Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 02:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe
-
Size
97KB
-
MD5
1b2e6863d541a4c2a37e06818c529d40
-
SHA1
2800b6a11e190be6e5cb7822f58470ffc19d75d5
-
SHA256
8e4605ce9403ff902ebd6c92a15f2f15be46967c43217b4ee3c9021d826da3d3
-
SHA512
1534d59c08e4ee51337fab8c301d32d96dc82dd1e26513cba95446164cda4d3e158ce2df2b1200713040f5987cd48f88915fb73163bca540ae23a1018982b8e8
-
SSDEEP
1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIe:J8dfX7y9DZ+N7eB+tIe
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE -
Executes dropped EXE 12 IoCs
pid Process 2564 SVCHOST.EXE 2756 SVCHOST.EXE 2740 SVCHOST.EXE 2572 SVCHOST.EXE 1636 SVCHOST.EXE 2536 SPOOLSV.EXE 1236 SVCHOST.EXE 856 SVCHOST.EXE 2768 SPOOLSV.EXE 2560 SPOOLSV.EXE 1548 SVCHOST.EXE 1744 SPOOLSV.EXE -
Loads dropped DLL 21 IoCs
pid Process 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2536 SPOOLSV.EXE 2536 SPOOLSV.EXE 2536 SPOOLSV.EXE 2536 SPOOLSV.EXE 2536 SPOOLSV.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened for modification F:\Recycled\desktop.ini 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\T: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\W: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\H: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\J: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\L: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\E: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\N: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\X: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\Y: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\I: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\G: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\Q: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\S: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\U: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\K: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\O: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\docicon.exe 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\CONFIG\COMMAND 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\INSTALL 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1596 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2536 SPOOLSV.EXE 2536 SPOOLSV.EXE 2536 SPOOLSV.EXE 2536 SPOOLSV.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE 2536 SPOOLSV.EXE 2536 SPOOLSV.EXE 2536 SPOOLSV.EXE 2536 SPOOLSV.EXE 2536 SPOOLSV.EXE 2536 SPOOLSV.EXE 2536 SPOOLSV.EXE 2536 SPOOLSV.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2564 SVCHOST.EXE 2740 SVCHOST.EXE 2740 SVCHOST.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 2564 SVCHOST.EXE 2756 SVCHOST.EXE 2740 SVCHOST.EXE 2572 SVCHOST.EXE 1636 SVCHOST.EXE 2536 SPOOLSV.EXE 1236 SVCHOST.EXE 856 SVCHOST.EXE 2768 SPOOLSV.EXE 2560 SPOOLSV.EXE 1548 SVCHOST.EXE 1744 SPOOLSV.EXE 1596 WINWORD.EXE 1596 WINWORD.EXE -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 620 wrote to memory of 2564 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 28 PID 620 wrote to memory of 2564 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 28 PID 620 wrote to memory of 2564 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 28 PID 620 wrote to memory of 2564 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 28 PID 2564 wrote to memory of 2756 2564 SVCHOST.EXE 29 PID 2564 wrote to memory of 2756 2564 SVCHOST.EXE 29 PID 2564 wrote to memory of 2756 2564 SVCHOST.EXE 29 PID 2564 wrote to memory of 2756 2564 SVCHOST.EXE 29 PID 2564 wrote to memory of 2740 2564 SVCHOST.EXE 30 PID 2564 wrote to memory of 2740 2564 SVCHOST.EXE 30 PID 2564 wrote to memory of 2740 2564 SVCHOST.EXE 30 PID 2564 wrote to memory of 2740 2564 SVCHOST.EXE 30 PID 2740 wrote to memory of 2572 2740 SVCHOST.EXE 31 PID 2740 wrote to memory of 2572 2740 SVCHOST.EXE 31 PID 2740 wrote to memory of 2572 2740 SVCHOST.EXE 31 PID 2740 wrote to memory of 2572 2740 SVCHOST.EXE 31 PID 2740 wrote to memory of 1636 2740 SVCHOST.EXE 32 PID 2740 wrote to memory of 1636 2740 SVCHOST.EXE 32 PID 2740 wrote to memory of 1636 2740 SVCHOST.EXE 32 PID 2740 wrote to memory of 1636 2740 SVCHOST.EXE 32 PID 2740 wrote to memory of 2536 2740 SVCHOST.EXE 33 PID 2740 wrote to memory of 2536 2740 SVCHOST.EXE 33 PID 2740 wrote to memory of 2536 2740 SVCHOST.EXE 33 PID 2740 wrote to memory of 2536 2740 SVCHOST.EXE 33 PID 2536 wrote to memory of 1236 2536 SPOOLSV.EXE 34 PID 2536 wrote to memory of 1236 2536 SPOOLSV.EXE 34 PID 2536 wrote to memory of 1236 2536 SPOOLSV.EXE 34 PID 2536 wrote to memory of 1236 2536 SPOOLSV.EXE 34 PID 2536 wrote to memory of 856 2536 SPOOLSV.EXE 35 PID 2536 wrote to memory of 856 2536 SPOOLSV.EXE 35 PID 2536 wrote to memory of 856 2536 SPOOLSV.EXE 35 PID 2536 wrote to memory of 856 2536 SPOOLSV.EXE 35 PID 2536 wrote to memory of 2768 2536 SPOOLSV.EXE 36 PID 2536 wrote to memory of 2768 2536 SPOOLSV.EXE 36 PID 2536 wrote to memory of 2768 2536 SPOOLSV.EXE 36 PID 2536 wrote to memory of 2768 2536 SPOOLSV.EXE 36 PID 2564 wrote to memory of 2560 2564 SVCHOST.EXE 37 PID 2564 wrote to memory of 2560 2564 SVCHOST.EXE 37 PID 2564 wrote to memory of 2560 2564 SVCHOST.EXE 37 PID 2564 wrote to memory of 2560 2564 SVCHOST.EXE 37 PID 620 wrote to memory of 1548 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 38 PID 620 wrote to memory of 1548 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 38 PID 620 wrote to memory of 1548 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 38 PID 620 wrote to memory of 1548 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 38 PID 620 wrote to memory of 1744 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 39 PID 620 wrote to memory of 1744 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 39 PID 620 wrote to memory of 1744 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 39 PID 620 wrote to memory of 1744 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 39 PID 620 wrote to memory of 1596 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 40 PID 620 wrote to memory of 1596 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 40 PID 620 wrote to memory of 1596 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 40 PID 620 wrote to memory of 1596 620 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 40 PID 1596 wrote to memory of 2256 1596 WINWORD.EXE 44 PID 1596 wrote to memory of 2256 1596 WINWORD.EXE 44 PID 1596 wrote to memory of 2256 1596 WINWORD.EXE 44 PID 1596 wrote to memory of 2256 1596 WINWORD.EXE 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2756
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2572
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1636
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1236
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:856
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2768
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2560
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1548
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1744
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.doc"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:2256
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD516b597b0778d21f76e06ba6449b74564
SHA11870d448ab0d8c3d11962730cf10a069f7211f41
SHA256ac60e7194d7434f636ba24259698b25e85f8e10e8dc935315a726737f11d0e08
SHA512e511c627a2ecf4d5744f037d27f4e3a6bd08a79b3d41537563c8e843e5bb1b2e4e8f687d2815acfb42f900221c32965808d1ec866c0db128f5868d54f77e47c5
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
97KB
MD5a16eb27a463442229f6e3a277601fbb0
SHA1f97eef36ed30d27f92b5d6901eae41dd907f27e7
SHA256eb3c272ca1c811805103892b79dde53c2faeffc30db409451c30dc356694a340
SHA51207b38ad4b125951f6428b3db2d76e374c393169a91f730cea83e775976f5c520c221255550a3897bf91501080f8275a3c065cb0f2211f929a46cb754c7f21dd5
-
Filesize
97KB
MD5007c2ccf60250b9a96edc73e0e733e98
SHA1a1d2a0af2d564b810359a2761a4d719a32fb4c8d
SHA256cdfa194b376a0ffaccf8a5ccca23e55caae7f25a8d34628144f06729ec3fe5b4
SHA5120e3c53a6cf68b7233de2c707da226975921324ed9123ffdb66807c771848f3bcfc703a8f77c748c7b240e9a0740bce5f83d4c709ce1e94f4c616b7453553f653
-
Filesize
97KB
MD54e5f86c2f1b5c7833a0afd0864fdaeba
SHA106a81a5860bfaf470ff08af7023ecbdf00a59a6d
SHA256da04f4e82658fb813662a0cbe6ae94db9f99ee990e51863bfd3e1b179ca7ad59
SHA512d5c81abf1492eeae41eb26d47bd33a19f5e8d96a7ba3e9746997ce4020dc4e6af9afd81af57c4911f8742276c5b2c0554a31b3dcc57fe8f2a0bbd4c12ccddf74
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
97KB
MD5c95ca607d83c12c22e8e74ff14c333fe
SHA1da6ab6ba41b7a5e4c64a5e782937155613d4de21
SHA256868e51e163dccc32c9e4cbb10d2bec392aebad37fedea3a7a28901c86b4536fb
SHA512ba9f692ee3f26c96c02ea7afe586fe3c1ffb7a1b9dbf347b65b10768f085cd5823875298de82f2cad6c6f610211c87c9589691e7c58e8793a6fbfd6899dae236
-
Filesize
97KB
MD5a966113c038433c8761575049c648783
SHA177b5dd803ede055d98a95348ac7a287caae07d19
SHA256c28ef1ea0cc47ce20aae505ea5a33171a4130f369b4db089233c478a8a04af91
SHA512b9f69168d4fd65056e69b9570c836131319fc82f09304832da9d9fce79ccc03208c5c3967ff0a7e38a68812fb0c9dd54444225f8ce5cc91de20e8a94bb15aa9f