Analysis
-
max time kernel
51s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 02:27
Static task
static1
Behavioral task
behavioral1
Sample
241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe
-
Size
320KB
-
MD5
241948d342c6c3377e3700afc52e6be0
-
SHA1
1694f02f7e6d7b9b8eca6a78a9fd914932797205
-
SHA256
756715ad6f5ec1101dfd9cb4f2181f1c96c58f6fce67364caeae7454effd895b
-
SHA512
4259e532dadf6ec97d939e63c482db57027810b832bb5ca511eb9261d147ed11d7c1f71de07575093d8694e601be7b785264b6c024f1d95403b8ff44df491f50
-
SSDEEP
6144:/OlgV6JUSULAYCtE07kli0KoCYtw2B0Ddu9szWfx09UBIUbPLwH/lLOUaR/N1I0Y:/97sYJ07kE0KoFtw2gu9RxrBIUbPLwHT
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnolfdcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nnolfdcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nqmhbpba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ncldnkae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ncihikcg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ncldnkae.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" 241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nnmopdep.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nqklmpdd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ncihikcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nkqpjidj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nqmhbpba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nnmopdep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nqklmpdd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nkqpjidj.exe -
Executes dropped EXE 8 IoCs
pid Process 768 Nnmopdep.exe 436 Nqklmpdd.exe 220 Ncihikcg.exe 4372 Nkqpjidj.exe 1844 Nnolfdcn.exe 4496 Nqmhbpba.exe 1416 Ncldnkae.exe 812 Nkcmohbg.exe -
Drops file in System32 directory 24 IoCs
description ioc Process File created C:\Windows\SysWOW64\Nqklmpdd.exe Nnmopdep.exe File created C:\Windows\SysWOW64\Pkckjila.dll Nqklmpdd.exe File opened for modification C:\Windows\SysWOW64\Nkqpjidj.exe Ncihikcg.exe File opened for modification C:\Windows\SysWOW64\Nnolfdcn.exe Nkqpjidj.exe File opened for modification C:\Windows\SysWOW64\Ncldnkae.exe Nqmhbpba.exe File opened for modification C:\Windows\SysWOW64\Nqmhbpba.exe Nnolfdcn.exe File created C:\Windows\SysWOW64\Nnmopdep.exe 241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Ljfemn32.dll Nnmopdep.exe File created C:\Windows\SysWOW64\Ncihikcg.exe Nqklmpdd.exe File opened for modification C:\Windows\SysWOW64\Ncihikcg.exe Nqklmpdd.exe File created C:\Windows\SysWOW64\Nnolfdcn.exe Nkqpjidj.exe File created C:\Windows\SysWOW64\Cknpkhch.dll Nkqpjidj.exe File created C:\Windows\SysWOW64\Ogpnaafp.dll Ncihikcg.exe File created C:\Windows\SysWOW64\Ncldnkae.exe Nqmhbpba.exe File created C:\Windows\SysWOW64\Dlddhggk.dll Nqmhbpba.exe File created C:\Windows\SysWOW64\Hnibdpde.dll Ncldnkae.exe File created C:\Windows\SysWOW64\Nkcmohbg.exe Ncldnkae.exe File opened for modification C:\Windows\SysWOW64\Nkcmohbg.exe Ncldnkae.exe File opened for modification C:\Windows\SysWOW64\Nnmopdep.exe 241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Cgfgaq32.dll 241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Nqklmpdd.exe Nnmopdep.exe File created C:\Windows\SysWOW64\Nkqpjidj.exe Ncihikcg.exe File created C:\Windows\SysWOW64\Nqmhbpba.exe Nnolfdcn.exe File created C:\Windows\SysWOW64\Bghhihab.dll Nnolfdcn.exe -
Program crash 1 IoCs
pid pid_target Process 2848 812 WerFault.exe -
Modifies registry class 27 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljfemn32.dll" Nnmopdep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogpnaafp.dll" Ncihikcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll" Nkqpjidj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll" Ncldnkae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ncldnkae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlddhggk.dll" Nqmhbpba.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ncihikcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nkqpjidj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nnmopdep.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" 241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nnmopdep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nnolfdcn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nqklmpdd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nnolfdcn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nqklmpdd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ncihikcg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nkqpjidj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nqmhbpba.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ncldnkae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} 241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgfgaq32.dll" 241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkckjila.dll" Nqklmpdd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bghhihab.dll" Nnolfdcn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nqmhbpba.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3440 wrote to memory of 768 3440 241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe 82 PID 3440 wrote to memory of 768 3440 241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe 82 PID 3440 wrote to memory of 768 3440 241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe 82 PID 768 wrote to memory of 436 768 Nnmopdep.exe 83 PID 768 wrote to memory of 436 768 Nnmopdep.exe 83 PID 768 wrote to memory of 436 768 Nnmopdep.exe 83 PID 436 wrote to memory of 220 436 Nqklmpdd.exe 84 PID 436 wrote to memory of 220 436 Nqklmpdd.exe 84 PID 436 wrote to memory of 220 436 Nqklmpdd.exe 84 PID 220 wrote to memory of 4372 220 Ncihikcg.exe 85 PID 220 wrote to memory of 4372 220 Ncihikcg.exe 85 PID 220 wrote to memory of 4372 220 Ncihikcg.exe 85 PID 4372 wrote to memory of 1844 4372 Nkqpjidj.exe 86 PID 4372 wrote to memory of 1844 4372 Nkqpjidj.exe 86 PID 4372 wrote to memory of 1844 4372 Nkqpjidj.exe 86 PID 1844 wrote to memory of 4496 1844 Nnolfdcn.exe 87 PID 1844 wrote to memory of 4496 1844 Nnolfdcn.exe 87 PID 1844 wrote to memory of 4496 1844 Nnolfdcn.exe 87 PID 4496 wrote to memory of 1416 4496 Nqmhbpba.exe 88 PID 4496 wrote to memory of 1416 4496 Nqmhbpba.exe 88 PID 4496 wrote to memory of 1416 4496 Nqmhbpba.exe 88 PID 1416 wrote to memory of 812 1416 Ncldnkae.exe 90 PID 1416 wrote to memory of 812 1416 Ncldnkae.exe 90 PID 1416 wrote to memory of 812 1416 Ncldnkae.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\241948d342c6c3377e3700afc52e6be0_NeikiAnalytics.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\Nnmopdep.exeC:\Windows\system32\Nnmopdep.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\Nqklmpdd.exeC:\Windows\system32\Nqklmpdd.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\Ncihikcg.exeC:\Windows\system32\Ncihikcg.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\Nkqpjidj.exeC:\Windows\system32\Nkqpjidj.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\Nnolfdcn.exeC:\Windows\system32\Nnolfdcn.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\Nqmhbpba.exeC:\Windows\system32\Nqmhbpba.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\Ncldnkae.exeC:\Windows\system32\Ncldnkae.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\Nkcmohbg.exeC:\Windows\system32\Nkcmohbg.exe9⤵
- Executes dropped EXE
PID:812 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 43610⤵
- Program crash
PID:2848
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 812 -ip 8121⤵PID:4504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5449cdc6f5dd3f341c8b3270f83efd863
SHA18770f938437d676ff659c0976307426be540a03b
SHA2569f7a8d536dff39943ea85c92c5b556e6ad9e956166e4270081fd8984c31f447c
SHA512ca8dfeabc1079393e387c5dfd26988ff7db07bd85aed4e2309b143f5c8abf6201874524d4df5ed5dbdb7f497a913b1f8d39e204bdb0a4cfce7e4585f3f9838b2
-
Filesize
320KB
MD52d1886e20eaa2e11d13852e05a66e22f
SHA18911c43f66173c20efdd385420ac1d37850b9b34
SHA2563dd0901f2bc1e5aaa8f9b75302207e6b0127d0965974dba691e3310b5ce0f2d6
SHA512ab66f9d215613b7697af22e1a03edef2eedc9d8f971f697a9378f825cc873ef391dc798d4e127f8f19a88f0e66f0b9f27f5277809c5f96f5a78d09f4d660ae00
-
Filesize
320KB
MD5cedcbe60f6754df7b7f956c4f45980fb
SHA193b017caac01b82de59288d1d0a16e1e9e85d7f8
SHA256dbe1a863ca73d51188f666e8904d0367994fa26117c2643a646996f4cea35b48
SHA512d5f1eab8360bd77fad60cf934c6efeb2b6a4e6fe1394b05ae244c02d601be4971ebd5a1df57c607ae4186c9a4628ca856a3fea3860bf1b9b6f5bfb65b5445093
-
Filesize
320KB
MD58050af21579f608f5787a002445b9cf1
SHA1807db3c2a0446790658a0e847444630eee0a3dc8
SHA25671a1cc90bc95ebd7a8273d38039e1af86969748f55fe1b44207acad9cf4f402b
SHA5126f5289d37ff4a144c71e0884e44a3777f21b589d6f1d8ba0b210fd6e04b2d972111e2ce305c5c9885bab13017f4c875fd0100e95a18925fbdb75c81f0cf1d54c
-
Filesize
320KB
MD53b824020b1cbd346c1813c4267b7632e
SHA107f4e38036baf8eb82146a04ab86a9e51b068ce9
SHA256f4b0ad1930b81c369d981704bdbbc26e904c4f88e44a790bf40f0bf8d9263d51
SHA512f2aacc46b276a832dfe847b178f8907aafda2576790472c0b3854155a441b7d32486c5d9d95b6734ce7e995a890af63e1735551a3f23af40b7616ed9a5e50477
-
Filesize
320KB
MD522291b7bcbc76c34a8d6efa7a8bfc1ab
SHA17c2fd57d45ef44bdc3273aca1501c390d8638fe8
SHA256e9d3fb2210cccfed8b7ef52504f23e5749a9d778a107ece8a62a6b930885ffac
SHA5122e9f42d9056894aa27d883f463dee9f44a37c59eb6979e330eba56bc7f239a5cc00d5354597a379338c3d4dac7cd0ca7711be400bb2df00f2ca87b83f351dc85
-
Filesize
320KB
MD58556f9ac860c6e27b10d799c024bbea0
SHA1aae9f020b9d93959ffb5ffea01c3923373bf9229
SHA25675b32450748c6d40bea91d1f632aa15bca9229bb9359e2f7a8c1e392deafe410
SHA5126726652db6c7ba2a750a62ca633b884dd5c06ae73aa120a5d929be86b7d2ecb31fa439e8e9829c64b5221c6f4837f30a38b01b20b612e6103b008692669ec4cf
-
Filesize
320KB
MD5567dbc9ef1dfa623aa3d43f8380e34b2
SHA12b73f2b5c96d4275b5ccd354bfa346d7f6af9dbf
SHA256cabaa39dc30a9fc82f2428e549a40c0823866f5d244d1ce98e232dd5101e2ee1
SHA512dbaa30a4bdb7e6279858791e4c6f7edfe83611015990c28f4974e876d7e2b52f505df31049fa45dc4a72d02d586dc23596a49238e7e746fe99ebe84b852eb9df
-
Filesize
320KB
MD5bc1003195b13ebd937dffc5c20313eee
SHA1a1bad83cd23285ef9c6e63bfd969e3fcb0e7c715
SHA2562d5df4a300a150cf0a1cd669ff9f32d745347fc0b4d3ba38ffcc420363810d3b
SHA5123f71531bfe8d285d3bd249360103ec4790c168a2875a1b35a26e384aaf03af770c57854f0115aed80e8d933515c9a9d823dce22717db7fb7ebdad63cba6685fd
-
Filesize
320KB
MD52307f8095962c2a96ee0aaed405b6a80
SHA1be385966a65af11548cec162e6e18d89c8f8def0
SHA25692b25f7760f5ca09c6d5ead48e4ef0794a604115822686ef9fa869a9ca911308
SHA5120611f44f90f1a4b559fc0cbf74b632371e1e8818ea9f3805daceced8e5e121f67e0d1296acde9345b7ebf06e27696503b7495bb6d84456ccf58dc174399cc12d