Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe
-
Size
91KB
-
MD5
55301eb548e63bec7976ae797b12e6f0
-
SHA1
c198aea6d8172a2ae8ab82d05db7bf5fc98be556
-
SHA256
aa6542b54f9f1957e6b1459257b2566817626b566c1eab579899d6511926723c
-
SHA512
0fccbf2887e24d7c0ba935ec652f070949be4d22cd1c3a068055224ce0a9ce9f8d7bf968f2829e8f0fd337e7b45f5c7b899ee98f5f35ff19ff9f0b7fe2bbc694
-
SSDEEP
768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imuz3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS4wT3OA3+KQsxfS4u
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe -
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 7 IoCs
pid Process 3020 xk.exe 3332 IExplorer.exe 2896 WINLOGON.EXE 3032 CSRSS.EXE 1364 SERVICES.EXE 4896 LSASS.EXE 1576 SMSS.EXE -
Modifies system executable filetype association 2 TTPs 13 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\IExplorer.exe 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Mig2.scr 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\shell.exe 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\shell.exe 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Mig2.scr 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\IExplorer.exe 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xk.exe 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe File opened for modification C:\Windows\xk.exe 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe -
Modifies Control Panel 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\Desktop\ 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 3020 xk.exe 3332 IExplorer.exe 2896 WINLOGON.EXE 3032 CSRSS.EXE 1364 SERVICES.EXE 4896 LSASS.EXE 1576 SMSS.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1156 wrote to memory of 3020 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 83 PID 1156 wrote to memory of 3020 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 83 PID 1156 wrote to memory of 3020 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 83 PID 1156 wrote to memory of 3332 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 84 PID 1156 wrote to memory of 3332 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 84 PID 1156 wrote to memory of 3332 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 84 PID 1156 wrote to memory of 2896 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 85 PID 1156 wrote to memory of 2896 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 85 PID 1156 wrote to memory of 2896 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 85 PID 1156 wrote to memory of 3032 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 87 PID 1156 wrote to memory of 3032 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 87 PID 1156 wrote to memory of 3032 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 87 PID 1156 wrote to memory of 1364 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 88 PID 1156 wrote to memory of 1364 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 88 PID 1156 wrote to memory of 1364 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 88 PID 1156 wrote to memory of 4896 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 89 PID 1156 wrote to memory of 4896 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 89 PID 1156 wrote to memory of 4896 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 89 PID 1156 wrote to memory of 1576 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 91 PID 1156 wrote to memory of 1576 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 91 PID 1156 wrote to memory of 1576 1156 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe 91 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\55301eb548e63bec7976ae797b12e6f0_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1156 -
C:\Windows\xk.exeC:\Windows\xk.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3020
-
-
C:\Windows\SysWOW64\IExplorer.exeC:\Windows\system32\IExplorer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3332
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2896
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3032
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1364
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4896
-
-
C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1576
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5aadce1705a8d15c5eac8b3221e78b658
SHA1773ae741d50a66190b650f5cd74f1a495a282742
SHA256fb282777906211405c58c5de55409d83e5744dc11addf8491fcc263bf3392024
SHA5124babb166b4195a9e7c56045fd0386deb3cdcc5a217aefea801a3c72518b580d078997a23e95c94e915e672fdec9e8a8ff72d2d870a8cc341273d1ffb4fdf0636
-
Filesize
91KB
MD5824221693f10287860879a33094e60bf
SHA1a098e46c0123a3d036c62239380fe870f59465d5
SHA25676b218687fe13b146d4a63de5c9e9563f3f29b2b165f7bb791715ff1da97b04d
SHA512f6bd30cb88eb7838dbd2d1360bd11f701624a98f86c57e133494fd4f42f29d3658029b3b3c69b53b2f02baba7162df093c59d90d706da58e815ef107023912cb
-
Filesize
91KB
MD585ecfeafdf1ab5585c8eb9b11a4b2ab9
SHA1c4a2ec69aa1fe2302d5428e45a3f068bcf940ba6
SHA25611353144a5ee62aea9216b58f3c7dd58d025b0ea868111350fe903e3f34b3fbf
SHA51244c205e747a8bef59885cb39606c61b94cce02bec9a14f87913f51f18e75cecc53bc3da47afd952ff735360917ef804dc85fc106a6643c4758f49b63fce3f25f
-
Filesize
91KB
MD557601c1b823f3226414f8bf3286c8343
SHA1bd95d498c673085af561f62689471864458f53fd
SHA25602e94d5c890416349344e3406dc12b9b7d8d41007bf5bd06f38ba8da8c077509
SHA51293653ce8f3acc214f1cdbe4f1fae3de8ff4df640cf81f0c89561fcf1ae827dc7edcab5dd9487e504dd7f7b32a4b2d2dcd0f427fefaf263dd29e07c36911e99f7
-
Filesize
91KB
MD555301eb548e63bec7976ae797b12e6f0
SHA1c198aea6d8172a2ae8ab82d05db7bf5fc98be556
SHA256aa6542b54f9f1957e6b1459257b2566817626b566c1eab579899d6511926723c
SHA5120fccbf2887e24d7c0ba935ec652f070949be4d22cd1c3a068055224ce0a9ce9f8d7bf968f2829e8f0fd337e7b45f5c7b899ee98f5f35ff19ff9f0b7fe2bbc694
-
Filesize
91KB
MD5fe7b363ba0657465f83226f701a3a2ba
SHA1dcbcd72ec09932936da61691fef6893de693babd
SHA256604458aa49a3be4993a17b1c5add20941671f7e6c82953f37651f6e5ebcd50bf
SHA5129a7099f2f7a17a972d4c59df256e19558bb6ef0a64a88cdde2a51f6c2781b3f9898be87eace75c56f7d6198eb66067743d497df02b8bd0798dc4cb261a733fc5
-
Filesize
91KB
MD53973eed6031d7b272f66df1c901ae40f
SHA1fb6c8c4d7fa432ffb3a8bab1c59fa764f8e3f1f6
SHA256f35c78f0d9dc12757923d9edabf223bebe07d51958bcf52faa4344538bd39db7
SHA51231ba4da9d188dd8f06079dcb3929434abcf8def92e9e80af38ccc49b8c6e4be07e892a34b4a5102a52f0d41fe873df8c9accc75f6e71cb39e0a25548cb1361a0
-
Filesize
91KB
MD569360307082a6128d3ca2e8445011660
SHA19993f32032362a0389ab81247025e247bfd9ddd3
SHA25673daf220fe07b78a76db18710915ccfa5fa05df4373090d892c3b68c1544e3b0
SHA51267ce4d4c3e69923549994b167da1e24515a3a50b84c6a5fab270800c30e19b26bac968c09d85cf6e9d0a9d9054009acef0f9705a83179475e10fa46209e42983