Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 10:34
Static task
static1
Behavioral task
behavioral1
Sample
0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe
Resource
win10v2004-20220812-en
General
-
Target
0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe
-
Size
602KB
-
MD5
2cb58bcf73308f9c7f30f7dde2cbdf04
-
SHA1
a97ae0fd1ee840e5ac5a76d9e7a5e01725480bf9
-
SHA256
0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d
-
SHA512
090e25114f75e0f3b41b7e8a2f0d952b8523e166441bf05f39dce76a69b3374da59689addad5a8fabcf166db454ce6f5b3ca45faa7e3fddb2f4e8f73e7db2312
-
SSDEEP
12288:dIny5DYTlzZWJQYZPZD7gYYDglz2O1ApqGU8gZRb9MoqX+Z:JUT5ZWJQYZPZ/gXg92AANgb5hqX+
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exedescription ioc process File created C:\Windows\system32\drivers\nethfdrv.sys 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe -
Executes dropped EXE 5 IoCs
Processes:
installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exepid process 956 installd.exe 2008 nethtsrv.exe 1656 netupdsrv.exe 1544 nethtsrv.exe 856 netupdsrv.exe -
Loads dropped DLL 13 IoCs
Processes:
0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exeinstalld.exenethtsrv.exenethtsrv.exepid process 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe 956 installd.exe 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe 2008 nethtsrv.exe 2008 nethtsrv.exe 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe 1544 nethtsrv.exe 1544 nethtsrv.exe 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exedescription ioc process File created C:\Windows\SysWOW64\netupdsrv.exe 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe File created C:\Windows\SysWOW64\hfnapi.dll 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe File created C:\Windows\SysWOW64\hfpapi.dll 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe File created C:\Windows\SysWOW64\installd.exe 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe File created C:\Windows\SysWOW64\nethtsrv.exe 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe -
Drops file in Program Files directory 3 IoCs
Processes:
0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exedescription ioc process File created C:\Program Files (x86)\Common Files\Config\ver.xml 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe File created C:\Program Files (x86)\Common Files\Config\data.xml 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 464 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nethtsrv.exedescription pid process Token: SeDebugPrivilege 1544 nethtsrv.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exenet.exenet.exenet.exenet.exedescription pid process target process PID 1604 wrote to memory of 1144 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe net.exe PID 1604 wrote to memory of 1144 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe net.exe PID 1604 wrote to memory of 1144 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe net.exe PID 1604 wrote to memory of 1144 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe net.exe PID 1144 wrote to memory of 2020 1144 net.exe net1.exe PID 1144 wrote to memory of 2020 1144 net.exe net1.exe PID 1144 wrote to memory of 2020 1144 net.exe net1.exe PID 1144 wrote to memory of 2020 1144 net.exe net1.exe PID 1604 wrote to memory of 2012 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe net.exe PID 1604 wrote to memory of 2012 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe net.exe PID 1604 wrote to memory of 2012 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe net.exe PID 1604 wrote to memory of 2012 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe net.exe PID 2012 wrote to memory of 1984 2012 net.exe net1.exe PID 2012 wrote to memory of 1984 2012 net.exe net1.exe PID 2012 wrote to memory of 1984 2012 net.exe net1.exe PID 2012 wrote to memory of 1984 2012 net.exe net1.exe PID 1604 wrote to memory of 956 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe installd.exe PID 1604 wrote to memory of 956 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe installd.exe PID 1604 wrote to memory of 956 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe installd.exe PID 1604 wrote to memory of 956 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe installd.exe PID 1604 wrote to memory of 956 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe installd.exe PID 1604 wrote to memory of 956 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe installd.exe PID 1604 wrote to memory of 956 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe installd.exe PID 1604 wrote to memory of 2008 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe nethtsrv.exe PID 1604 wrote to memory of 2008 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe nethtsrv.exe PID 1604 wrote to memory of 2008 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe nethtsrv.exe PID 1604 wrote to memory of 2008 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe nethtsrv.exe PID 1604 wrote to memory of 1656 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe netupdsrv.exe PID 1604 wrote to memory of 1656 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe netupdsrv.exe PID 1604 wrote to memory of 1656 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe netupdsrv.exe PID 1604 wrote to memory of 1656 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe netupdsrv.exe PID 1604 wrote to memory of 1656 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe netupdsrv.exe PID 1604 wrote to memory of 1656 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe netupdsrv.exe PID 1604 wrote to memory of 1656 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe netupdsrv.exe PID 1604 wrote to memory of 1992 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe net.exe PID 1604 wrote to memory of 1992 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe net.exe PID 1604 wrote to memory of 1992 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe net.exe PID 1604 wrote to memory of 1992 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe net.exe PID 1992 wrote to memory of 1496 1992 net.exe net1.exe PID 1992 wrote to memory of 1496 1992 net.exe net1.exe PID 1992 wrote to memory of 1496 1992 net.exe net1.exe PID 1992 wrote to memory of 1496 1992 net.exe net1.exe PID 1604 wrote to memory of 1504 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe net.exe PID 1604 wrote to memory of 1504 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe net.exe PID 1604 wrote to memory of 1504 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe net.exe PID 1604 wrote to memory of 1504 1604 0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe net.exe PID 1504 wrote to memory of 1492 1504 net.exe net1.exe PID 1504 wrote to memory of 1492 1504 net.exe net1.exe PID 1504 wrote to memory of 1492 1504 net.exe net1.exe PID 1504 wrote to memory of 1492 1504 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe"C:\Users\Admin\AppData\Local\Temp\0aa2f007501db23aa0bdf2d6ce2e7be5b163661d198a2e169815b398870f3a2d.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:2020
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:1984
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:1656 -
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:1496
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:1492
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:856
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD54681be6beb65c2fdcf558baca2737542
SHA1be8fb4a0150275adfa68d3affac6da0039157711
SHA2565950afc0f7ddacefc63595b747decaa3528fddb6dc08d53a9576f81cc32b20e9
SHA512f4092651e9e9423089f669c65b4d41d7b7a5ce86603b59b1d23b5e018893a7e7d0abb82c74b795fad6dde97cd81e566e0bf2e05b2a59264f6005975fa6df77a3
-
Filesize
241KB
MD5bbb52322b29768484848c180cc180315
SHA1604d9fab709cfce0be87851666589a41171fb43c
SHA256397b3c44425537a12141760563545a0a37065ee9e750807d3519124d46bf3b75
SHA5128b098e86357c6c3f44b073aae8b0605c70e5af13b59f5fef1716b879cc0baca694ead9f7e68a97896ed0b58ed55f6c2c2472062f51ecba4ff4af640505020d1f
-
Filesize
108KB
MD5fa970ad04bd373f852794d6efe01f733
SHA12541773febadd016457ecad7347ed51569b89b50
SHA2567142a8d3022c750177749ca4afcddc5b6ec9f12609a51def165b9a3392307a50
SHA512f7a5ab9427005606f760807837f064afdfd483bbbbaebf0b7fee3947d4f49696fbd5c96ba0f354f6e9402602fbc802eb745586ff70441453e09d7c214925ee3f
-
Filesize
176KB
MD505782db44e3c0833b5626ac86d49c9bb
SHA13aacff25360cc33cabee48ff6204420fa5acf004
SHA2565377be450410ae5ba287a614c9ccea297d26f0b06f6006f217812671a97bf257
SHA512778121e30c3a63b87852e02d5ea1eaf6b9cb1a4fdb1ff9fdbd5ee4cce638d121d0a1c056ad679abd3c50f2b6863bc8c2124f5ad64366529ef6e134574793ddf4
-
Filesize
176KB
MD505782db44e3c0833b5626ac86d49c9bb
SHA13aacff25360cc33cabee48ff6204420fa5acf004
SHA2565377be450410ae5ba287a614c9ccea297d26f0b06f6006f217812671a97bf257
SHA512778121e30c3a63b87852e02d5ea1eaf6b9cb1a4fdb1ff9fdbd5ee4cce638d121d0a1c056ad679abd3c50f2b6863bc8c2124f5ad64366529ef6e134574793ddf4
-
Filesize
159KB
MD5c4459f5ea23a26fdc27d56a497960198
SHA126183a908ac9ff396d7cc8a0c11ba9bd03a1961b
SHA256d06687d750231bd911f7783efdf1be6e4886d6059ce1cf931c5f56faf6303c12
SHA5120082a1e17900ac7f99b3d392857697541778171140aaaec4942b31a7c185efdbad04cb82bca4895d8895466c84203b901db844e4020a4f360a5ad02a871ba996
-
Filesize
159KB
MD5c4459f5ea23a26fdc27d56a497960198
SHA126183a908ac9ff396d7cc8a0c11ba9bd03a1961b
SHA256d06687d750231bd911f7783efdf1be6e4886d6059ce1cf931c5f56faf6303c12
SHA5120082a1e17900ac7f99b3d392857697541778171140aaaec4942b31a7c185efdbad04cb82bca4895d8895466c84203b901db844e4020a4f360a5ad02a871ba996
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD54681be6beb65c2fdcf558baca2737542
SHA1be8fb4a0150275adfa68d3affac6da0039157711
SHA2565950afc0f7ddacefc63595b747decaa3528fddb6dc08d53a9576f81cc32b20e9
SHA512f4092651e9e9423089f669c65b4d41d7b7a5ce86603b59b1d23b5e018893a7e7d0abb82c74b795fad6dde97cd81e566e0bf2e05b2a59264f6005975fa6df77a3
-
Filesize
106KB
MD54681be6beb65c2fdcf558baca2737542
SHA1be8fb4a0150275adfa68d3affac6da0039157711
SHA2565950afc0f7ddacefc63595b747decaa3528fddb6dc08d53a9576f81cc32b20e9
SHA512f4092651e9e9423089f669c65b4d41d7b7a5ce86603b59b1d23b5e018893a7e7d0abb82c74b795fad6dde97cd81e566e0bf2e05b2a59264f6005975fa6df77a3
-
Filesize
106KB
MD54681be6beb65c2fdcf558baca2737542
SHA1be8fb4a0150275adfa68d3affac6da0039157711
SHA2565950afc0f7ddacefc63595b747decaa3528fddb6dc08d53a9576f81cc32b20e9
SHA512f4092651e9e9423089f669c65b4d41d7b7a5ce86603b59b1d23b5e018893a7e7d0abb82c74b795fad6dde97cd81e566e0bf2e05b2a59264f6005975fa6df77a3
-
Filesize
241KB
MD5bbb52322b29768484848c180cc180315
SHA1604d9fab709cfce0be87851666589a41171fb43c
SHA256397b3c44425537a12141760563545a0a37065ee9e750807d3519124d46bf3b75
SHA5128b098e86357c6c3f44b073aae8b0605c70e5af13b59f5fef1716b879cc0baca694ead9f7e68a97896ed0b58ed55f6c2c2472062f51ecba4ff4af640505020d1f
-
Filesize
241KB
MD5bbb52322b29768484848c180cc180315
SHA1604d9fab709cfce0be87851666589a41171fb43c
SHA256397b3c44425537a12141760563545a0a37065ee9e750807d3519124d46bf3b75
SHA5128b098e86357c6c3f44b073aae8b0605c70e5af13b59f5fef1716b879cc0baca694ead9f7e68a97896ed0b58ed55f6c2c2472062f51ecba4ff4af640505020d1f
-
Filesize
108KB
MD5fa970ad04bd373f852794d6efe01f733
SHA12541773febadd016457ecad7347ed51569b89b50
SHA2567142a8d3022c750177749ca4afcddc5b6ec9f12609a51def165b9a3392307a50
SHA512f7a5ab9427005606f760807837f064afdfd483bbbbaebf0b7fee3947d4f49696fbd5c96ba0f354f6e9402602fbc802eb745586ff70441453e09d7c214925ee3f
-
Filesize
176KB
MD505782db44e3c0833b5626ac86d49c9bb
SHA13aacff25360cc33cabee48ff6204420fa5acf004
SHA2565377be450410ae5ba287a614c9ccea297d26f0b06f6006f217812671a97bf257
SHA512778121e30c3a63b87852e02d5ea1eaf6b9cb1a4fdb1ff9fdbd5ee4cce638d121d0a1c056ad679abd3c50f2b6863bc8c2124f5ad64366529ef6e134574793ddf4
-
Filesize
159KB
MD5c4459f5ea23a26fdc27d56a497960198
SHA126183a908ac9ff396d7cc8a0c11ba9bd03a1961b
SHA256d06687d750231bd911f7783efdf1be6e4886d6059ce1cf931c5f56faf6303c12
SHA5120082a1e17900ac7f99b3d392857697541778171140aaaec4942b31a7c185efdbad04cb82bca4895d8895466c84203b901db844e4020a4f360a5ad02a871ba996