Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 20:08
Static task
static1
Behavioral task
behavioral1
Sample
0f2afccb4ebef7b35ec7cf011af664e0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
0f2afccb4ebef7b35ec7cf011af664e0_NeikiAnalytics.exe
-
Size
648KB
-
MD5
0f2afccb4ebef7b35ec7cf011af664e0
-
SHA1
c536b7a5690dcea668559a3a7f1cdafd249f7516
-
SHA256
e4138fb58abb36224899d13cb25f25b0440997586e976e5e5417204e8913d244
-
SHA512
aa5ba0fdb4ec2ad460bd3470465a4ac5385201726c7c9915e0a9a978f7ff898b7e208ad4d79fa2d364bed19b3c523421389f0a2378859b624974c7a4a0700644
-
SSDEEP
12288:Uqz2DWUDp/SInr8vv2BDeT+bVYHTb3FRk/rMNxaXqqlPbJKTGv5DYFXOBnXREHa:tz2DW8/i328ab4F+rM/aXq6bJfBUam6
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2332 alg.exe 3748 DiagnosticsHub.StandardCollector.Service.exe 1392 elevation_service.exe 2216 elevation_service.exe 3732 maintenanceservice.exe 4824 OSE.EXE 4376 fxssvc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 0f2afccb4ebef7b35ec7cf011af664e0_NeikiAnalytics.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 0f2afccb4ebef7b35ec7cf011af664e0_NeikiAnalytics.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\fcea0f85b3e2edcd.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 0f2afccb4ebef7b35ec7cf011af664e0_NeikiAnalytics.exe File opened for modification C:\Windows\system32\dllhost.exe 0f2afccb4ebef7b35ec7cf011af664e0_NeikiAnalytics.exe File opened for modification C:\Windows\system32\fxssvc.exe 0f2afccb4ebef7b35ec7cf011af664e0_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3748 DiagnosticsHub.StandardCollector.Service.exe 3748 DiagnosticsHub.StandardCollector.Service.exe 3748 DiagnosticsHub.StandardCollector.Service.exe 3748 DiagnosticsHub.StandardCollector.Service.exe 3748 DiagnosticsHub.StandardCollector.Service.exe 3748 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3108 0f2afccb4ebef7b35ec7cf011af664e0_NeikiAnalytics.exe Token: SeDebugPrivilege 2332 alg.exe Token: SeDebugPrivilege 2332 alg.exe Token: SeDebugPrivilege 2332 alg.exe Token: SeAuditPrivilege 4376 fxssvc.exe Token: SeDebugPrivilege 3748 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f2afccb4ebef7b35ec7cf011af664e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f2afccb4ebef7b35ec7cf011af664e0_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3108
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3748
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1392
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2216
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3732
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4824
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:81⤵PID:2184
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3528
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD550bee11d96d8719dc2a76dc104f8b758
SHA1ef5dbee224c3df4dcaef796080040433e2c55980
SHA256c6944362fd2bd8a69dc74378536d96e83ed4a40988548ae2ae5a07fffe9ce552
SHA5124349c6a983a82234844c6417a3c8638de4c8d94a8a7428ba00c78a3b31610f2b72bf605ef68655625f8bccf10ad8f356e125531a0f3586c9313b433ead847282
-
Filesize
781KB
MD5c3aee062fe02a68823da23c57b13eb09
SHA1e5bdd570bdf0a839f221338601bd61a9a0ff708f
SHA25682ddbb771f7aaec694c06c83dd165ef102c1396e799081daeb4a75ffc54d8199
SHA5126d0f3101f3c0b3ad6b2e5f948192c5483d250c9aac033ce8ba65aa65afd6629e0ac5d96f7e616ba51f685c43023c2d91898de8f58b274e293878cd91d8e20c63
-
Filesize
1.1MB
MD53f7f2653f3518095ebf31e3764c0a537
SHA11a72f1062a398670ca42509d7dc11ab973ceecba
SHA2563ab85c31c74f1a731ed0e877da68c726f3f13fcc17e0a1726b161fe2b215c871
SHA512e81e6703848a8ebcaaaa29895c26c4830c2393e52cc660628fa3f8945cb58f7e5b56b0e9dfefd127fa26ee3905a778df14725819072357643535def97836de81
-
Filesize
1.5MB
MD53f3fda7ac71d83db0e3d6ededba3d4f8
SHA118a17e082c1afe77130c40584667a7670496dffd
SHA256323c47543c1436fcbe2d44426ac2f9223256ea9aa6af321913b45297fff69cf7
SHA5120ff16f34ce1e99f8042b4e207e502258c585705e37d05d86611fe44065c502f36224b841a3da3600e0779d573f0ee2d41d0a23c3a1c2e1aed58dafc7ea33c7eb
-
Filesize
1.2MB
MD5bee625159b0627f23934ccf851e574bb
SHA11227c009df9ad222e440bad2dfc9f3d5f19246c2
SHA256a0e8640b484ec332374d3cbd29edd16b47045d2950324f96584b33f84e94bcfb
SHA512382ba7c499e98a2bc22f089baf68e92a3992afcb1ad3a1db1b042dbc6d71b1d162fa1177db57c2ba6c7f0a0ea730a5ec26057fd5bb06d2c7e534d049a14c58ce
-
Filesize
582KB
MD506292791221dc8503401e2030d84c6a6
SHA1ca7368794785549338a55d802a70eef564cb529d
SHA256e7dc22fc2be67a79106138ba3267862c91977afebfaf3894fb6c87532c5b3450
SHA5122cb15fb06b2999b375ded71f700c1bc8e2d7ec43becae2ff4491d5d02c1685c77b3176e2e2c40e076b8fdd1fa56d931eef333d42822a9d055338b72cf3511f02
-
Filesize
840KB
MD5afa4d952acd730b5024df053b9387ed6
SHA1e71ce62aed4d68861fd817f5baf190cfca3fd162
SHA2568184fabb0b64307df8c2950ed2687e0c3658a86c0ad74b54f2e6323a4ab51ac6
SHA5123a0629efdfd737d1cfebf8a55be27f2bce0645645d526ab3e842c0959012773caf941ba249d178572001291313512ffa5768fc457c1278d1614e1fd8958d2d79
-
Filesize
4.6MB
MD58868239c8e7b7b84e48cc1a6339127cb
SHA1bb80675874f37e15da12686e64211d2bdc1c9144
SHA256c70d5b7c9027e9e342d7cd9bfba5f8ec34602dfb824d9ca7e6374b52df6013ea
SHA5126511e3cc481d67ce2a7e92f7db52807fc96776f8792c9e88cf61d0bf7f374728bb096bd5662443448a291984298d8e04909277f26bdd0d867a0b0a269ded46cb
-
Filesize
910KB
MD524fff1e2f757f9c61864f07d4bc40b44
SHA1b42c992a40c76843eb19700df2c4efad04c8809a
SHA2560b17fcda50cf64a9eac83a9cf4a9b668a8a66a4eacbade590c0162b0590afba9
SHA5121e75d19b8cf3546fd960e41f644e92b6ecc783220e7193ae1125c259448a6ade576860d0211a55be30f1b60073dfa064bb7f65b1338b36faf05838a13956816f
-
Filesize
24.0MB
MD5a51e789abdd861ca97c0fe2f00adde9a
SHA194d81c93160df391440e309dd196854c9edb02bf
SHA25677a3db3fe199ca232822622531b45b41b89c9f67140555a84abcacc77d160b8b
SHA5129178c7fe58ee812e980aa1d4c7eaa446c669ac1bd9df946e07ee218b8449d0235356a667d23bab3db33629ff0759141179af0a50c8d9ffbd4cb6bd391b207fa2
-
Filesize
2.7MB
MD536ef7e3b138f1bf412b943b48e1bc56f
SHA1cdebb68cdf1e0a8f64ebcd72f208803a388f8f8b
SHA2568097c29a4439f0015ca06c917913d62b22029009a2155fbb7e0c0bc9a56a5895
SHA512ac7a9895b787e863466ba6f3e9cc48ecbe4fa4e95646a4c7e601da76e11041c643f474760321539fd99f07c7b09f38e43b0ab366f28d9b54e8f025e73ae2a97a
-
Filesize
1.1MB
MD5bf0ff901774f266b667162ee6419c1cb
SHA1112428a3df7015c1584efba4180f8f616b73ae43
SHA256c9db2070894a9be295acd7c5bdc2a3493f9399284081be91acd4eeb3a1115551
SHA512a759dc800ab1759a3e6dc1daf4bc5bea12e9cdcd29b7115ee28ff736cd0835ecdde325b4581e9db575e71240fee16dea1a876fb5af7efcb9c1a34e8ea599ff85
-
Filesize
805KB
MD52bb9cd08e12c26f0780f08d09f97fa03
SHA15db1e4a8c0eb8a580d0a1e2629c5b3ec7ee167e4
SHA256da5754cf505d83fc6b0acf23d33f25a66b3050afd9d4b6347d5a4735704ed026
SHA5123275233d831e3bbdfa5e3435a189134424ebcbad878f22afdb57e7818c240ac5fb40df65b56870252fa508db678528520f7ac44225bf21fe101ca5975181f916
-
Filesize
656KB
MD5a6059dc8d7f513b8c26a77afcfb03017
SHA1388da6b4b09fafe39d140a9a794d9a30911cdb7f
SHA2569a87606ecc56ef6034fa4c50179bd956024193f32fb2b1ee02aa7c0d6bda8d4b
SHA5123af0930682acff91cabe33ef7ef21ad4aa7655a2da1d98d06351f69da849a57e9c817ee7f4e168bee95459ff118fd8d671a5652339baf6ef916a0d3db48b093d
-
Filesize
4.8MB
MD5df08b5b53f55f96e6274884c1989c218
SHA1f85ff68a16ff6db5d829365bb2a9ebcfa2d30447
SHA256617305395ed7a2bfb89ad6c23a18b2e1f3460f31e4d4f2b3bceb2a16ddbde414
SHA5123eb81ebabbff5e7a3cc738e89b6e51fe08c219e7e3c6aea5714197078f922ea72351f41fe73b3ed8daee271cc8d01238dac50d05c344cda52fafcc29651b15c6
-
Filesize
4.8MB
MD59da82a09a9d546a7c462400449b02dac
SHA1367621d18d70b93d0fab09fb09581ffec739b599
SHA256cb8e4d3ccb9f9a2ef179f5ff498c09c53288fd9a47f4eaf9554bfd54e533e474
SHA51249efabe4db2b75e803298a88d814387e1338de3572a3ee933d56e5709b8bb972b6685abb68d91695a85f43a650d2ec0e7ade56542d15a31846be3cc745e9caed
-
Filesize
2.2MB
MD553c24a3edb0360e0b5cb970a6dfbda33
SHA145f12c09645b0881167ff243131da1de75345392
SHA25650fe618c56d1c7db56add1c793caa75193d07f3fec9e5d2d0e65093eee917138
SHA5123d2849a14e20824b8fe2fa16c7adfdbc1e18dc08842715af7bf37c3f3deae4852b74f370d6c1aa7a724da2b76140db6496f15528e8a3d334ece56bf072e43d6f
-
Filesize
2.1MB
MD5eed1e490a8c5d96f4151f3b8ed7b4e92
SHA1dc00ba0474c0e2cdc341ad3c27008d2560c72e5b
SHA2567abd950ffa57567ae30a20846af88fefe389056e5f03b2ec8d0e021e1b7d8899
SHA5127bb2924fb6bd9cdb7d11afab73a2cd762551e34ddea5e52481b96457168396fa9ac8f4edcc07e70242762b05b67d7b96cb9b74ea5429b57ac78b4422ebc74f71
-
Filesize
1.8MB
MD5e3c1979c773242d5fbaa01177aafabfc
SHA1f599370797b472243f0e9fd2dc4a8a3c49db636c
SHA256f37c83eada82375e163c61b4e2b8020450f8fcb7dc30d0d93d8cc29e0e60d350
SHA51268a8e799fb728715dcdabaf8a7fa0e9857b2d12ab6e44441a619c6482afe49d1b66ade6a2953a1bdca828afcd702e6326113d63f30b41d4969e3c97982e4a1b1
-
Filesize
1.5MB
MD579f3eafee63873ac76531f4ce66030e8
SHA1ee4b11175e72c39bb03554d59cc328df185388cf
SHA2561b30c2d2be291a1d9d4352b9aee8b9dfbfc191cf05a9130e73e4a677ec2f58e5
SHA512e43bec90a505283366ea23ddfa19105d73580123ccb4d7023a6fadd53d618e8e78ee6f2f025547238ef0c4026fe8b0e9e3edb013609c4d79cc2d134c008cb55a
-
Filesize
581KB
MD56031ba0faf972d91a3e6aafb8766a3c2
SHA181add51b57457cc37b3408579510499cdc3c8f93
SHA25693276d2ca01c3ee84d4421e091f0ca2415a6d701ebbfe56a958fb51befe3dd12
SHA512f1e21593df6579eb0b054538e722ff2fa0b92520ec312c48341712bccc885af9e169c3bbf94b853377d1b266e85e65f5385807ce634b3790ddbf9f440dcee55e
-
Filesize
581KB
MD59ef8507c4bac69f0a8167c621ad41eaa
SHA1bb94cb17fce9c14517e92816c65f5ed678674eba
SHA2560009bbc14c6912c9445cd47ea0969a020685ea18644001561b71c4806e35e485
SHA512bd359dbd7b4e80b42868429308bb82365ea423926fc34f8c6e8e2ddbcddbef9905ce41e514a383ac8becc6c5f70ef27b929fa7c8e52e1b9d94438530b2b63d2b
-
Filesize
581KB
MD5871c9a708ba2b0db62a69e2f1ace22d8
SHA126139cfbf578867d6c41c2f6b40cc8caf0c6f7f6
SHA256d4111fd5f2c0ec79ca4925ec4f0effd3c0a31607c213faa43db9f62c27158c8b
SHA512a01338f5985963faa7b5857359fcfe52f21f577d6bdf041955dd8dc26f9cc059543332f5ec5d5eea95fc8c8463c025418a578094cab3edb0d13a8e9ac10cbab4
-
Filesize
601KB
MD593bd657532fd31937957d25d57202ff5
SHA1b6b8928a0379c7714f8178deac41fb973bd63fcc
SHA2562291d973111583cfb5ea75bbd40d729cec8e8fb8c98426ae72ee9c8b3d9c6430
SHA512ffd8acf813fcf171c19df4a847111881d084f6ef4da1eb8e9a31827ea29386334851d65640da292b99239ba80eb50807ab0c959eb542dc4e94f3ee54b68b2396
-
Filesize
581KB
MD5f0a347d2d28eafb0a1619adc8a6b4a8e
SHA1c91216474d40495923c7e88571107f9b3a4145ef
SHA256c728a00adf278ded137c7e91e9890824bf06e257292b5ecbf01b7f1779919ab6
SHA512cc2da73f095e7838d1b12f669da453b58e5be84f6dc10fb7f4b90f3156db7ea21851e4fd4f51d0a279cc6e41962a6d7749e9e77c6fa21757126c0b78073bfc7d
-
Filesize
581KB
MD573c475bd7603ad9b3e9fa6f5d107ce1e
SHA196dd9cc15f807be3733ad6bb6316d95307155f65
SHA256cb7788bf2d54a793afb73d3c884933623b57bf24569fecb8ed6149e30574fecb
SHA5129993665da2f60bc36ea6c0520a3baf65247ddfa7602419af2fb02d13be2765eb099c69975d735ea64b99f54682fa441465f6d1da8e8086c805813a6cbea9f9ff
-
Filesize
581KB
MD518f713309c2d6200ef24922ac7cb2012
SHA13730b08038bfdefddf09b3d92bea4e98d0729145
SHA256a915b693a7153f024458867afc1d266523e40c54600b3202ff4c414d5248225e
SHA5125414ee1740577a0d4b554e609e72ae415652e79da0051f457c254bbed463d70e3b4afe91bc7dc6ed1767a86ccc7b8c33b75823836a76812339346fa809c98006
-
Filesize
841KB
MD5caa181a009add22ea1a830c28035c8de
SHA1db4609dcdb5e96c298ff24add97599c0a63d61c7
SHA25664b0ed72a6ffd316091c85355c82a878c702ec043bb6b2c55fe872c6d1dca676
SHA5123ad330dc930f6c5aa7a11e1b0b6b397f1e25fb7446468fafc95398372c53772f7c62ff003516df78121cedccac5a8b64f8257d0486be9da368e11f3908a478e9
-
Filesize
581KB
MD5e65c30f5be74398eb0b19820dd485d71
SHA1f5cb66104dc1261bdfcd99f1fb63e988d3c3f0e4
SHA2566365868d20c9912c7d2b8505ee3a2f56d238b0233ddc140a85d3506e499f2bfb
SHA512e63d24d8e19924e3330075f508d830ebd89c16c0af0bd5e5e703be6499adf2d2e38a7f91e0aaca2c7ff4dd011b20bb6f1aaf84cefdaab81be148457052cc295c
-
Filesize
581KB
MD5142502b0f5c29e05069b61a04ca7c28c
SHA1a2a287e201adb74f9659c24da98582d9d60f7be9
SHA256d86ca5fd1985acd2697016dcae8a27f81480956eeba3a6aeb2905459930eb51b
SHA512837bb5244582be505c822f6cd74f6dc447fb715e814b6bdf0860e694046821b1d6b2ddcd30bb0eb17e042479e7b2922bcf078f28fc976744df7eedfa85257905
-
Filesize
717KB
MD540ef9cebd475684ed83e681505067666
SHA121c833c3f5cc7c0c85a6c2a7cbf326c0677710e2
SHA2566838bfbf30429a6624168ee57116e792261fe9f35d99da504f9a36bc5f391d16
SHA51213f7ff13a7ac10ba968295044a4ec1f42119c90f81dfcb14a20c7643effdf61172cbccf11c2d94998d8c2a15d1200282d0ab6b10512c3840ae7ab1ba73b8e08d
-
Filesize
581KB
MD5eb03dbbed6d35325f2a9c07c00dadb4b
SHA1ce671d8b326225e5dbb6cd9d2dcf925a5de46aad
SHA25628a6cef92c41b65054f3bb81d5551ea04432a05cfe4a69ab513501f25ac7e6b8
SHA5122a60228e7b413755351b10e5807b43b8b32668486ca278554b989a02da5f3b95d5a60897f7926f3bb1165df5345bf702bed7b355fa0292de9af66a7291866ea2
-
Filesize
581KB
MD546afd4060cc0a7bc15d69a53ca8499bd
SHA1b7e88d3ffcba24ca419038827b51ad9e51113c76
SHA2569a02cfc37cc809496c567391270c6121ec7e8fc51ffd43f139bcbb822cdf8cd4
SHA51264535f65f419b9f4e290d8bad641be102f1fb2586e74f21f32f6111a36f7d463fc6dab4e2ec4475f4d1e38d1db49cb3f152aa3a1dd665f51506c3d627dde1ec0
-
Filesize
717KB
MD5400fd98bd01ee85c22f7cfc2817a42c8
SHA1232c40d20a28407b5beeeabc54a7a0802ed4431c
SHA25612a578c0ed703cae3f476eab0a824ef23fb39aed63084dd3a7bd34b10c247e44
SHA512befd5b7c78a2c3c8ae6fc1dfb5d6899a6f66587a198ddd909a082fbc5dad744d6ed50cc4582020a1a2389a42db5963f6f52c1e0975f28d767d9df340c08c6d83
-
Filesize
841KB
MD5892532816b6cc8dc0c867a71d8c90bec
SHA1931d57138f29f826d0a422a681ec2f1873c54da2
SHA256435a69e02acaf52dc7303101ff64897e8c82d917a658e23334dcc9fd62fd385d
SHA512c45354ab53f3416e652751b3bef6f4e2bc40ed4b1aac65a90995bd1165ce28553692822a81cd7637f64f7498799a096f56cb00cd84fc4b82b84c26b1b03dba90
-
Filesize
1020KB
MD5648116fa70dddcde5d8cb290aa252229
SHA18819c370ac6cc26978a9be79a9598190314063e7
SHA2564857c83d2fbbac0cb8391a3e8cbbab4ce2d6273bfedba5062c62e79fb6b03314
SHA5124677a8bd291477612a84c57c1d250a87b3ec01236e8cbbb5e985482629f4a4a34bdc3c68b51690f25c8d064343ccbbd863789b9031df5d17c740821e05c086f9
-
Filesize
581KB
MD5775dea7aff91037bb75acfb8be9a1388
SHA188cbe138635ceedf07faca1ceeeaa684aaefa506
SHA25663ccc7ab32caff55298d7f976744ec672257cac184031cd161160ac0aff28beb
SHA5128082b7d4c84c6dacf5f59ea7b18db739397fdb7711b590fc77278f922f774366646c3387eaf33446e6fdd06298ae4495940f7de16f7e4149996e4e0c17d5e364
-
Filesize
581KB
MD5fdfdc30bcad803807546b67edf2af1b1
SHA16698ec79cc555fdcb5ee59c5f03d1e8807349c7f
SHA2562b9655af3982276573d4d6790b11d7d60f1f1c2e462881e22f485255412a57f9
SHA5124b60ce0cde52bb45eeb9d1ec3799b6ec7233522917474cfe69ed027833f0ab914b0459780b13c860f3b4a52691fe855625c0f369788fb62cfcc954ce94e75506
-
Filesize
581KB
MD59e9ab24ccd23aee1c4839747bbd52658
SHA1097581373c323a31c89427ff5a96254c61cb2da4
SHA256b1687c8dc84502c2f50f180d7cf53d6b4cb04929c16e16cb83bb07bbe1a29ff6
SHA512ac4c3c525e22119eec3e98726f782b302b83042e9e49fdabd6d92bf7ef747cfdf4e1b0665e13bb0befffbef2ce16d0cc3507cb979b6cb6f09b06f2a91e9791ec
-
Filesize
581KB
MD5f7f63d34b20354e8f736a73e4c2354cb
SHA12394a2cd8c3c7400bd08a5699e39b4fc21fc56f6
SHA2560a95e62475f03dcb5db71fd365dd104e7bcd06720b861851b680da3dfa17e8ea
SHA512310f6cf11e890e4004653c1321bb3f11d7453e9b532a1a86962ba647ce7b206513aa9e570e9426e4859d3b38734d4b1472a1722172594b9a6ac051b70c01a91c
-
Filesize
581KB
MD5c4afe2fccc78e92377a2e02753a51780
SHA1e3f863ccbce07f69568d2620c3abf1b6326eef53
SHA2565e946f18929f7896cf77359baa66d632ab388c1d7ffaac5981be5567f0fd6416
SHA51246b9833b87c6ca0512c78a63d2be2d2954189434d84389fcf0a9e65a0c4c30fe73e59cd47034604e7fb4a870c9020284f78b8afda1db499f7fcd71e6e6c62770
-
Filesize
581KB
MD51db3ae1246b2bcfb836021dd2c19156d
SHA1760284c935702999fc528778af789143f623a36d
SHA256099c47c30b0ed68984b5013ca45dde7c17c86040ea6e29842c5ee90b538fdccc
SHA512bf7577a1916bfc6cc9e0b279dd8eb6dc04938e8814b2a07637b1326f698690258902008286d952bb219d74583ece1ecc8f388435e4638cd25582aa35f1ad19b7
-
Filesize
581KB
MD51d0eeaeb18b6b7bb43faf5c00ac3bef5
SHA15c6c00fd1990ba59cd9f2c18341886251fadf657
SHA256a461e908c375e8d1797b0619da24c8f80bbb3ecabae36ee4ea850a97de6fb9bd
SHA5127469674eb8517e11597d362f3137264a0495bface49257c5a5f4626d1fd71d069bbcd45cc7bde48c60fa654b4b8ff47272f61d40a78d181b6edf38c68abde3d7
-
Filesize
581KB
MD5084f02ce8b7c4081139bea9dbea975ae
SHA11e261d06f5e2b106f8820fe4377d6dd54a56c791
SHA256ff341e022c84c307e7ff46c3dd0d175836be9214d3d040a424d8a37a5a48d2f4
SHA5125f0f82e7335a409f6f5f2c799c510cfc8e17c4943c90a725df3f9c9f453ae1373fb98a16c6360d71bae1996d7fc6fdfca2ec991b7ad02c466c84a80eca1b1331
-
Filesize
581KB
MD504f86e0934968fb242be7ea44ad02911
SHA1c180167278fe692ecb66afb21f79728599d2bb90
SHA2564901a4089b5d0673a13649b220d7072bf580935ade955a0e9d74c7103d3dc35b
SHA5126812d93a6bad51b8a41022aa347895c2333eff4be5cfff091dc81b3b6e1c583d4044326e12594b97618d159033d15fafd7d95f3ed8a8921b84b5486b879c188f
-
Filesize
581KB
MD57e09e579723cf4219414e744703b6218
SHA11c274cacd451644bf5aa0c05dd300a425f0c83e3
SHA256ab187bae997283eadd83b566d080a22acb30f484a124d3e575e5783f5d6468fe
SHA51220dc3973116ea9a88ebe6f8a33a101776fe49b86a705a1c9dc1cc8ccf388f241380836fce7627aa7ac8548f98cc19a70efdc82180c2fa6fe4ad1f49d3dff6dd5
-
Filesize
581KB
MD5925f387863ec5a82e1def54872b1c04a
SHA1c0da29fb08757a6731243d3d3da903c96913f496
SHA25644e5ac4a66159fe71698463285e585f9feb726daf29f4405cb69a5263d8b79cf
SHA5123d8d76e76a5b94ceb19d2acf983614d354a3793ac4f328a983a7c6dff5ec4c6bf9155f27dce0132abd4988090c208a55e9323b1a403b77450e09c47445a36c3d
-
Filesize
581KB
MD5d8bb9a5eaab2fe8e6c56cb6fe8a87117
SHA10f449a2e415ce9177f593e213da69352cd6d0f1e
SHA2564168fd3699ead675385e5e4823d1a8a82c9d6ee403a15d3a7fba3b816c6e86e6
SHA5123e9cfc99bcbf763f6910d982d47b3190f1ffbe1d18a99439ce124df3a847f9ed08e5fbb658f604ceb8caa9e574ce61256caeb16d7342fc1ab72d1acc2be56813
-
Filesize
581KB
MD5aa5309ded496097586a94c56166cf75d
SHA1a360206388686c34f2d77da1ee48a7300915aa62
SHA2560e2228a44395768e15afb9860a27f85a65df30f1e0f67563e1be635baf91c79d
SHA5126541fd3f92cd5fc5165f6fe3a458c1b8fef1a04c48386a599f6ef88acab41c04490f00fc24b42e43f6e84d94f6633ff7636522890f43f50f6f686d3fd4522acd
-
Filesize
581KB
MD5de1f45b9e343de8e4bd63927ea86ad27
SHA1a9ecb20fcfbbe4acf40eeba65186cc7732ba0569
SHA2564f7924d9a66f91aec80a01dcf28b87fb68402f59be9ee9248f36a77b34587877
SHA512c187be91c1c3d7e2c5b60816332d1009f5f0861ea055e65e29297304b9fa94113f2d02b132ffa51af28eb938cf4d361030408d1cabf2f85fa39dba62b4853202
-
Filesize
581KB
MD5b878cd4e7931f79f460414031162a3bd
SHA172e65f9869285f8eb65636fbc56f37f83b739235
SHA256f066ae5ffa939c5e7e379afdcc3c97227d99996334a2deb31eefd4525173daed
SHA5121f56e7544a7e04803c9a406015511f2389c4a74c9e07480ac8c496c71e9a995222cdbc1f2b2e115d8dd9d32a2e02b723b42a8364600221e945671adbb1dbbd3d
-
Filesize
581KB
MD5f4a8b02b0332b60cbdd45c93f8c548cc
SHA193fad752be6d499ea0129278c89bfe561843852e
SHA2567e0e4184841d86222928d56e7116667da68e0306b58878b5fa3d1a31d7d4bfe2
SHA5129c2a3e5988e1497d0d48e3c1ce61a781442c556636dbb70fed2eaf8f9fe7ae09b341eb2532fb299064f358974dd01a37ae87991408cbb659a17123af304dc3af
-
Filesize
581KB
MD5af03a8d2a5fb5a6ed9fc245ee183622b
SHA18f48e866cc14b4146c8f37163dace937f0060c53
SHA25654427729bf55766540999e57189f78abb132661b9251199872952edba64b2887
SHA512f02bf657f89845abbfd70adf9c459b1d23ba97b6d5eb849ccd26d2f8659d64a5a7a0a65f9c3d91b0551a8d82192907eb9d6c9493e6bdac1791984e4441c028fe
-
Filesize
581KB
MD5633e185713d0303261681bf9aeda5664
SHA1486375d9fecbae1b6ce743ec33a766e10317f19b
SHA256ce65d46130125cb8661ea94e03a76d16a6b29c86567fb9594ec6f61283e2fb14
SHA51228437a3309929b1abed4b26fabdb298242473f5c7105927ab8207b8c30ee1aca488c6f58c7f24dc982ce2841fa704f783b65ecec2a185176b433ee32f85798be
-
Filesize
581KB
MD55ef08e2d305d904767637e7fe43292af
SHA1acfe3192b78d94b34e10539b03e521dc5d9a4a2a
SHA25622332560b05e474a49f1ae1911961004aa657217b483c299c74c1a622cc488f9
SHA512f275e0a273b71966af002b074810c70e9dae8acf4b4a749e9af4d47f046be4db7b677802851ef79d866876f841b62ac2d731302c0bb493fdf9b6efa29770df26
-
Filesize
581KB
MD5c3d1acd5ab26967b63586ca2b15e1b00
SHA139cfb3abaae130d3b5c2da2f792ae1d87c1def41
SHA2560113cc2e547cb97d30662a64dcb918f792714bf718e662fb92e6c2ed6d19ab98
SHA512c696c2f876d42dfe53d8b9a5a3076c1641075de21830088db744a6db5e077d88e463031384a99fd8af1ff202f3784c37f5580a5182d4234466292117bde9445e
-
Filesize
696KB
MD5867c3447663d3756b46ed08de2f43d6c
SHA198fa0d4af7747405d203988109bb9d18290284f0
SHA2565f068a656d4dedadab2430ce3dd472ecee8bf4defb3ca3813dac4debdba79996
SHA512b608d30537b2b662d5b1f328a32ad3e682c1978bcc13fdf4e4e283e6dd8e1eefdf9cbc58a40759f41bb4ae05d1d1428ba7d4fbd8e468c9bef9e25158e55ace70
-
Filesize
659KB
MD5afe5f1c7e769f0523c15a89b7110a805
SHA1838e548061a1f16d752f13e45675c8c0848873f0
SHA256150321768e967dbe1f8b02063d0a8bce51dcf78fe9649b4c7c275de31f2080d9
SHA512090be42f1dfe7c505fc48654c99502d82feff4709ba03d2efd1ccb703d8ba3bbb4330e05acf1c4e2cf0380fb4e819002dbf2da2384189b31fd51b2672a576f0a
-
Filesize
1.7MB
MD5e70bdfbd2f82b7180ee7eda5dca1da26
SHA16e5a75a9504316ad1e376890e1ab9f4147d46ba0
SHA2561427bbf7bf1b6ad234c207bb3f5f2acc20ebee5256313b27c349437266440ccc
SHA51215237f48a12f32ef49a48693495528f2a1bfaeae171465d07e07b463bde01ca3f02bb459051d5d7ef8a346454c797200a47f569a70aa48018dac5f1073d9f0b4
-
Filesize
661KB
MD516fa1c65b8e9ca6f85b67c9f9eeba44e
SHA113c5139fc88c519d32802a942025994c9ce8cbb3
SHA2565d2b338864d293e1f071cc4e24918daba49a0c1bbcf2cc8b0fcab1cb161ef782
SHA512d204b9e086f38fa7d2ceb68e28297fa43ecf0e127974b72c2a8148330f8b6c288545c733bf64b46deb7062df177a763d9f956dbb365704898c48db901583f24d
-
Filesize
1.3MB
MD5056fb195cc18442b61d1b54d4d2f875b
SHA1f460622ac832eae9fee7fb50dd68f551cbb03a96
SHA256615ed1de0f3c22995c24e10453912889efcd11470eb6fd6e98e8fc7ed9d39d59
SHA512ae071a815e2d3b582300034ea654276d82bdea1fcdf96a5d2aef0c88c2ca8bb1808148a4afeb653481a306c96b6206420db923151f7e0b6ef38397a99b3c188f
-
Filesize
1.2MB
MD565a0ec10dca2e303dbb2f93b31862092
SHA1524156e8bb0cfca48f96e479a7bb82b8d094b1ed
SHA256703749ee314a9bc29995517453e8e6541207fb3e08fa4144bc5f795b709d73ea
SHA5121ef15a48a4e311bdc47bee806f67a63bd8e2d4c24aceb5f268a6bed188657ae785c698d1a1adbbbee4d4340c47559b9ec7d02fa416c94c736a8fdc7de3b25d9f
-
Filesize
5.6MB
MD5fa0f9ec238c3ec973d1a1dbe6d0bd08b
SHA16eacaa1bc7daa041d7cacc372d1fe8d579c052dc
SHA256acf5e2c1adb57b6c00144c8d87fe74c1bc5b8aca6aad9af150b3cf5cd9e7b0cd
SHA5124961c49b4179746bd729fd6d4ba82746f6a588fef51057c97d8b8f51f16bd0408c1faaa7f669ea6bbf314f5e8c20017356c8dee939c72438987388828f68b858