Analysis
-
max time kernel
132s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 00:30
Static task
static1
Behavioral task
behavioral1
Sample
62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe
-
Size
91KB
-
MD5
62471f8897908d4a96bafd17b1fff310
-
SHA1
6744d8d50390d6b295e19abc72e1f53db87268a0
-
SHA256
f53e279d82dc377fecdd1583b6c467c3e5061c5672643660b43177929d722b7f
-
SHA512
bb14fe42812225b5f039b10fc1527b96067ce51bd6517a9037be21943c5690bce68161c8392a414551ca941103a1a35eddff8e52aa30c5a35f25077abae61bd3
-
SSDEEP
1536:FAwEmBGz1lNNqDaG0Poxhlzm6AwEmBGz1lNNqDaG0PoxhlzmR:FGmUXNQDaG0A86GmUXNQDaG0A8R
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe -
Disables RegEdit via registry modification 2 IoCs
Processes:
62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe -
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 7 IoCs
Processes:
xk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXEpid process 1748 xk.exe 5044 IExplorer.exe 1488 WINLOGON.EXE 3368 CSRSS.EXE 4568 SERVICES.EXE 4928 LSASS.EXE 3216 SMSS.EXE -
Modifies system executable filetype association 2 TTPs 13 IoCs
Processes:
62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe -
Drops file in System32 directory 6 IoCs
Processes:
62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exedescription ioc process File created C:\Windows\SysWOW64\IExplorer.exe 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\IExplorer.exe 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Mig2.scr 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\shell.exe 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe File created C:\Windows\SysWOW64\shell.exe 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Mig2.scr 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\xk.exe 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe File created C:\Windows\xk.exe 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe -
Modifies Control Panel 4 IoCs
Processes:
62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe -
Modifies registry class 15 IoCs
Processes:
62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exepid process 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exexk.exeIExplorer.exeWINLOGON.EXECSRSS.EXESERVICES.EXELSASS.EXESMSS.EXEpid process 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe 1748 xk.exe 5044 IExplorer.exe 1488 WINLOGON.EXE 3368 CSRSS.EXE 4568 SERVICES.EXE 4928 LSASS.EXE 3216 SMSS.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exedescription pid process target process PID 4052 wrote to memory of 1748 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe xk.exe PID 4052 wrote to memory of 1748 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe xk.exe PID 4052 wrote to memory of 1748 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe xk.exe PID 4052 wrote to memory of 5044 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe IExplorer.exe PID 4052 wrote to memory of 5044 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe IExplorer.exe PID 4052 wrote to memory of 5044 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe IExplorer.exe PID 4052 wrote to memory of 1488 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe WINLOGON.EXE PID 4052 wrote to memory of 1488 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe WINLOGON.EXE PID 4052 wrote to memory of 1488 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe WINLOGON.EXE PID 4052 wrote to memory of 3368 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe CSRSS.EXE PID 4052 wrote to memory of 3368 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe CSRSS.EXE PID 4052 wrote to memory of 3368 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe CSRSS.EXE PID 4052 wrote to memory of 4568 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe SERVICES.EXE PID 4052 wrote to memory of 4568 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe SERVICES.EXE PID 4052 wrote to memory of 4568 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe SERVICES.EXE PID 4052 wrote to memory of 4928 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe LSASS.EXE PID 4052 wrote to memory of 4928 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe LSASS.EXE PID 4052 wrote to memory of 4928 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe LSASS.EXE PID 4052 wrote to memory of 3216 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe SMSS.EXE PID 4052 wrote to memory of 3216 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe SMSS.EXE PID 4052 wrote to memory of 3216 4052 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe SMSS.EXE -
System policy modification 1 TTPs 4 IoCs
Processes:
62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\62471f8897908d4a96bafd17b1fff310_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4052 -
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1748 -
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5044 -
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1488 -
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3368 -
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4568 -
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4928 -
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3216
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD54ac238d86d195e7bfe299a5670e4d305
SHA13dee8118480d19d740f1a1156f9ae88767230eeb
SHA256a4318d4573c3128686aabdb9a2a119afb0f7d0b2559f0885b15ac714771b1334
SHA5120a7c27dae5fb477de763b79aadf3b7e1d4a1395a766c3c993ce545ec7ee585b3d73c567c152db39213ad6eb7174ab7457b32e8191a6957a914e59ff23feb91d0
-
Filesize
91KB
MD5ae5086914e885596fb328690343f041a
SHA1d6f98a23e2bab492c3aa4dce8953b0efad7aa422
SHA25601774f6a9f58ab2feb18a89df307cba4d3db7ef94c1e95e63e2fb1fc99cbbd4a
SHA512e3d173cdfbb8a6d7081c89b99f3b37c801d0c62eb7b2cdb5a02f2020171a6e494ee98dc9525ee6632c4f548b1d71646b15c5732d6373f8cf4361acce4f024d5c
-
Filesize
91KB
MD51577460bc866a44b6e874c2fe7bb8673
SHA1591fe08a8bdb20ac44a032689060d177a7d22a58
SHA2567b9eccc124f526d50042eef2a4937a83bd2e24540440d82586634788a4b25906
SHA51283cadc9d772cee0a30dabf8d24bdcf8f387fc381790f9f72a0bfdcbd0a7e3ee9f98575eaaa06d63cd636c027d9ff525cf5edbaa881c80680736c23543a7cfaf8
-
Filesize
91KB
MD5bbb5ab1b79cb1628cdc515deb46424f0
SHA15ca284a5148625950b6b42dcb7e7fc7c5297d57c
SHA2560da7f7b6a37f7c88ea6f7ba6c32417897a379329293fa6a6a0acb0845e57ea2a
SHA5125114cf7f9ce0432ed28218343656a8ce48a90858caf5b6188c50fccde09b5f42407ada6cb1e74ca3684d588d68bc548d923f2c2474bc40a68abb15650976fd48
-
Filesize
91KB
MD5d3681f881ee1f1c003e5fa3b4ba11817
SHA18951ac26debde95c98c64c2b447fef07ac6ebcfa
SHA256155c5e5caf92d0082ef84b46882d9f8a4bf3a37b1832c97b64ea3531c1630781
SHA5125cdac4c9ab22bafcff5f329a49a34bdcacb5fbf1714d3d777830adedee94306a928c6ef30509d7142d88f2df88d498420f75d803fe17de37c71bccd6dac12b9b
-
Filesize
91KB
MD562471f8897908d4a96bafd17b1fff310
SHA16744d8d50390d6b295e19abc72e1f53db87268a0
SHA256f53e279d82dc377fecdd1583b6c467c3e5061c5672643660b43177929d722b7f
SHA512bb14fe42812225b5f039b10fc1527b96067ce51bd6517a9037be21943c5690bce68161c8392a414551ca941103a1a35eddff8e52aa30c5a35f25077abae61bd3
-
Filesize
91KB
MD5e4a603d1ee71ebd597e1a9876295a69e
SHA1324c08790d3cc17f18ada7ddca3a76782026210d
SHA25612734c48d485374eda029280dc9d8f46ad684d61ec777aa34956e3a6812795aa
SHA51234e6365b07fc70dbb3de39cddacaff0d556df77a8499cd495608d5d68e25003b8ed1302ba49afd914028b1ae2c5c8f1dc6f62a535168a9c24203db71cf4cbf74
-
Filesize
91KB
MD54887a6993edf48882c8623dcf254eb3e
SHA1e0397bd9f6761c8cb890b7487435f847be605b19
SHA2562f0f534396683963ae3ae0b7fe2b18efa091dcb1aa17792fcec496679ea7cbb9
SHA512ddc1f7c1124763780e091f9d660f4008dfb8224773d53bb07f111b706d9e9602f3a88f63e5ea5283d98768429e4027e8f2c7562919eef5c03b8cdf6fdf7ed4cd