Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 11:07
Static task
static1
Behavioral task
behavioral1
Sample
7836938e2743dc46910575df9475b500_NEIKI.exe
Resource
win7-20240419-en
General
-
Target
7836938e2743dc46910575df9475b500_NEIKI.exe
-
Size
1.3MB
-
MD5
7836938e2743dc46910575df9475b500
-
SHA1
2c0a4dfe51bf66008a55b01987531b193ec04d1d
-
SHA256
45c8a4feb69d013069af198af3d81995d7e23d6c99709bd16a328dcb2bf6412d
-
SHA512
06ad416a48a71044f1ec17279dcfa91b5bc3caa478c7579a3c610617b7d3707146686d9d16fe13f61eef39b9f21044785f0f2fcb8b00f4e35ece71717e4a92cf
-
SSDEEP
24576:dk1ll11tmlNQ2OnBdFQtP51llPup33kT:dk1v11tmlNQ2ayVup3
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 4184 alg.exe 224 DiagnosticsHub.StandardCollector.Service.exe 4864 fxssvc.exe 4048 elevation_service.exe 888 elevation_service.exe 4496 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\b14adc2d234f82a5.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 7836938e2743dc46910575df9475b500_NEIKI.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 7836938e2743dc46910575df9475b500_NEIKI.exe File opened for modification C:\Windows\system32\fxssvc.exe 7836938e2743dc46910575df9475b500_NEIKI.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 7836938e2743dc46910575df9475b500_NEIKI.exe File opened for modification C:\Windows\system32\AppVClient.exe 7836938e2743dc46910575df9475b500_NEIKI.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99062\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 7836938e2743dc46910575df9475b500_NEIKI.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 224 DiagnosticsHub.StandardCollector.Service.exe 224 DiagnosticsHub.StandardCollector.Service.exe 224 DiagnosticsHub.StandardCollector.Service.exe 224 DiagnosticsHub.StandardCollector.Service.exe 224 DiagnosticsHub.StandardCollector.Service.exe 224 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 448 7836938e2743dc46910575df9475b500_NEIKI.exe Token: SeAuditPrivilege 4864 fxssvc.exe Token: SeDebugPrivilege 4184 alg.exe Token: SeDebugPrivilege 4184 alg.exe Token: SeDebugPrivilege 4184 alg.exe Token: SeDebugPrivilege 224 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7836938e2743dc46910575df9475b500_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\7836938e2743dc46910575df9475b500_NEIKI.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:448
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4184
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:224
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2520
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4048
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:888
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5a8d03cfd2cd9486f69a8a3c37efc0776
SHA16735c5b405ac2f87578f5f358359f78c1f6d524d
SHA2569688612dd70d14319f55dc1512a9e2522c3f118e51aac5c2de4bb911524bc31e
SHA5122e46e8c72da4c352494a6a011a6406a844be352f1b2064a8db093f1518e7e992e6a00d60f0305b1b2bf66eeb206326933f492bda51985ca9b20679b47205bf07
-
Filesize
1.4MB
MD57ff2c6263d1092b7805d698679935868
SHA1fa1677bc86dd744a880f5396494ab99e2164558b
SHA2564250ba5d83869c77ecbe9748c35e091995ce6782ff9d747cad4d5549e0c061f5
SHA5129d96682e4d2a0f9636a5018e355f83686e657956b632501a60d091b9752654ba088748b183ee2de137407960bbc838d9c01cc14f8747a75f36c0f0cb6d8a74d0
-
Filesize
1.7MB
MD5f1e3546e74c51c7e6bfe9cf2dc122495
SHA1de157db7cebe420018e1550469d048a831eef6a1
SHA2564cdebf2188e5a0160e98d74a906299586ec810052b6f144a458c4b0bb9c8d37a
SHA512109552a5b138abc45ef9f2a9fb2ee3440693fa0671f441965165ba9040fb45784caf12e9b81f72648f2f2c5771bd2d27649e406bd1e3ae750fb26d6bcc3c3c27
-
Filesize
1.5MB
MD51fee48c899128413a23b7a0c39688e88
SHA15c8293222334c419c9a959bf20a727e7cb696d75
SHA25640e354c3225cc03d343522046d1827b305bedde81fb76b61278d8b81b0f3792f
SHA51246fe1f7851aedd6241e4df5f2b2e45afa8f89be41783cb23d8c16736b3cbdcf634140172b4626ea0b65bd526812f42b768e08b5001f611def2710fe731aba739
-
Filesize
1.2MB
MD582d176cf28da9e709f6cc62c7862983a
SHA1c8fe054f075f39e2dcbd112dd1afdd90f2dd3e65
SHA2564388c2049422e495cfd8577aec450e8b8e0732733c6e393b558597bac9cd5baf
SHA512bf965544aa1e3795e3ed70be5a022e826ca8d63b9226a4f28d1cc49baaa2bfead551bfb433643851336c7dfcea02506e5421d9f9d5c1a288c26961b721c6d922
-
Filesize
1.2MB
MD5a7da95e3494752897303aa038eb4a0b4
SHA191c16f5a548218df997adb7ce6b6406b150c6a31
SHA25668b6d329c34c7b07198b35e783e02f199bc71a2b88cc021091e279254f47deef
SHA512990de07f9a73831e8209862732d6eebfa4bd6efc53e0f5c9162065b0194ee5f2db882b7af0a32aec2a223cdd1a17c95753ffcdcc43cc362f6157296429bc2d24
-
Filesize
1.4MB
MD5efece28b88698abe58720ed8b0d8eeaf
SHA1ec26282a6fcb6e32fc68f580d0624fb2283e91cf
SHA256afbcd987c5e3a4216834cd9d590d1947914f1105de76afd6eea3c53a9c9a3164
SHA51240b069ba5d3babd683456ded6bd7c61b2ee82ea53940d3ab4fe81e63478c8410ab4b9d38056abd48d080929bf2a14eaf0552a61e3bcb4462077b806f56db52e8
-
Filesize
4.6MB
MD5b013937b18ede3aa9a272fb9f7b775cf
SHA16314cce55fb7439ab82c0b02b28353afa5a806b9
SHA2565cb120de148065112f62ee98c1b63717881c41c1d6eb574632121d6ff72fc858
SHA512bdf28efa98b1cabbb5d9b03ae8d60bbc195b5a54fc9fa2c5072da1515c246ccdac784a33e4703e3d7ef4f46b7e5e53c89cf78bd823a666ee67cfcb7a0ba3a2a7
-
Filesize
1.5MB
MD59e7ea1886a2f6a4b5f9991364f153583
SHA17e9460d47a2bd8fef410b4e3dd58abafeaf7896a
SHA25611b13ce6ad5c4802d67a1d0f639a3a2ad3917ebc95172225a171e1eb5aa5d8ed
SHA5125651572a26c3956f1878e8bde4db9e94527b851496cf63438e0dab2956db92e86f37ca7face84054b56e330e9f480406667a7fbd7462f8d915b03a0cbc441b74
-
Filesize
24.0MB
MD5932c9ad1d56405a5ffb3f959f4cfc285
SHA1a30c4ba168c7559452d5d931d2764e87c63ef8e0
SHA2562ba58e3235592706c779a36bad9bf691734a9592ccc132b3e4147c32746038c8
SHA512344ff5064c1b3473e88c3911c853bab90b67f7a2439ad7a8d8d67044ad05c325b1c1305d3f2b835dddb54de1b135885cdae0e327171a106155bc259bb2a75054
-
Filesize
2.7MB
MD5a58144cab6bc89f135cf920b43a7be9d
SHA1b2df417aadcaeeeac6e9edc2dd67ceb5c3fda35d
SHA256639898e806fdd332f2989402afa90090dbcffafd603747f73dbfe13fd6c606c1
SHA512945a2f76d628eab2bde95bf8e14b5960981d1561d362dba433ef8356db1d0b3c01afff56d2082f1d4ab9646933a57bea579d1fcca0412b6d7f436a5660e2c090
-
Filesize
1.1MB
MD59b83932b28768f8d5c53ce880d5fa89a
SHA1e4a406433b939d080283499c9273d54fc95f6f26
SHA2568e221f3ec8f0df777f2886cf33b14ba8ae4065fef0b6211400300980c5e8411e
SHA51236aafbfc4392a892fab33f277b66042e0397d625d361eba489e3de361646cd075b1b8902b908af4b840da992930ad4bc8a0d681227e0d14b93070fbbac8b692f
-
Filesize
1.4MB
MD52c9f1c082d2e155805fe3dd108188b7f
SHA1b92e09d69375feeb4d6f71835abb2f68d4ff0acb
SHA2567d442827dcbc97a6dada0a02d6808fd0125aa61c939b4d8545bca0a013b89772
SHA5124e2a7612ba7a1bca222adc3877b401de7b112c2fb71ff7a578c487fbfe880f1b435344deb04e8053c704885225888dfc2c3e46b9010b9d1524c5eda7ad4e9f1f
-
Filesize
1.3MB
MD5feda3da42950691d63f3cd8984fbb139
SHA11874f6543e0917174b75d3de080e76f063905abc
SHA256e58ea7e19f52fdb6a4b13bdbc2bf8d964402ef7e98b1fc323a0fba2149529c2c
SHA512beb715e901bb72dc1b04955bd635413fbf5b155266a485a727b332af82aae1df9286a40ff887df9690271d79f3e53f42034cd36f4f9bb6c23133e22e85d027d0
-
Filesize
4.6MB
MD5fc1b482ce270d89575c8a78e81dce7c1
SHA1b934a20e3efa4b4d78d3b6cae52c4d098bd87a82
SHA2563fb085196908c69308695594a5aca4b7668c14ed26788e981959d22e8dcc46b3
SHA51275b1eef9e605b09447f3e10beeb9be42e382f46970e9f5d422bf3912baf837d53f9d7ccbb76c43e186cfc31f95e7713837ab9e760cffaaa0fafe9eb4367a4836
-
Filesize
4.6MB
MD568b82858a3be1cfacb7677a8045e0534
SHA1b1c1a26d6ab6d8b4c9632c00f21becc333b5496c
SHA25635fdac99de153908cd586fe3a2ad6cd8d381286b93260c6e816cef7225e0a4b8
SHA512505e261a78cc9d4981069e4f5638c36418ceaec143c1f80f29055868614e1939b5cd8442a251039cf56d36bfc2977631fcb8974838386b4e8916db26f584a765
-
Filesize
1.9MB
MD5d4b73751bb2ab2cb708c1576fd9063e4
SHA1c7fa11c3ae2c4cc1a9a970bca5fb03e992a0742d
SHA25681b869369845e27e880c4c71a4124112d01b45ca4106bdc382b931f931fcdab7
SHA5128a05a1127f94ecbaf1703468059e51965f2bbfc8317c1915599580249a940a212f13f1c0bdfbf7c2c2ed878d3eba9baa2277bfcfaf8eb14441c653e6420d3399
-
Filesize
2.1MB
MD5e58e8f5fb264597c15b2cc8920af5de3
SHA180dadd73c1e48be42b124e51561fdf787445dc1a
SHA2568d8d2de058c4e1c04f4b3783a250203c9e485c9916ce449360ac478d056915a6
SHA512428669690d0f86d2dc70060cbc94edbdc9c9f34b2f8e507d1c8b052971e1f5c6c03741abea250cfc173c044e665cfd06e75c0561ce240e42db0e012291bf70a7
-
Filesize
1.8MB
MD5ba2e17fd79bc3b003a5a9a688e90c082
SHA179503b7b617c8b0421923d30891a223738d65158
SHA256e447bf88ad39a3d0526da2778b765c122b327cbeb375a51335b275412cc52bd4
SHA5122c508e65d4db9e849991ce0d8bdbecb1523f4c5c2c19a6f92c018022a407908701ccdb7754d61b4b3eff8c71cdcc43cff82c3fc9e22bee0eea50b254777a44cb
-
Filesize
1.6MB
MD5994a176c07973d0e2c10bde4a7ebd7cd
SHA19abfd0c07539b741eccf629c287fb86239e925cb
SHA25606bc8aa7aa7456443fefa5103d69621089b9c094e51757dff6aafceb508a6337
SHA512f79e8104639364d453b1789ef2638c5cc94718d098c31b6771b4d656d21f13a431aa5370e4702da9229cc471c731aefeac44553af99e8c60e07539d5db6a7d5f
-
Filesize
1.2MB
MD548dfaa205c6712c8defe0e31f6d0bb3d
SHA1ed514f0aa1fb8ba4c1dd944cb6795eed038d43b4
SHA2568616e232c35cb7ee1855a273ac4744cbda4700669f9622d55cbca3f5fe8a91de
SHA51234ece02cfb448a74b07f4941180aef68d369f01213591bc7dedae80a8f1bf02db0b6fe112e9e03cfed8ccd86da7e7f967ec7fbcb3223aee811475f0c73fd5cc5
-
Filesize
1.2MB
MD5a9e128184f61f81f290c1af787edc820
SHA16b1cdb10c855c3eded17937d9f86fd2a1ea6fc24
SHA25603d72dcd948c4afffdb524dd1d26a0deb3aad9a6e3443491b1656e5b196bf8ef
SHA512a8b75c477db79a1195a2a8d565737113c04b5680d5145d8000079da50f025f68f73718e2640ce59fa66f79bb72f2d7ddc1718a1863ea5084b94aba1969e1021d
-
Filesize
1.2MB
MD539c1c7ff684ae1c0aa868ae9bbc6a3bb
SHA1c56538e567f72e8e58d14adf119b13e13f2a0286
SHA2569d366d175112c3eab2060ac714bc8a4ef58b272691372dc5957edf59996cd283
SHA512a90b8c5c921fb45c66fd488e78d87bb47aa21087f4299187a7ee8fb53434594deb05ca75db1b3ac7a034b188adc92b06ebbb4c09a99f1f9e989eca2967f686f3
-
Filesize
1.2MB
MD5bfe411d4fc6d3e3d9c1048bd0e240639
SHA1e55e157e1c884aeb6f6e66de2fdd3bf0bc58c42b
SHA25679cbbf112a5592ad086cc6239534e61fe5b2a21f6c4abd269d940f3a01ecd38e
SHA512890b236b066523edc273dd0a36805ecc87a8f968d5f8ed65957dd4f429eeff85248243a850694015aaf0a6fa24488ecf1b5d431e1ed227ca1aabd9a5aed0bc52
-
Filesize
1.2MB
MD52a8bda04090c4df0b1e57bff38cc6bdd
SHA1bb0bf626255f5acbe0d2aa6ac5910a1bdda17d54
SHA256ba531c05eef369fed73acdd9ac725fdf9219866221685b72c4c4219abde47e32
SHA5129381793d487e55333c4a9ea97ec09e8006fe175e6a367785c0c3dff0509f5daeff0faa5b79a63153f82b86c7d9097ca71243cd7ce4260324c20e8cd6a83fd2d5
-
Filesize
1.2MB
MD5549e9024ad57b680c09ba326e578f9d0
SHA139db3e10c5723f563069871f3b3abed84277dc78
SHA2568af96e978c3f145c874471674b1a7bf8c7e7a66de2c1f273aaa0a43b393ed51f
SHA5123489ab20049dbe3d42dba580d4d70a1eef0e0cd74248f4f4cc9900d036f053a20b52a2535b9333fa14360a55d236fa663e3d7a9ded7505ad8e264b520dcc20e6
-
Filesize
1.2MB
MD5b863427c3eb33b382c0c3e8c5c1ccc5e
SHA12d8b140c041c274e9e7c4cd49565456ba15a597a
SHA25671d9a96e1d9b632ffdb2472c2b2cad0309371bfc88e274887ebcbbb6d1344d4d
SHA512259d921f4a0a7e856bba4d86f56cff6297862528f61121995e3aaf432af5ea5f6e67b2a48ece8d1c5e7c139cb076179f616382e542e214d8507e2bf9aeda0d5b
-
Filesize
1.4MB
MD5e33b7b7e24ba19392578011182a63d34
SHA1575f1a482ce0a80e238030db1debc14b2c0a4476
SHA2565c41f9bf89a0d93f6c46d319d2b7d297630d631dda6fa31c2ce19f07472f400c
SHA512fa928b2322265f553889dbbf7ab743498fa053be0dadbdbdba5874b05db3be4870b2094d3665b570446403c672965f5dc2a77b5c13609646695f45c7467d3ae4
-
Filesize
1.2MB
MD51abf435d3a3f2426c08fcc82d9c12171
SHA1e3371cf30b8f0390370c2cbc930f9f0297e8a11e
SHA2561ae648fefcf55cbb67bb5e6bc2c3f43a0ef36ed6edc5841e6873c85e4c5770dc
SHA5122964d4dc8a4b52c3d76ebbedc9f92e0ec4206cb51148778db8a0c44baa16e444bc7c67a491780a0f80f2604f4422a391fd8b1121d6792781c660691c9e0b1971
-
Filesize
1.2MB
MD5e7394839c7ac4d649be8e684770697f5
SHA1b42be7d9b95a925fa847d619e65358f11e49305e
SHA2560f318f2de549593561e904f620f101a2bfd855083326a204915698488f48637d
SHA5125f70495f6a3165c60997d52645a224c014beaaa8d096e8bf6e43d7d0da7634988079fc4f0401804eeba298bd562c4aca1324069d7a359a2c9f8b151c8d96772e
-
Filesize
1.3MB
MD50560d84cc98c423d8e11d92a49035c2d
SHA1a11e7b75e5a5875391148415eaacf06ff74e06a1
SHA2569ff6e10683326f37385b4e40d9918a2a9c7abf669c4194fb988d37bb1307e304
SHA512f74c1fb03c91281e66a374e4fa38d67e2e453ba7854b669c8db24d1a5751cd089efc9d57971a24e2791c3f6d7bcffe3b2116c6cbe26a826eb12ca4b1b50d886f
-
Filesize
1.2MB
MD527db99f0a85888d7a4a13a7cac95feff
SHA125edd20464dd3c4f419b9fbd38009b4c1965ded8
SHA25664017585e922ef8d4c94ee3524eb90f2b61e0989e75644947ad47898dfeed228
SHA51280e4bd464341b5e76ecab5b42a080a863355c8cf866ae71f735025867bab0e779ad893e587507e7dee1e5edc1bde24477b217c63cafb5fa39ca57793fc7ced46
-
Filesize
1.2MB
MD5129e4f375493917666856bad780f4693
SHA18db0bf6285dc2cf64f1f45b82a727396ce9c4ce3
SHA25649f62c2b268504f4257f69bc92578de17d7cf8a7ec0549e02ca3a75e9775a67b
SHA512fdeb66c8de5bf1d56918690fa677a657eb42931f778c00ee0cdfefb5df1d122f8336e5397d0a707bd50b879f714bf16d3fa49ca8e7a5a062d3ab8552421c5b17
-
Filesize
1.3MB
MD5f1ff37e59fdeea19f25c0b5cf89e1ae3
SHA1fe1a2d5f953d228a97eda15d9f8133d2a374bd5b
SHA256ef3c205d44ab28bcfca46532fa2d3de8155c69efde74fa50575b4336dc2b913c
SHA512ec637ec19c2add525d368d22f5f1854f87a665bb695652079308ac49f193039c5e623ab0eb877d823bafbdfd4dcf5895f450900784b4332cad6a3a164471d926
-
Filesize
1.4MB
MD51b795da17c54afc04dbf6d5487cd7b77
SHA102d748a3901c9cae60bef54f5107bee1049436a1
SHA256bbd48d5a465459e50d8710409bdebc073bc7cd9035f25c93e44b23153130bc2c
SHA512144e46a245c6b77d8928f94140e057b064e100ad0e0d6f453ec4cd0b4f39bee2c3ce8ad6e04b6084d7054dc2ba37e4f237c8959298d6d2ec8a6fb1b918f4e4ac
-
Filesize
1.6MB
MD5b93e53c8fae203553f3d146ff2444751
SHA12b9a18e536f459e6166b9dcc3e14c51026acaa2d
SHA256f19f019cf1a728919c01d2bd2bc2d512a7a7c155b7a67ae529bb7cf043b48cc5
SHA512fbbeb67bd3267369a15c23f133e8bf9d62614434ebc4b9cf5d6196bbdd75b478a5d718e7a711035aa80070175c8e4440edf3b5bd63915190f98a73a039722f7e
-
Filesize
1.2MB
MD54e910524409a92c8fa0796febf080489
SHA11fae046a2bb8a69b24b4f299e9982b879498dc45
SHA2563dccb1f637ef3ef486022577f8ebdd8ac6e577d4a69fffacc3f92439fbbd29cb
SHA5121568d22b2ebc50f3c5da4525a1ac5ae52ae136a4debb5a53e8d8a5569be7d6784cd3b874e32b3d6f1fba5bf1cf37431f2927dc4aed57890b43735faa979b604b
-
Filesize
1.2MB
MD59650e8755924db197d0d64b087b67497
SHA1b5f35d322d39185448731b8f1e7b5bfe2bf75cca
SHA2568dfa358baaf80f5aea76867a3dad18a45bb8e7389f6dc31970a3b2759dd76be1
SHA5124577262e1ba3950e346b1350c4119ff79a9c5aa7dc2c5ff9216106ed302d1d46a1bd3b76527899012e38d88492d4523e0c290e18a56a530fe1644bc59616e69e
-
Filesize
1.2MB
MD5954c7385203d88739a51906aae589754
SHA1b3cd4eea8ecb2a1798e7677bfbc957eb638548e8
SHA256b66bcfb5035784da8cb8ce98ab7ca2cc293ed64dd3990f2834e7c1ec3ada980b
SHA5120b96242b48920979d2ab56bf344a2d100898f379859e90ad00512a76dd9454c5c204ded446cac46f69106474ef1f47c579502a88c9f28830363f316ffe4327e8
-
Filesize
1.2MB
MD572f8ca03a1788ae31ec2347fe1c3841d
SHA1ed9acce6527268d7b973a2712656dff8e67e8423
SHA2565e2efea591525925e51ebf18b07eaea646c33543cb9c5a11821e9bbe049fac21
SHA512311bcc8f93f40732fd44bb2c48acca7c74d169656da81ff6b95ac32180113e480fd2710b07055ffdab94d868096f0d7aff43cebe375b4d1f2318006bc95cb570
-
Filesize
1.2MB
MD52ba23cccb8ea2d500e82666818d4ade7
SHA106cb8c3ad423b35c88f38b3e581e2cbdb83b56ac
SHA2569ba977797b974ebe79d293b7501dfc1ddc68a3548c9c47d7f18b27588aab4ab8
SHA512447b4ada8de84ee65e11ca4622bb536fb810b28152cf4310820aaed3f0d8360d5105a52002efe6548aaa9d31ec38fb5c8d8ce37e3505e0c1b0fbb9a856efd70e
-
Filesize
1.2MB
MD5dabec00ef148c040c9de83be7e1e592f
SHA1e374b584f584c5e65ff266d31b933857d0a2eb12
SHA256816f638f2b1a76569a1284654268c779a22756f1e1114a5f95ebac13ba7c4ad5
SHA512f9fe752e5fcc568912b2cad7bcad09fa0eec15467447a82fba71790b3a1b57242cee1742b952682bacc9ba1e6f73bc26f20830c60925736b28b8bb6d5f10de6d
-
Filesize
1.2MB
MD5c2845cf0f306295e6ad6888e7daf663b
SHA17ac21a7f9102116e9171b2c0fede01435d0dbd35
SHA256a4367765d97e3fbd03aec9e45d9f72fee9fd06a698a0037cc44ae102cd554c2f
SHA5122ea49e95f6ffa70430b6f5f42c2a2ca6d2688520dec7fe82809660327f94789bab2f8beb5ce75f89cbba5f96ef1df440e1a3caad99c3e08113cc7ab51a1fbc4b
-
Filesize
1.2MB
MD52e90cae019921f674892909489f70c0f
SHA12cdf9e0927b436d4b33bb801c502546b986e5b70
SHA2567cbc3d3d8cca7cbc7280c8619f41b415f9c10915e90ceb34123ce2d253cf7210
SHA512352f2dec09ec10534d61b3d95840685c57008ca03adeff9a1541cbf2ee0c35c1e0d31dd64e9da7b84f15a2515c187f084b010d3821d33a4adcc6c82327c08c7b
-
Filesize
1.2MB
MD536af85ddef250ebc651914abfb12b7e6
SHA107100831b5296ed0be8799e786af02e24f32e80f
SHA256f29140583f0bb1ccdd0fe29dd0c2ca9666fddb379362b6d61ca4ff757714b46e
SHA5126a491eaaaba422776e82f090234b37d23f3c35d65b86b811299f11bc090d9f6c7f2132de10f87cd516721590444fa5fe9528910ff14195b3f67e7dc7d9571d33
-
Filesize
1.2MB
MD50aa2299b2f1ed4014e804bc2a029a74a
SHA16d85b7ccb19406fa94bdbe06c1789b2ffa7226f9
SHA256061bdf96637d5edd91244e48ad2b053b350affd93bf4e9da84163a6a128b4bc1
SHA5123edfd2aff66ff70dc0a2bc462c3bca01ce3df13c2a54f2e1521c1d982a52279752c01771655dd6c980f98ecf6a9a628ceb6ab56938857ab2962150632820029e
-
Filesize
1.2MB
MD5023da8c045346e542b0de4f1dd8eb9bd
SHA1cb3ae15a72c34440ad031bc6386bdd0a772bdc1d
SHA2567dd6746473ed9ae0cb66ace8ee7c9b547b2ac6845553811d10a61bca54292562
SHA512232e7138f51813e9606065af9ef472cca3589a77b3aa2ea8b43196f41033dc5b6794c9d40f4181af21c1607c69ab049c5609eccc81cf7c4ac6d74bbdb713cba3
-
Filesize
1.2MB
MD52c28bdf72e600a5d60024e7470df68c6
SHA1d35c8a4b83d62f43b0c2ef284988ae3347e9ba2b
SHA2564c108247907b4a22182757a56b676e3d743b6fba6edb0f93160974261223618a
SHA512e89ff57e1b697364aaed106358ea3f507f2a7fea58b8b88efc830c70502c7bc526015546e98088b8d548a76334e2408b99c3ae961afba0014f9172854832485d
-
Filesize
1.2MB
MD5cc4fbcb00e7d48dfced85a2a9484c54d
SHA163cf019d98cefecc4829fc452bde11824e3b0922
SHA256a851e7715e303daf57727a085036575493da9824bf8f1f2ae2d683e6214f6bbc
SHA512fecd48d3a9b15a773e2a080596e5472e47f4420e371657e9db1a9dcc337bd60d1368d30ceffb07eaebd1e0eae73f93f6e26be1f2c6f793aa2ef12c5cf08472ef
-
Filesize
1.2MB
MD551e15b42171bfde166f3e40b472a6fba
SHA1c6b6f480b0742946a419db8e5c654783048aa405
SHA25676133d9424914a3a5192e2641a34a30ed71bd0b93b8dbf3cfa1146f196ffcea7
SHA51218737af4130749fcab5c10cb58f346091a57e0dff1a371a2333e04cb264fcfaa50e4c7268adf4861446625b53f8bf592e599ca47b8eff960778084fe92ddafe8
-
Filesize
1.2MB
MD586db767917ef282ef6eae589ef3ad211
SHA19452161792746f4d0510529bb09f73d7228abecf
SHA256d4140eb1658d560314fccec179381c26bbc10e405fc5d5c0f7d9eadd18145015
SHA512d1e302e1e38b58dcf88df2ca36d9c2a76e71c69eb9d75e344fd8ed2e4125ac61ca04a99bb19143812418e605032b7ef6aa55ed2359d3d3403df44dc475958cc0
-
Filesize
1.2MB
MD5c7dd81c32c4209a23ad40246bde311a5
SHA1b5ab682c0820f87afa34f38eca3edb029c8c2a31
SHA256c3962256ef2290f0413e3a4a82e632e02fc080587de30fde336e56a0ce0f302f
SHA512e716eca844c831ffb97d6bd94608ffdc7b05cea67d47efda482bfd84a2344d77684bc387071537d4f5486aa18e0992a7e18642e13e4fe8801ea867159463093b
-
Filesize
1.2MB
MD582d23f8210ecf8969b877006fe73a7ea
SHA1acd54ed6b358bccc3723ee4bf36e1b169bd40b73
SHA25656f271f5101f418b08bfaddbc1750bd06f31503b8c51f7c5b1ef0e9b3603b33b
SHA5121513fc07b081c9b03b2b8d343ae5eee7ad90e5517a69d1d6906f5036b7319a56679fd5b0e1105a7a0c9ae0bdc1b7e4bbcda9bec43647d9be0905a1493f429acd
-
Filesize
1.2MB
MD51d8eca8bb9ec0f68e3ef05eb016bd63f
SHA190399099f2395207084223166fd463529f764fef
SHA256a9291bb40d9598e21ece87c201136122390bef0abc7fdfbe736ec4266cf12f6e
SHA512a4040923b8ea37618be51569881c80a57be3aff549fd048c1a13e4121c7bb6f8683dfa4abe6933aed89b827e521073d2aa4fddbebc98c522fc33f0fc82c86d15
-
Filesize
1.2MB
MD5221b3509d575d4d60b3195d4eb30d86d
SHA17dbd2e22b8b330950356a96819413f9b6b38f966
SHA2569af494924b48cf514d968d3a2c1993f6e58626c3a3e1d68a7e488608c9e29a4e
SHA512c3545561fac8280298f44b30d873ddd3ed6375e78637a51f451beddab3d6464387eb0f6689f5f563801db0421d8c2ec119d7a9efc945aaefbfec0290cf156b00
-
Filesize
1.2MB
MD5c19941a5e466fccdc15fefe141748f29
SHA17a02c9f16e5c7497fcdd6657d9e20af012f1fab8
SHA256c4bedc5f358833914394fbe5d7c2867891b9fd47392036091925e2380e71644f
SHA512dbe8b701bc56f318eaf29939ea867754c0d074bb5402935bbfb1fb054ee01b21f1641df0894baf5e10c2358136982268e2e8f39a39020010b974f1d07e2bb6bf
-
Filesize
1.2MB
MD5d72e1acebd22833f185555a2583c4293
SHA134a9652d65b3ecf964614dc97db73698a1223c6d
SHA2568e6cfe624836a43e9bf92571e0d4b2db6959ddbcb64d17f9e7e86ecb45d9411a
SHA512649d46491059dfea1520918c1838c643f596b4059f7ef4a83359d4afcfbef730197e8b8a8a820db7cfbca01e71dc0adbbbeb136baf7c867697074b66abb1205f
-
Filesize
1.2MB
MD52a92fecafa5ed7c6cb7c903e10ab205e
SHA10c056ea0e53fcc8c104d0706dba24241ada88a5d
SHA256e374a84f3816218eafd534dd0be479359042b7c590d14c1be8c15cd1d5e61df7
SHA51296c56e8668a117b0573347a396d71bcc601daddfd5b288d1b240c61203de3e7586a4a2025d388017f7f09cce77678394d209698cd51fb3cac4b0884ebe9257a1
-
Filesize
1.3MB
MD5e8a59f53966bb99fafa731f25e8fad5c
SHA1f87d80022a13fd2babedc7059a6a4afa804f1fc9
SHA256ff1e11ba99e97f84eff82baac2d197c92d1e05317d28b767f120145655e7025b
SHA512cf613424df1a583a14991c0e85bfd6f96a29bf82d5d569c8540c1e986dfaea46ff7b94323577014587896927a54c53f1e6320a817e60890e43737edd357b71c1
-
Filesize
1.3MB
MD5a90984c06c684a98d20f21cdc763eff9
SHA1fd0f2b98583cdfe2a7d1d14609236729219eccb4
SHA256f94edc358ced1932ee04db802d4ecc2434389e06520c746a8a0e64f895becc3f
SHA5123e4632636ac07f705533c190f8197e786fbc09e17fb6ae99f5e91082e99b7180d9823f500fea61c78a59e9ea6cdd82e886b350467f6b91cc1c3d163abed604b8
-
Filesize
1.3MB
MD517bf4b9fe7a004d1f3817f9a13763bc4
SHA17f87536fafeebdb110e22ff2f29cdc85a2505d2a
SHA256be99bcafb618cda41251a8eaecb58236d0961a373dffde430051f9beadaaded7
SHA5122c101336f322b800e9455d57a94020b32edb505b79015b1fe21d75962ab08b86e75ca147dc56bb9325d433acfeca1d4e5a23896c54fa48752f8c2808fc5b61f0
-
Filesize
1.3MB
MD5f67dd21be7be791acf90507f3deb2d99
SHA17e5e1f14962f0d624e73283553b17a4e53799360
SHA2561cde4ad450e11767694bd0d39046ed58190e7178daf946bb83067427c7b7fb57
SHA51210f11d586ac6da078694402d3fde89b90ee436d7d454eca8e2a3d9c1e41e5348ca8071c8f60fe14a43e7a7fa4dfeb131ae004acc7a3fe76b3d516bcaa6e5426c
-
Filesize
1.2MB
MD5688ebf1bdf3122fbe15ccd97de230ef8
SHA128caf5adaa75dadbf158e4897c68b249d60af58a
SHA256b70228537cbecb26e4a9ffaf45cb55ff1024a63ef43b9fd8be0308185a60e060
SHA512ea494d61090826b57344e06d2ae8f6909cfa69f58cba5ced2b5c4448b4004b13da2e9bcbf4286e944c3ab71b737d002b3fc79f955f8d2da1efbd23f5ac19d160