Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 21:47
Static task
static1
Behavioral task
behavioral1
Sample
0fda41835e5f7ddffbc49947e01c1fa0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
0fda41835e5f7ddffbc49947e01c1fa0_NeikiAnalytics.exe
-
Size
1.4MB
-
MD5
0fda41835e5f7ddffbc49947e01c1fa0
-
SHA1
833f7744bbd0026b644a2d6fee99e82e2a6cd1f3
-
SHA256
0c8415e5485d6db8da4045e3b33b24fccc3ca05d350aa87da80fa5cf61e5b9dc
-
SHA512
e2783cd00de2a54d8d2fc1057277528619580046b68a1c8db6e039d43993cd7434f0eb06ddc1437379b42b27546af4086603a410d9552b17a26b425a9cfac800
-
SSDEEP
24576:CPIaQ7kTm5hsqjnhMgeiCl7G0nehbGZpbD:+IfYTaDmg27RnWGj
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3628 alg.exe 1216 DiagnosticsHub.StandardCollector.Service.exe 1076 fxssvc.exe 4432 elevation_service.exe 3212 elevation_service.exe 2488 maintenanceservice.exe 5076 OSE.EXE -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 4868 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 0fda41835e5f7ddffbc49947e01c1fa0_NeikiAnalytics.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\9453996cc8648821.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 0fda41835e5f7ddffbc49947e01c1fa0_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 0fda41835e5f7ddffbc49947e01c1fa0_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe 0fda41835e5f7ddffbc49947e01c1fa0_NeikiAnalytics.exe File opened for modification C:\Windows\system32\dllhost.exe 0fda41835e5f7ddffbc49947e01c1fa0_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{14DF0EF0-439C-4CF1-9E8A-D1E954BF645B}\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1216 DiagnosticsHub.StandardCollector.Service.exe 1216 DiagnosticsHub.StandardCollector.Service.exe 1216 DiagnosticsHub.StandardCollector.Service.exe 1216 DiagnosticsHub.StandardCollector.Service.exe 1216 DiagnosticsHub.StandardCollector.Service.exe 1216 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2812 0fda41835e5f7ddffbc49947e01c1fa0_NeikiAnalytics.exe Token: SeAuditPrivilege 1076 fxssvc.exe Token: SeDebugPrivilege 3628 alg.exe Token: SeDebugPrivilege 3628 alg.exe Token: SeDebugPrivilege 3628 alg.exe Token: SeDebugPrivilege 1216 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2812 wrote to memory of 4868 2812 0fda41835e5f7ddffbc49947e01c1fa0_NeikiAnalytics.exe 85 PID 2812 wrote to memory of 4868 2812 0fda41835e5f7ddffbc49947e01c1fa0_NeikiAnalytics.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fda41835e5f7ddffbc49947e01c1fa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0fda41835e5f7ddffbc49947e01c1fa0_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:4868
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3628
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4004
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1076
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4432
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3212
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2488
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD52a1ab82e575a549c52e95002012e39ca
SHA1eff30bcd700ad5aa4963e1b17a95195a12f5ceb9
SHA25631708038f68efb5a7aea05e27f21f28c048b3e8df70bef286168bb7d0253e733
SHA512328e4a4c8b3e6d5a9bfcdf7765c95087a622cb22163e5d7095bf3244e4da83dcbaae55a2b79420588b89a7e6a6ca808865c3ff7fae5e0d388fd0006d5d62901c
-
Filesize
1.4MB
MD51c1f73d8559e17ebc5c2ac2d331e1353
SHA1832daebb0c54a4e0127c426bd02f463f3d4c0a81
SHA2566554b660ac6bd37354503bdfe12280cbfd021a083835ef99250f63b4567514fd
SHA5122cf8b6a85fa7e22d30db547dc4da7483127802f69914922317d69328211382558884733878d028f64ed940e84ddff9af9497896523e82fd154986cf2ef0154e1
-
Filesize
1.7MB
MD55f99dd6080403718af15d0c90c0764b2
SHA1bb082f160d87f0d66acb302bf9bfc443c60e919e
SHA2566ce736d2938eaeb78cedff090c5eabcee76a1b3c915224e3240f0748165f7340
SHA512b6fb016f465a88a429d934049fde45e78ed5f5f868238f09a87c7b9821f2ffe2e54af0e4aca60272413ea41a8113e048737dac96ad7d6748bcc8aa6ce8cf88c7
-
Filesize
1.5MB
MD5f9fc419020446b2897c7ead780e73a6c
SHA1e1939cd1e70b7494b970ab7b9293535e491612a2
SHA2565be904106bce2d196389c80ca31c010a77c6586629e47a89a7b8565e220ec8ad
SHA512695d94a2ea347ffab7b8816bd944b3eeb6c16447cf666e13e1778b8e0f53a0b017d7c3313d02d3aa8918c62022b4b6a35011615402f2e75cf4b6d0c92812e985
-
Filesize
1.2MB
MD5a0a42a20618a42f647e082f6b71cd0c7
SHA1e9c56aa53c7d426ccf064b9c5ec6264f2617c2c4
SHA256c7009fcf79dad73334d9b05f55d68393ca1eb4ed0dc2a3954382a59b8610f365
SHA512c8822051f6af817aff88718d42d3895bb2aada75f2b889979c03d8406b365c4ac6c0b9a17abfa5cf8e6f4fc2db2f153cb6eadf350d29f26b43120523eff2b5b7
-
Filesize
1.2MB
MD5472116f69d0639597eb551256a3d9c10
SHA15de273aed24320adc3b37af9519f8b1ec04c2ed1
SHA2562996c1c328815f54259887c8cb896bba85befda30f0be181f82954a695f809ae
SHA512211606ccaa667125d31da330a11c705fcb7c7b80de0a93e212ce538a04b34c1a531de1bc0381ff29fbbd8e447bfa8f893402c7e3a39bba874795ad12364d9d3a
-
Filesize
1.4MB
MD5f0a2c0b6714dd212f208a694d2fcf93d
SHA11016799e5731f22fad1047aa38b690d69accd751
SHA2561d56ee8b43b4246d7dd70b83f01198a8f1b2e0492bb697956e9204b86439f7c1
SHA512059b2682cb89cf543cdf8d9e18c5d75dfc97954b42fb5fd5f023a90c94eade493e329c9ff769c591a4f0ac18d50e0fcf20d6312b8194732c1f6d8a5fb7bccd93
-
Filesize
4.6MB
MD5c588c957e32d9eab6f5cb33a1f7c0d98
SHA19603f1b0abdd97df2dde5b44476ff8f8c7d6c967
SHA25677f78c72b71716c709bfa8b8b83d4e804c70bea33dc1e2c63eda6ba2186ff830
SHA51283b21851b8c089b1040686cb5b70073a61adc9c2701da93e2ee56368dd17bad0b6f6e965a5078ea0a4decaf5c5863fa83f71c9d3c16f52ce46d0d7d4f7b59574
-
Filesize
1.5MB
MD5efcfe254404e21e24718de1557032103
SHA1985be7bab19fc4d9cfc455a6c680bfc0cd11dbec
SHA2564d1ff3b46b13895ed98a6f9aabef7266ce4c1b2bff8da96ed1991dcf7debcc93
SHA5121b1e39e20c0cd48a7a0707f6b0165e1ab78fe0791c322d195113a94db741345fe1f8f017e902d32a6f516fa0395515323be4a17ab060914f2037466def515265
-
Filesize
24.0MB
MD5d8c2fdcc273d92fd76140f3c2f02ff6a
SHA1975487afdbf69d0ff947ffd16dd4666a68e7fb7e
SHA2567858392c88a37c9b83df9283434c7976d2ee3da1c590f7e24bcd587f3df7929a
SHA51288511a99aba714402e7aceddd0524604e3df16914f0d8e7624db6ee116afed516692a7c5523dbb09ce4dd6a8886fa76d67de935d277e34603137d3ed875bef7c
-
Filesize
2.7MB
MD58ef25abd681071c03518279a2312dff6
SHA1ad1bdc7a9d032c66e93d0cc9d8def8b568ae2254
SHA256fa36e1b9b2bd4c6a889a50867dd9a52bd02bc46a2e1812f5c97b4dcd039a8ff9
SHA512d8c12f3639f86656e3496acdcdf81571bf3cefa596794a98199ae92adb71d4adbee476a9ac8c7381c994c0506e20d2d94beaaf6aaa03b02fef4f9970f2342bc4
-
Filesize
1.1MB
MD55db91c6d484af63c394496720f10bda0
SHA1b3fb62b7ef2c363ec8aa8fe7b5714e1fe78e439c
SHA256f928c9dcfbd98f40849cb6dfc75fd2e9ada6b4fd8841c6a23fd3933bf1057e9d
SHA5128605909096831a662ee7c8399cea1a18e3d6e29a37bea2f9faab91382df4f01a75d8b8f6cbc2ac1bd692b7e4be7e53f350c519a30a2c28d3c73eb118fbb21f46
-
Filesize
1.4MB
MD5afd624e2c2210cf608932832c7b8c300
SHA11ff5c9ae91282932eb9e8ac0b416e773739655d0
SHA25612e43948668469851f7e27a4aa68a9c82c7535c14efde9d0a263ddd28a543fef
SHA51253e71945ea52023ec8b09beff8b1010287e92a83a5abe15b6d26028ab5363a5e6e9bf6c6fee33f20dad2b3dfea9f3b545771996b348cf849a5c68e52fe19eea7
-
Filesize
1.3MB
MD548bdb5fa4ff344282d954f47d9ea9d35
SHA189bcdaa0803a688fc051fec6cc44edf25bd0e98c
SHA2569fbc9df899270edd08d98e4a99688f1bc9c69e51f8b6ddf1fc64e7e067e457fa
SHA5127be611b8904c23179a5680134752aa80c708ccf109d6cbe83b1362248c56a7e5eb1fd7731dfd8f1198133feb5456f9ec2ba210e7fcc791a47ca8519a861404bd
-
Filesize
5.4MB
MD5a57a78dc6ceea169bc5ba30e44e0eaee
SHA11c29072d75365b7b49dfd986053e17d835a1545b
SHA25633ec5e5c3f5a5cc076132eb2528cdd7b41bddbe1cfa87e1ea55b5fc0c0f69454
SHA512b1ecc3e5c518d19720598d2b3e61ea4cb77de27f4ed08b3e44204c3b2cc63ca50e3201301eaabc92da332e7035b0ccf2630854c2107738f950931227ea78c7a0
-
Filesize
5.4MB
MD570a094726ed0b7ffb466ebb79514d1ed
SHA1c710b44dd17297b7d38d5b556c6f3822fd112419
SHA256fd9e4f4e3f1cefe6ab66f45be5d441aafbc6a3194a2ddde5b90e4039199ee17b
SHA512f53cf07bf6e8fc160a9d1d84ded54331da96baad854cc5e3a7f6f5a133d5bd138314b3c0447af8229ff3afa4a811e1e01a6b7e7657e6f294c04fa1d43f6f0e8d
-
Filesize
2.0MB
MD5c9183b8c75ed89e1aa6dbe6fc5210301
SHA1e6f20f1df02a319934f4184c176d4098d819bbf7
SHA2563ee8717d4a7a9259fdc1434e4bd3506cce45a6d0690a01162bef2f380d3602e2
SHA512e64629d1aad5287fe4d11b916e3958134ed132b8123b8b1e8730e61bdf9869e8a0d4e2334205b8fc4d5fce40fc5462267cdc750395658904215452bde4a2837e
-
Filesize
2.2MB
MD5581aff4023617b704ad0d5d3f9c4020e
SHA1926e33002c1326dfc22b2928474be19292e2713c
SHA256e53b5b10ee7ddd3f15a4d893946b8b3538982be249e60ef13878744bc241f3af
SHA5123be9a3f6ab8a263ab4ac599addb5560225c15a21cbfb361830b926147e3dc806f17f3dcd3801c1df54bf2e4bedb2bbda650c36b3a3311b1b12740b7ef8251553
-
Filesize
1.8MB
MD5bca5fb4ecea407c48278339868c1975b
SHA1ada55b7d98b2eddbe477f97606ff641f389e12f3
SHA2561ee539ef8ef1c911c745678c514ee0b5718b169fdf2e95c150cfc9042b649217
SHA512e5fa000589cc1d9de2401108a81a7c62847d3ff1b47222f6c1ac58bb451dc53a491ad58a48cccb21032d3deff077be491210f7e95caa4275b97058a43fd9ed12
-
Filesize
1.7MB
MD5cafde754c66e9d16bf9c8bae616af299
SHA127ee0e2f5b0d3d380d28134448a478c48d86e501
SHA2563160331b844f06f0397881e844872da21ec14aa112d7555deb32539a9209bab9
SHA512817cd89b49632ad7800d99a25b880f41e9f38816dde80c0813a3bb8f7d755b37bc6310b09304e857167d5b0984e5204e0173d5c60e83e476a6c8252f6216e5ef
-
Filesize
1.2MB
MD52f42566bf441228da8cd7b98048a377e
SHA1d66289056492003b11bc2dbd38120942f0f4d983
SHA2564a34e87e931abb4962413a10531cd3d98e3f5d820bb9377256c635919ff20ca8
SHA5125f6f63029fa5fa1c1496b66d6d497a3ad26064230798e7044e0c9932c75d1fa4a92ee9327b1499a342ca21aa665ee830d57c1c304416e9a0f9e2c6b93234f877
-
Filesize
1.2MB
MD5e4e8959b4425772eeab40858b5816b38
SHA13a735202c27e3a0fb503c8d85776f719baaf061f
SHA25619dd17e99738ed86e5b37648b0263afc5642fdab1e7c8a4f5c8e27bc11de2ce4
SHA512f2005343219da615aab382c183463e967f7afd969cbbf8d660032e4c3bf7253138eb24db38e6c769c585164f1d12fc9af79840662872abb23a11c4fc363c63a8
-
Filesize
1.2MB
MD5fe4211c0723707436d316802aa318fb2
SHA113af6ba10df6549029e576cc1c090f1e32d8ebf8
SHA256e227faf9befb0b215092101de75916bdd88711b8a53878c61431ba47e121dd6e
SHA512d851b6dbc17e69b6851384fbe35508e87f749c16ac4cd734d16eea759ec868b6d1930a3d421152ad85435f1f5bbb167eb15e51188ee31bf749c7cf31cceb67b4
-
Filesize
1.2MB
MD50d0e41bb286f0a3b597fd5a20c231626
SHA13e405d2e78fc2a1ef6b9aaab6ea8f2530890be47
SHA25613c3cabb57cb52a6415cc4debd6764d744dcc99b8f31e41d97c93206e3c69a34
SHA5126d41f7411884f2401e0e0ffad333df2f6ccfb1350380374b4d2cbc293594248229dd1157f06bd5c8e4e978cb695cf5b6ddd565ea53e5f1b44ca104c65098fdd7
-
Filesize
1.2MB
MD50a9033547d26271e37a3af767b3b5a4a
SHA169dd78fca4c0b7d4179088dde08d3a3a800f32de
SHA25697c21bf366b6a992916c644feee37a498697be8a6bfb517cf21e1a2916fd23c7
SHA51224e12012396f678ef17cebbb59aaccd313d77ceb53ff13561dae523349a78c177c98434b1a0e72b7ea6ce9d79d66ed04b6f49f58026aee499c7d30fb91949b5a
-
Filesize
1.2MB
MD522b7b80bcd681c20f34cc9fc34de37b7
SHA18f38a5b91cba31441287506f20b87da5526ecb36
SHA25676bcf7e1376ad48d2d4e47b42440ed245e7bb872e042368170eca1071033613b
SHA512180c0575f9f6055c2ce4a4c358efc94170a50925d47212910519ad2151840c26bd424cc6e9d8f82e69d10f6d378d2fce6561965b9c374869639ebed14cd4df9c
-
Filesize
1.2MB
MD55e6af10acd79d3552d82fde7314225f0
SHA1da7972091f905b05e32c32666bc9d2a73625a690
SHA2560d00bad093a21d310c11a1d10f2188ebff09e7ecab6d5b9a258f851eb56b6365
SHA5122fbb486d0f1958462a3293f9e1f647b651914de35eea3ca05095c5ffebbc16970e96cb624a4957836e99e910c9097a7d90cd628f4ed8028b77d6f10c3d159f6b
-
Filesize
1.4MB
MD5a76d3e225ff436de0f826faee3014bbd
SHA12bfb205ea5afafc730b32453201fd12e61f03f64
SHA2562cbb5b1967d3415d33036b152587811dfae836c81b151b885dac49b0ff33f499
SHA512a7400209fc2e0fb314360791d4ec3548c83957f5ba4b20fc26c25054bb3f165e8ddb494d5f797b2e2e51f556f461c98bf33210df06a6e7fa69bc46629e7af537
-
Filesize
1.2MB
MD52530f19ef29eb7fc4d3c8855d25facd7
SHA18d01768b8af48c3b7ea76efcbcb8d15f11346dbd
SHA256950707bcee2e217679ba1b43a63875e7d25ea0bab45ac3ed1dfa4fd17d9254ab
SHA5124266c741ab93897f5e0fd298ee9ed19344a3ffa21e7438cefa1e024f5b1f7bae46b0a368736b956f865d1ecac37fdfaab251ca3312873870d0b1b2eabdc2f1fe
-
Filesize
1.2MB
MD5c73e3fcda877a4ce507abdb513ec2055
SHA1b5e26938f33500d173963c7b680f2a2aa1f89e86
SHA256b58e5d414f389fa78007b63a8e3bdd66b9c2f67725ae27602d255fd3d535c4ac
SHA512c665d3bca9382827b49f4599bb240c5ce33f6d63e8b8c2206f7969c549a68aabbeba06f994032bb423fb72eeb8771def9d64a862afd9269d93ec1ad79f38e590
-
Filesize
1.3MB
MD5a21a4e0dad62673d85b47986d17f7441
SHA16bd048b8f795f2eefe67171682f12281aeb4b4e2
SHA2566dad12d257513a9bffefbffd003d95a5605543cf8f6429e2cb92a4cab50f027a
SHA51240d3a5fd3b073ad16908eefcad5e1e6e9ac7e3e38a5a5dfb22e4254ee8b924bc6c3b9435b34279c1ffc859183c8d769ba06d5829db7a0cec6d66707ccb1fca90
-
Filesize
1.2MB
MD59d80e92059841e18d72652838e8863e3
SHA1a98dcb14f09227ed3c6bdd6b1c7e5a9efa51e0fa
SHA256b6a9be4b2ad1b61bf8a99f0c66801953e24625a572bcd8aae8badc31ea6de56b
SHA51263a05392425deac16f2f79aee5f49a5035ceee1fa8b1ebf628f8ea7fb7bcf590ab49e13dd0f41ef31c100da69f1fcd4ad8859761549e5afe5acf5fa9ab3c08e0
-
Filesize
1.2MB
MD554f91713bdd31adebb7681f7cd255bf5
SHA17d8b73831dc85e2f4bad54d0f09bfb41ded295c0
SHA256f880c69def733104d3ff866ca68c2612e061c8a7c42c0bd766872656780ed63a
SHA5124351a87e5fd196ef2d1193e524ad9eb83f2a178e932cdcd1426cd2f48296516fee2146085ea6803a806912cdb97bc405d0e5d8d02254a5f648e42d386a9edae3
-
Filesize
1.3MB
MD5e594986c00d3973a0d7652fb635996d2
SHA1e939f75366a984877bada2eb38a7e30c45ed746b
SHA256e3330cfe65a51d0f826f212491ad858db7af1dd04aad56116b09fff073d5f091
SHA51234cb5ac04443b5299e0bae7697a775c79365c35de60baf99ac889d470da4cddd7594d610c83787a9cc8b6d57f86b9be1f47b8f6b71e9a899312f2622603713d4
-
Filesize
1.4MB
MD59cae1c21de75326c0646668eb9a44e09
SHA1b2ccb1a8f5494c418e3157cbb3e1d189a9c38925
SHA256ebad9485945bf7538c4b2340b8419575286a927a2b202f180cb73ed00e76ae9c
SHA5125c5ebc81491df4261feb6b5786d6be758cc43733d4f4b2a3e813540dce4ab0c84fe4fece546e906f54a0d6df898e84df3fd78384e3fc89e8abad7139f306984e
-
Filesize
1.6MB
MD5d8e8d17c0067e79654cf1ada2e6c772c
SHA1ca05cac35ff420a0f885bb4fd914994d174b4bcb
SHA256ad4414fb1a340b6eaecc697f87b585827ecaba1e5c5bc2f9acafe414ed7f7964
SHA512238a9274f80f78ab1000d099090b3c60727dcb96598c74f5cc852aa386c2dd3a661c2dc356121e9cac9eb66f9546efc01a3e4f0f32b6c6b3b1dd87b049fbf5a1
-
Filesize
1.2MB
MD513218ed4c317fcf9d568f61a3b049de1
SHA128c9b7e2caf05a62881f7d33c0d3e0717247f8c7
SHA2564ff86756fcb578e68a3fa3cf626db1352cc0ff04553338219624d77a52ece95d
SHA51262a35ef122d740d10a747999e9ade9be2d4d35a76b4a820ff5459fb6f187419062515b08290abd028b215c1d82810dbbfd4428eea355d76eb58b2b5b240c49cf
-
Filesize
1.2MB
MD5483ef89bcb373f93948a877338f0c8c0
SHA18b475b8c4efc50fb95300d7d6cd5e9bc25321867
SHA25605f9fc4681072fe4d6f1bd6e9c135a7a498bb7d8b1b2b196d5a8bb724255fd33
SHA512aeed0b3d8809eb4a9f3196c6be89daf49973e532140c2404b31fc9fa0a55f0fd17449451a435fba9eb3cb311648f14114f55c1d6112954718d9b4f961fee5f2e
-
Filesize
1.2MB
MD5d9c9b729bd955c2564b466a8d9a81318
SHA1ef59d202eb82eca5c9bdbcf06c0d7565cc9fc63b
SHA2563e678b579245383901e6330ffcb401fd1f86f87e24c26271273060f2c8f6e72e
SHA51253a542d3b23d2184ba962c5e10981a67e47cab9c14cb0caad6e625f4ebdefe359994a95f9ec8248b6ea818777572b3a4dd1b8f1eb7d41e33cf88380ffe176fe0
-
Filesize
1.2MB
MD54eea623b77a82529693abd5d081d6c6a
SHA1fb5fef77be21e0205dffbf74d326abd6a3c13843
SHA256a5483cad0a320152fa09d8a965f3a132e94870a1327783ac9a893f6b3ef21fb7
SHA5125d1ac96be46d84e3e46c30ea5035d9e37017fc36bf79a9861b4e8b5b011584136dd1c6d3a7973f9effdd49d481c3b1932955dcee2c0cc04ad6b29ac6fb51a152
-
Filesize
1.2MB
MD525fc9173be6e404f0c6995d2623cc7bd
SHA1f67ba23c9235ae1e7ac3ad07faaa5ee76dadabc2
SHA2560294ae25b47d84dcbd8b2ca4ffe9d4dadb66d3c11fec88fa7969df999e7c1851
SHA512c1017651c2d9c6bd6b235bc8f7b365f3a932989eb7f190466df3c1bd64d0c40108db42d951c573ff93de73b268881c87d31d6af66cf7b628def0547f15260d90
-
Filesize
1.2MB
MD53f4aadd6b9c6f4c2dffde5dfb9526959
SHA1e02013b0719e3d78ed1b027fdcc2bf38f7859c72
SHA25627cce36d472097ac87adad05294a5a9663a33aa01ba7736cb02a71fda695851d
SHA512ab1708bcf3b6f5c2fdb46c4555f616facbf677b397f49977567c946b158ba05291702bd015f0c9fd2c9b2bd96cf13e439bc05bac1e0f891794ac4cfc2d57af02
-
Filesize
1.2MB
MD5466398f313a72bf81cb266f4e79ff0fc
SHA13f26c442d771522e5556aad9df449bc2a34e2a1b
SHA256b024f44308f806067180c5645b596b665a847f1ec6064a535d43cacfa0b95ac5
SHA512fb53e513189bd50804177d508162d7649d40b8afa0ce162ff355ce85bf805268279d57efcfe54abbc18257cbc98373fe9cb1cfc2b42d8442f1bb828720bc0a3a
-
Filesize
1.2MB
MD59b9bdebd8f78e88a77a554acc279fa3f
SHA16b5ed48e938e1ea55934740e69705434fb28fa0c
SHA256d65eaa26e9ec21daae76ca204120722736b095b9e15f1bb143f3c12cdc340f0d
SHA512e7f7f90074362eed0a12a20874d82ef84dee2a8f36bea3b42afc8bf2c43f3f2e78f738ae61d888b0596eac4fc20f7dcfeacd06154bcc08f469ab67ec2d64ab7e
-
Filesize
1.2MB
MD51bd2ff156bf9139d58b5a4d2f6c887cc
SHA1c4c0bcc35af4d09f39e95cee625d4dfce7c9b3b9
SHA256cb9b18b4d9114f39c71b81e7b07f727dc8179e17edd7248e9169d68e500ebc95
SHA512c544f6fb47f58f149d18057feb341fa947983e8121c73f2334348b6b5c92f2344cb53135c2707281a80d1bbe2f3eef067ede4fd50ae3efd91169d9f51fdcbb52
-
Filesize
1.2MB
MD5c624e20d4ce3f22f2fe499faf455e0b4
SHA1373e3a2ccc4b0e0460d45c1634002bb6c3232f49
SHA256058a734a329c7cceb7a2be53ad28f96b23f52a7a972f21b1d6934dfefa88aca9
SHA512af35e7b17ccfeb865759c5237657ac6dcfbc900f5785606c0d0aa7311daf1c264363435e46cad2861b0b014b8b860de591270d865218b753b9c34b5826c5d4fd
-
Filesize
1.2MB
MD57744a510528fbd4988b16743fae4917c
SHA1f7cec94737053c90df869ea936230f206fa4667d
SHA2561cd6cd8f54cf34bc7f44d22c7e35b1ea2dc8cba63ccabebb167eea6642eecfeb
SHA5121e02ac63be25acaa240bfbf7dd1aadd9d57353d9ff306d984dd0bd9a36ab44cc9f68556adef891852c183613e71716548aaaabff5206b7d692df93c10669e626
-
Filesize
1.2MB
MD5fc4c550928b44fb2233cb03bed5176b4
SHA1035148b3ad27e5ad8d2745d481a62ec7a7b062f2
SHA256d34f0b092760b1ab46c52fb1e1107587775dbf9d276640c43aaf1cc74b3d0e4c
SHA5128d6e5ae2215de661f68bfed5498355d9a3bf40b8edfad203166281da4a26956f80f5366c2352416336f73b45a5c06d669bde6643b38e8e330e3f632d37515ba2
-
Filesize
1.2MB
MD5e65f712dc6d6a487527ef623048f18e8
SHA1612a45d6f8cb73a4ecddc0b44329bae7000db784
SHA25616254707a7ee2ea3ff1bd65e552a4faac317858ef00f8560c0f624368ade41b1
SHA512b040b2cb163a20ca3bd9029e07e11e06c261a8a57cf8aab79b680dc95027ea2ba20feec8c1126771e4c2b88e77647cc49c05243f777a9aee7ec5f0baeb20aebf
-
Filesize
1.2MB
MD56430cc09f3d35e4e9d9894e8c4631eff
SHA1233a4d0ef4a90aaf65848875a1b77ca701de8c61
SHA256c3c454732f1d8c513ab475e2fdd3f0d1c99516b9258350d13ee365d92744c543
SHA512fe8e628a283bf32b851aea5526e77df3328e93cde9ba91199ffa77bb6d88bdbe7acf0f8264d753a700d51158c3dd456d53f0e661bbf3f8f1903c7902626ead15
-
Filesize
1.2MB
MD5217330015dc0500ae9d9778a737900d0
SHA1936d1bd6532a8d09c060081bb2bfb2ce71639571
SHA256d6b66c97e3d21c86036e039a115d5d8452c9cf9e0e79cf0ef14296374f4fad7b
SHA5121cbc70ee76f439c14f8d224028889c8d67dbf95493d6347610ab9030dc296f05ab2fe70bef90740f7d213642130b7d95fb78240301ee3b465e62873e7b9ae91d
-
Filesize
1.2MB
MD5ff6152a3fdcff8ac4f488a10aa627256
SHA1a14d4adc361d58c4e2d54bddef19308d01fd4d5e
SHA256b403d5cd3b7d623015684b315ef90245bedcb37a9e6728e9ffe840879f001061
SHA512174b3cc0b235782be1143c844b45f64d28941418af03b7921c5e47b0a9a022746bf05fd498f193192ec1de9aacad1f096b6eb6bdd173743821b496b3e2634337
-
Filesize
1.2MB
MD5a147f9d285e10722216c13f17108364e
SHA1fd8bf20502672b877aa9bdcf45c494569894aa87
SHA256f7e79ab106bae3f98a0ad70a257bba1019b4592e6f7c3bd8246d59c984c7c249
SHA5120a86f24c31011b14183b7b1e85a2ef284129e86dd7cfd166f1b7a37fd3883285a07c22f568d1045a2cf3529f3b1836d35bd7e9d3f55de82fbfdb722d2374239c
-
Filesize
1.2MB
MD5ce679d7a89a9b4694f851ac0b979ac90
SHA1bdd779d866eee5a9476c8eb8e7a7436408e57211
SHA25680dfd91ff429540c0af0f148690b35376e071d252835be74e40dec686d9ee9b8
SHA5123ab995b382f5ca485030087ba4b01ff0c38f98e60d00b63403177d8b269ec03b124dfc30ba80111d87735ba7791e31eee18400106fbc848cce3f5c3df39f4e78
-
Filesize
1.2MB
MD55756034e36b31b70a58aa0fe8bfa7117
SHA16a0364054bc4f27d41419d7541fcedf64d8e6d5d
SHA25656384b47ad769f34b5a67eb967aa6807170f83f664aa67b06a3583445c815c45
SHA512ce8261a09634a82f4b5d47f51574f57b930261dbfb5b27d1a38818b34fe5af96d585ca274f6874329ae405c17511c25ed5f3cdcf4b307d24a67cb87b438987cc
-
Filesize
1.2MB
MD5b2541992ce589eac7e8476b5bba5816a
SHA112a2ef11f478d11b1cb026c9e078709a9b102c01
SHA256e72c0eed326a99c5a7eef5ca25c1fbedbe12b686b54036a5352891c1e941c2da
SHA51234f899eab747296ab89fbb07b5868390965f841e44d8a3b791e9aac0e55ae596010a789868454a65fd8afedd239acfcbb6cf3b8e6666afd888c4e885069115dc
-
Filesize
1.3MB
MD5060f401d25ca8575de6874452a7ddae4
SHA1c2314816113da074f32b57e2e920d3a6bfec3dc0
SHA25687d8378574af7ea35348d447fdf63d312680807ebd2df24a0358e8c6b260a137
SHA51222f2d5106f0015f9dacc530f61f3e74cb02c378407ef3e2a3dc6ef9f5208c45a0f457d1297b55af9f84c52b2a839cc4faf22cc5695a906fb741a80864b5a02bd
-
Filesize
46B
MD5c5513a59f54a2721a6e3377d8a5564b2
SHA1492e301f1eca4efffbb9775dce83efcd2cc193be
SHA25647e723ef38f77083f2e89a621b861c6c9ca81fb26a3fda414947ae3fae4edb31
SHA5120541c4682047cc9e3f8d61aee012c92bfad47f94da7ea75626afd182514eac03ce50b56fb91784c2f210d61b1eb31c59920760f345cdfbf3610d8dddef76e376
-
Filesize
1.3MB
MD5df125aad0ecf2e3525680fffe49b983e
SHA19c5a28b9e5d24bc26a2cfbe4a5b139ee00e40b18
SHA256a28d01c5e608de4ee94a7a99bb08384ca4bada89c166f697117da4e4b6e7fecf
SHA512e91ce54c430dc6423652c208a99d8967366ff50ba1401d6f47eb6fa138bdcd5904dd22707947f021569cc5b0a2ba4c39e351a5b69d9f8390e0fdcd48d43f70f6
-
Filesize
1.2MB
MD5dee30d5a21f08b8f5f121e5ffd26117c
SHA153fd98ec21e1318fbec6153b95fd6da3250d3ecc
SHA2564606b2cb5581d2e98e658f13e641deb336dd2397e5d56624649020cbdd6e2264
SHA512fc8e01c07ee7a1774ff61d6551a8732b80b7b9c24007a1495078ce02283f71d4582b95945bfe418eefd36b3e90b9a19c6237762142724f7a672d1c54b46229d4
-
Filesize
1.3MB
MD5718be6f451f7ce27deb5d9d49a1ec174
SHA1ad85d97d8ed963982b091cb412c54b16ec2b3572
SHA2565ef14ff51e205778dc74c2ca9eecb3d0124aae7c1132db128984c8ae18bbd32a
SHA512a17352268d57e86d0d981a66c63b7aa33a0885a23892145ea2f344408d4ccbf8d6704c3028217ed3d88d9940fc55d4318e71e67bc0b3c860efa523140f39cb56
-
Filesize
1.3MB
MD597c0ba7a1d40784c8051d53c1dac9f63
SHA1f3abd0a3e179bd19bce02b0651b06587c4e7d8eb
SHA2560c9f74a5746ed64a9ebc4352d513ffcf225a806ba9ebd3947ee228774ec239c2
SHA512eaa9a0ff8dd5a015449dc35a291cb70bd147cc786deea57bdbb24b9e002283f6571e5c96f9fbc402214b2fd24bb52ca4cf21dca07e4fb40681223bfbd499f70b