8e3b4e4015e4536676cdb7d72a0ecf4
SHA2562fdc6c83740c45d6168ccbe6ae148f5da786971897a580750609f8d22ad9b496
SHA512abced16dc3efd9db31e2b702514778aafde2d9410d54141186931f324e07572822e0c20a4789ad453a31c79ab904c99ab0745f8997f59e40286cd0c8b5754203
-
Filesize
106KB
MD5c3022c6a1742633eb5f2b11eca29ad8f
SHA108256a58b8e3b4e4015e4536676cdb7d72a0ecf4
SHA2562fdc6c83740c45d6168ccbe6ae148f5da786971897a580750609f8d22ad9b496
SHA512abced16dc3efd9db31e2b702514778aafde2d9410d54141186931f324e07572822e0c20a4789ad453a31c79ab904c99ab0745f8997f59e40286cd0c8b5754203
-
Filesize
106KB
MD5c3022c6a1742633eb5f2b11eca29ad8f
SHA108256a58b8e3b4e4015e4536676cdb7d72a0ecf4
SHA2562fdc6c83740c45d6168ccbe6ae148f5da786971897a580750609f8d22ad9b496
SHA512abced16dc3efd9db31e2b702514778aafde2d9410d54141186931f324e07572822e0c20a4789ad453a31c79ab904c99ab0745f8997f59e40286cd0c8b5754203
-
Filesize
106KB
MD5c3022c6a1742633eb5f2b11eca29ad8f
SHA108256a58b8e3b4e4015e4536676cdb7d72a0ecf4
SHA2562fdc6c83740c45d6168ccbe6ae148f5da786971897a580750609f8d22ad9b496
SHA512abced16dc3efd9db31e2b702514778aafde2d9410d54141186931f324e07572822e0c20a4789ad453a31c79ab904c99ab0745f8997f59e40286cd0c8b5754203
-
Filesize
244KB
MD5b1b63b642f75637bb2517986c82c7059
SHA1f0aa2280f38d82167aadfc19351813d4be0a25c1
SHA256ec291cc99c1c8aae65254ee36d7f944f621c317e6de935bdccd8a8198f37367b
SHA5126b4ff654c9082ea765bf03509d62e383dfa1044be8c673f4a8b6fe33e89f7e3c07e5a0b786fdef481a450ad50e85fb9b88519177cf39fe872bf770892358742f
-
Filesize
244KB
MD5b1b63b642f75637bb2517986c82c7059
SHA1f0aa2280f38d82167aadfc19351813d4be0a25c1
SHA256ec291cc99c1c8aae65254ee36d7f944f621c317e6de935bdccd8a8198f37367b
SHA5126b4ff654c9082ea765bf03509d62e383dfa1044be8c673f4a8b6fe33e89f7e3c07e5a0b786fdef481a450ad50e85fb9b88519177cf39fe872bf770892358742f
-
Filesize
244KB
MD5b1b63b642f75637bb2517986c82c7059
SHA1f0aa2280f38d82167aadfc19351813d4be0a25c1
SHA256ec291cc99c1c8aae65254ee36d7f944f621c317e6de935bdccd8a8198f37367b
SHA5126b4ff654c9082ea765bf03509d62e383dfa1044be8c673f4a8b6fe33e89f7e3c07e5a0b786fdef481a450ad50e85fb9b88519177cf39fe872bf770892358742f
-
Filesize
108KB
MD5a2651c290cb13be116bc3ca73a3b207b
SHA1efdf614f9ea2c0a727f3c3a993aa39dc26e1c8b1
SHA25606a919ffd5b00e652a111a21143c06e64e834de54bcdce9e1b5629ce11f4a881
SHA5122a63d27707a2585ef41eab370e3498a751c27adab358dfad783227f7c03cf33ef5bcdb4d946713653a5719cd8bfa33e6a37ef4c26df5f7e5dc37d7ab13bc3880
-
Filesize
108KB
MD5a2651c290cb13be116bc3ca73a3b207b
SHA1efdf614f9ea2c0a727f3c3a993aa39dc26e1c8b1
SHA25606a919ffd5b00e652a111a21143c06e64e834de54bcdce9e1b5629ce11f4a881
SHA5122a63d27707a2585ef41eab370e3498a751c27adab358dfad783227f7c03cf33ef5bcdb4d946713653a5719cd8bfa33e6a37ef4c26df5f7e5dc37d7ab13bc3880
-
Filesize
176KB
MD56c417a8ed68b0852d8bf6f3d98bcc117
SHA1eee134f14b3e0e98dbdb2b08c19b6be10fbd9ce4
SHA256f4fd7787e6ea2284f22b84c65cfd738a6dcb8f0a449006a197a3b1ff5f9671dd
SHA512c739a10864f15e4a3c52ee0076bd63ca9a5921b9ce403f9a81813044de79dd536c4d8692a457ab19ef6fb63e9b6c1b587497ca556aced0abccd91ec8f38069df
-
Filesize
176KB
MD56c417a8ed68b0852d8bf6f3d98bcc117
SHA1eee134f14b3e0e98dbdb2b08c19b6be10fbd9ce4
SHA256f4fd7787e6ea2284f22b84c65cfd738a6dcb8f0a449006a197a3b1ff5f9671dd
SHA512c739a10864f15e4a3c52ee0076bd63ca9a5921b9ce403f9a81813044de79dd536c4d8692a457ab19ef6fb63e9b6c1b587497ca556aced0abccd91ec8f38069df
-
Filesize
176KB
MD56c417a8ed68b0852d8bf6f3d98bcc117
SHA1eee134f14b3e0e98dbdb2b08c19b6be10fbd9ce4
SHA256f4fd7787e6ea2284f22b84c65cfd738a6dcb8f0a449006a197a3b1ff5f9671dd
SHA512c739a10864f15e4a3c52ee0076bd63ca9a5921b9ce403f9a81813044de79dd536c4d8692a457ab19ef6fb63e9b6c1b587497ca556aced0abccd91ec8f38069df
-
Filesize
158KB
MD55e053ef02c32afbf449633e5f64284dd
SHA1058eb072d3ed585eaaa72496a476da37b74b37e7
SHA256f204185466f214a5ae5d7d1786eb0c881b7cc1bbfecb0fa46b14fa635e568ac9
SHA512da9196db1cdb6ad975b46556a27a3974b9c56f7bf3df599c8ff7ebd8f24f76724ea803494cd21f3e9876646ed36dea02e912a3b1ebc410da98e06a2f7411f347
-
Filesize
158KB
MD55e053ef02c32afbf449633e5f64284dd
SHA1058eb072d3ed585eaaa72496a476da37b74b37e7
SHA256f204185466f214a5ae5d7d1786eb0c881b7cc1bbfecb0fa46b14fa635e568ac9
SHA512da9196db1cdb6ad975b46556a27a3974b9c56f7bf3df599c8ff7ebd8f24f76724ea803494cd21f3e9876646ed36dea02e912a3b1ebc410da98e06a2f7411f347
-
Filesize
158KB
MD55e053ef02c32afbf449633e5f64284dd
SHA1058eb072d3ed585eaaa72496a476da37b74b37e7
SHA256f204185466f214a5ae5d7d1786eb0c881b7cc1bbfecb0fa46b14fa635e568ac9
SHA512da9196db1cdb6ad975b46556a27a3974b9c56f7bf3df599c8ff7ebd8f24f76724ea803494cd21f3e9876646ed36dea02e912a3b1ebc410da98e06a2f7411f347