Analysis
-
max time kernel
151s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:52
Static task
static1
Behavioral task
behavioral1
Sample
ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe
Resource
win10v2004-20220812-en
General
-
Target
ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe
-
Size
445KB
-
MD5
840a4a8c1768b80d1fda0993406a5535
-
SHA1
70e70d59bbbe5337fa04f4b9d0efddf9dcda3254
-
SHA256
ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf
-
SHA512
c2a57cb6837646635e506a256d0116fe124b70a10555c87198646332e0840c2edc35b27c862efef65c7d6d71b145d3b709100e617035f32ebb0127248f973b15
-
SSDEEP
12288:pEOa0BaqRVJmmtR2dPyOvHVM8Uyx+lUlFj1N02liqwF00b2:pba0wI7mxdKOPKrU+lUllirFBb2
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exedescription ioc process File created C:\Windows\system32\drivers\nethfdrv.sys ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe -
Executes dropped EXE 5 IoCs
Processes:
installd.exenethtsrv.exenetupdsrv.exenethtsrv.exenetupdsrv.exepid process 4956 installd.exe 2160 nethtsrv.exe 2324 netupdsrv.exe 3664 nethtsrv.exe 3724 netupdsrv.exe -
Loads dropped DLL 14 IoCs
Processes:
ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exeinstalld.exenethtsrv.exenethtsrv.exepid process 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe 4956 installd.exe 2160 nethtsrv.exe 2160 nethtsrv.exe 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe 3664 nethtsrv.exe 3664 nethtsrv.exe 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exedescription ioc process File created C:\Windows\SysWOW64\hfnapi.dll ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe File created C:\Windows\SysWOW64\hfpapi.dll ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe File created C:\Windows\SysWOW64\installd.exe ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe File created C:\Windows\SysWOW64\nethtsrv.exe ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe File created C:\Windows\SysWOW64\netupdsrv.exe ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe -
Drops file in Program Files directory 3 IoCs
Processes:
ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exedescription ioc process File created C:\Program Files (x86)\Common Files\Config\data.xml ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe File created C:\Program Files (x86)\Common Files\Config\ver.xml ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe File created C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 1 IoCs
Processes:
nethtsrv.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections nethtsrv.exe -
Runs net.exe
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 648 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nethtsrv.exedescription pid process Token: SeDebugPrivilege 3664 nethtsrv.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exenet.exenet.exenet.exenet.exedescription pid process target process PID 1928 wrote to memory of 3208 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe net.exe PID 1928 wrote to memory of 3208 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe net.exe PID 1928 wrote to memory of 3208 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe net.exe PID 3208 wrote to memory of 860 3208 net.exe net1.exe PID 3208 wrote to memory of 860 3208 net.exe net1.exe PID 3208 wrote to memory of 860 3208 net.exe net1.exe PID 1928 wrote to memory of 5044 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe net.exe PID 1928 wrote to memory of 5044 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe net.exe PID 1928 wrote to memory of 5044 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe net.exe PID 5044 wrote to memory of 1420 5044 net.exe net1.exe PID 5044 wrote to memory of 1420 5044 net.exe net1.exe PID 5044 wrote to memory of 1420 5044 net.exe net1.exe PID 1928 wrote to memory of 4956 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe installd.exe PID 1928 wrote to memory of 4956 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe installd.exe PID 1928 wrote to memory of 4956 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe installd.exe PID 1928 wrote to memory of 2160 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe nethtsrv.exe PID 1928 wrote to memory of 2160 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe nethtsrv.exe PID 1928 wrote to memory of 2160 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe nethtsrv.exe PID 1928 wrote to memory of 2324 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe netupdsrv.exe PID 1928 wrote to memory of 2324 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe netupdsrv.exe PID 1928 wrote to memory of 2324 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe netupdsrv.exe PID 1928 wrote to memory of 2828 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe net.exe PID 1928 wrote to memory of 2828 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe net.exe PID 1928 wrote to memory of 2828 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe net.exe PID 2828 wrote to memory of 3536 2828 net.exe net1.exe PID 2828 wrote to memory of 3536 2828 net.exe net1.exe PID 2828 wrote to memory of 3536 2828 net.exe net1.exe PID 1928 wrote to memory of 1980 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe net.exe PID 1928 wrote to memory of 1980 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe net.exe PID 1928 wrote to memory of 1980 1928 ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe net.exe PID 1980 wrote to memory of 4148 1980 net.exe net1.exe PID 1980 wrote to memory of 4148 1980 net.exe net1.exe PID 1980 wrote to memory of 4148 1980 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe"C:\Users\Admin\AppData\Local\Temp\ca636974a40a8a76fbdc38fef343fe44980a69b6283e00a01cdb7ce32b42bebf.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\net.exenet stop nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop nethttpservice3⤵PID:860
-
C:\Windows\SysWOW64\net.exenet stop serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop serviceupdater3⤵PID:1420
-
C:\Windows\SysWOW64\installd.exe"C:\Windows\system32\installd.exe" nethfdrv2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4956 -
C:\Windows\SysWOW64\nethtsrv.exe"C:\Windows\system32\nethtsrv.exe" -nfdi2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Windows\SysWOW64\netupdsrv.exe"C:\Windows\system32\netupdsrv.exe" -nfdi2⤵
- Executes dropped EXE
PID:2324 -
C:\Windows\SysWOW64\net.exenet start nethttpservice2⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start nethttpservice3⤵PID:3536
-
C:\Windows\SysWOW64\net.exenet start serviceupdater2⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start serviceupdater3⤵PID:4148
-
C:\Windows\SysWOW64\nethtsrv.exeC:\Windows\SysWOW64\nethtsrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3664
-
C:\Windows\SysWOW64\netupdsrv.exeC:\Windows\SysWOW64\netupdsrv.exe1⤵
- Executes dropped EXE
PID:3724
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
106KB
MD59f012a34b4794524e4e99e4f3eadddeb
SHA1ba12935e9ff1566058418f8ae7d5e04b3dd6df29
SHA256c532bad65016ea7d7fd4140b03c0bf02780075e1007dd5c1d90a11a1663a8f82
SHA512ace2793f145f6359fa38dec8c88aa195dd0a74c65ad68ba59592308d00326cf58ed637b7dcf4974f54070f4cbe1ee9c933e54e1fba9d3f920760c2fe93a782f5
-
Filesize
106KB
MD59f012a34b4794524e4e99e4f3eadddeb
SHA1ba12935e9ff1566058418f8ae7d5e04b3dd6df29
SHA256c532bad65016ea7d7fd4140b03c0bf02780075e1007dd5c1d90a11a1663a8f82
SHA512ace2793f145f6359fa38dec8c88aa195dd0a74c65ad68ba59592308d00326cf58ed637b7dcf4974f54070f4cbe1ee9c933e54e1fba9d3f920760c2fe93a782f5
-
Filesize
106KB
MD59f012a34b4794524e4e99e4f3eadddeb
SHA1ba12935e9ff1566058418f8ae7d5e04b3dd6df29
SHA256c532bad65016ea7d7fd4140b03c0bf02780075e1007dd5c1d90a11a1663a8f82
SHA512ace2793f145f6359fa38dec8c88aa195dd0a74c65ad68ba59592308d00326cf58ed637b7dcf4974f54070f4cbe1ee9c933e54e1fba9d3f920760c2fe93a782f5
-
Filesize
106KB
MD59f012a34b4794524e4e99e4f3eadddeb
SHA1ba12935e9ff1566058418f8ae7d5e04b3dd6df29
SHA256c532bad65016ea7d7fd4140b03c0bf02780075e1007dd5c1d90a11a1663a8f82
SHA512ace2793f145f6359fa38dec8c88aa195dd0a74c65ad68ba59592308d00326cf58ed637b7dcf4974f54070f4cbe1ee9c933e54e1fba9d3f920760c2fe93a782f5
-
Filesize
241KB
MD58e4d6a790a4ddbd0280b9a21a1dba3d5
SHA19ea978447a7f6c0c8b26a7295b629eaafaa8bf48
SHA2564e2c442987096cd5404cec52a25642407c6ae6baf1afc73c84c191e599e4973f
SHA51264144c2fcf1ac1277d17af105f9f6326a131c255669e9727a51fd70753fa907b89f5fbf9eaaf4198dd2e103d5ecb2865fb5662815ca4b1c6ef7f19a30e251069
-
Filesize
241KB
MD58e4d6a790a4ddbd0280b9a21a1dba3d5
SHA19ea978447a7f6c0c8b26a7295b629eaafaa8bf48
SHA2564e2c442987096cd5404cec52a25642407c6ae6baf1afc73c84c191e599e4973f
SHA51264144c2fcf1ac1277d17af105f9f6326a131c255669e9727a51fd70753fa907b89f5fbf9eaaf4198dd2e103d5ecb2865fb5662815ca4b1c6ef7f19a30e251069
-
Filesize
241KB
MD58e4d6a790a4ddbd0280b9a21a1dba3d5
SHA19ea978447a7f6c0c8b26a7295b629eaafaa8bf48
SHA2564e2c442987096cd5404cec52a25642407c6ae6baf1afc73c84c191e599e4973f
SHA51264144c2fcf1ac1277d17af105f9f6326a131c255669e9727a51fd70753fa907b89f5fbf9eaaf4198dd2e103d5ecb2865fb5662815ca4b1c6ef7f19a30e251069
-
Filesize
108KB
MD54d41f02a360ddd011bb82c6a73cdc647
SHA153bfaa25b06120d110f0647ad2cadee18bc4d72c
SHA2566aeea173d6f2de9e6dc26b9bd6457f16f3561a89b7479e55d505e85cf3145132
SHA5125abe813be81ee9395a6e2a375af2b5974fd214d76b77f78914760a1ae8b1395aef9b93e0a904243608d117c6781c57af3b16226d2d6d28114b89d1df184adff4
-
Filesize
108KB
MD54d41f02a360ddd011bb82c6a73cdc647
SHA153bfaa25b06120d110f0647ad2cadee18bc4d72c
SHA2566aeea173d6f2de9e6dc26b9bd6457f16f3561a89b7479e55d505e85cf3145132
SHA5125abe813be81ee9395a6e2a375af2b5974fd214d76b77f78914760a1ae8b1395aef9b93e0a904243608d117c6781c57af3b16226d2d6d28114b89d1df184adff4
-
Filesize
176KB
MD59b59ef55106f28098cd386ff7d8c861a
SHA1c89ceade72776e527ef399c5e80133bbe591c149
SHA2560d733914c79c6c9c1625cb483e7efce3134a201dbf6a038f87ed685c402ccfe0
SHA5126ff529f7505c150e6812ca1d6ca2ee810da5596dfe4dd48fcc8c0eba2cd27c3d26abfa66bd1ab06af1d42d9ff7e7beafdc52873f3846360a8d65cd801fe0fb9d
-
Filesize
176KB
MD59b59ef55106f28098cd386ff7d8c861a
SHA1c89ceade72776e527ef399c5e80133bbe591c149
SHA2560d733914c79c6c9c1625cb483e7efce3134a201dbf6a038f87ed685c402ccfe0
SHA5126ff529f7505c150e6812ca1d6ca2ee810da5596dfe4dd48fcc8c0eba2cd27c3d26abfa66bd1ab06af1d42d9ff7e7beafdc52873f3846360a8d65cd801fe0fb9d
-
Filesize
176KB
MD59b59ef55106f28098cd386ff7d8c861a
SHA1c89ceade72776e527ef399c5e80133bbe591c149
SHA2560d733914c79c6c9c1625cb483e7efce3134a201dbf6a038f87ed685c402ccfe0
SHA5126ff529f7505c150e6812ca1d6ca2ee810da5596dfe4dd48fcc8c0eba2cd27c3d26abfa66bd1ab06af1d42d9ff7e7beafdc52873f3846360a8d65cd801fe0fb9d
-
Filesize
159KB
MD5a1bf28ae24a9e43836a7e2ab189eb793
SHA1cac5b081e9afa4222d013c7d7f4871f5310129bf
SHA256fe362ec8fba52b3a6295fbb480ea0beadbf9772579dc17210bfa9b64fdcf915f
SHA512c18c385aa4ea72e96ab911af8eaba91cd0c4ecb9ae01e5e866d0c6e2a0451433149b2c47dc2524aceecd48b3886bd6da222123689cd3ca3fa45d27c6db23e846
-
Filesize
159KB
MD5a1bf28ae24a9e43836a7e2ab189eb793
SHA1cac5b081e9afa4222d013c7d7f4871f5310129bf
SHA256fe362ec8fba52b3a6295fbb480ea0beadbf9772579dc17210bfa9b64fdcf915f
SHA512c18c385aa4ea72e96ab911af8eaba91cd0c4ecb9ae01e5e866d0c6e2a0451433149b2c47dc2524aceecd48b3886bd6da222123689cd3ca3fa45d27c6db23e846
-
Filesize
159KB
MD5a1bf28ae24a9e43836a7e2ab189eb793
SHA1cac5b081e9afa4222d013c7d7f4871f5310129bf
SHA256fe362ec8fba52b3a6295fbb480ea0beadbf9772579dc17210bfa9b64fdcf915f
SHA512c18c385aa4ea72e96ab911af8eaba91cd0c4ecb9ae01e5e866d0c6e2a0451433149b2c47dc2524aceecd48b3886bd6da222123689cd3ca3fa45d27c6db23e846