Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 11:02
Static task
static1
Behavioral task
behavioral1
Sample
ccf76becae873257b6fd0e688ec92bc0_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
ccf76becae873257b6fd0e688ec92bc0_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
ccf76becae873257b6fd0e688ec92bc0
-
SHA1
26447fb2f3109a74ced6ec8d383037430a4823cf
-
SHA256
95c3ed67ae5b25a3c6e963bfe56788dae0fa21fd905a45722314362f2025069c
-
SHA512
5b52689f7bc7b15aa35063cb7a7d722945340a801de5f9f0ab5b903e84ae609b883c7bf848e2ea801bfd29ba0c7f6b9cd231f0dd6cd50279133b697c5aabe8d4
-
SSDEEP
12288:nQbMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:QoSkQ/7Gb8NLEbeZ
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3296 alg.exe 1548 DiagnosticsHub.StandardCollector.Service.exe 3616 fxssvc.exe 2180 elevation_service.exe 5068 elevation_service.exe 3896 maintenanceservice.exe 4616 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe ccf76becae873257b6fd0e688ec92bc0_NeikiAnalytics.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\454546d3b3e2edcd.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe ccf76becae873257b6fd0e688ec92bc0_NeikiAnalytics.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe ccf76becae873257b6fd0e688ec92bc0_NeikiAnalytics.exe File opened for modification C:\Windows\system32\fxssvc.exe ccf76becae873257b6fd0e688ec92bc0_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe ccf76becae873257b6fd0e688ec92bc0_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe ccf76becae873257b6fd0e688ec92bc0_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1548 DiagnosticsHub.StandardCollector.Service.exe 1548 DiagnosticsHub.StandardCollector.Service.exe 1548 DiagnosticsHub.StandardCollector.Service.exe 1548 DiagnosticsHub.StandardCollector.Service.exe 1548 DiagnosticsHub.StandardCollector.Service.exe 1548 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1800 ccf76becae873257b6fd0e688ec92bc0_NeikiAnalytics.exe Token: SeAuditPrivilege 3616 fxssvc.exe Token: SeDebugPrivilege 3296 alg.exe Token: SeDebugPrivilege 3296 alg.exe Token: SeDebugPrivilege 3296 alg.exe Token: SeDebugPrivilege 1548 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccf76becae873257b6fd0e688ec92bc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ccf76becae873257b6fd0e688ec92bc0_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3296
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1548
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3260
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3616
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2180
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5068
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3896
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4616
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵PID:5036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5f74494876709486f6b94438717db8eaa
SHA1c2e972f4e3e2ccb64301100f31bf41efeb2e1d6c
SHA25676783750fd87a7663ddffd16ad62adc5393385b0a77e116c01ebd20b424e63b4
SHA5120e797e8bddb0ac8126b101ddae3e3f981612feb0ed6ac00dba98541680efc251146b22655bab210c6c9cdb5e2f5d7439978abb55b9e7674b88101de691dd76e7
-
Filesize
1.4MB
MD5c90400a724e0a6b620744b12b12f2b88
SHA1511337157446f3244d658fb6376855dfce6c3001
SHA256de20c96cfcb771cf91d9e8b74be15351b1741d50a509fa9ad5e20baa7961a564
SHA51273f34ad362878750c7863b966d923e8f1c61fef692f5e23964a5caadc49ab4d04c29cee9435ee97aeed977a9b38560a8551c7f2ddc23d84dee6719ff8292b2d1
-
Filesize
1.7MB
MD599a45024491e785f27db410015e190fc
SHA1398c8aad055152f28bf177802c14679a2f281bdf
SHA2561792118131b0d3aa348aa103bf738ee119dbacb6ca9d108535a86c4b9cef004d
SHA51207ea7fc185743b77c95e872ebf1894080648847224619ed7ca4d8b2a5487a9f9b50a3180300f7ef0073a70b034bd0013788102da04f16080f7670d2b24f90962
-
Filesize
1.5MB
MD5e4654e8fa0c6c23c5c6ef96783f4eee6
SHA16a1c2afa6815e40b36b4b8e8cf3fb4e464c536e5
SHA2564287c30546bae3972dd9b64bb9330e1b030a4a25ffaa56ea29ef6ead9fd309f8
SHA512ab2bd4ac8a83a6a06675c396dc85da59ad9a00bc564eeec5ab2d0cff03e5460151ecebfe6ae2efb7d7fcc57d6f758028295b61189dcd4d36d13697ec22994a7f
-
Filesize
1.2MB
MD54647623c085a72d703ecae1db04c90cd
SHA1682a2b2c9eb63589c66387bdfb3e39c5d34654f8
SHA25653d2244645f2c37fd58e0acd7a823eae3850365bd23a1f020d567212243e5b9f
SHA512c00acf3827e6c962e8de805dad9db1d890ef39780e1b72e536ee0583d0a670d2e6ab024bdb4812563e2a854eaaa7aaf7f9aa5eefaeb778e899ec303ed28d020d
-
Filesize
1.2MB
MD5ceb90c0b01aae6d875ef40a1d9410f93
SHA1a70ce977ba0faf05d2b307ca027d3c1e7e750da6
SHA25637cc589eee63c82061f443b25888f2bf4ecdeff5408dc43c4fb648b6124d6f69
SHA512d5efcdab8695651232416d9b10b910bc2409577d4770ac1763c48118fa44ae960a4b09c18ffb711a421a6e46e8f855bfe7cd3a830589a89d47f7f0b155af203e
-
Filesize
1.4MB
MD5999e19a8de9880868cae70765116482b
SHA1bef8e33310451754409483d8c1780a44579ed464
SHA256861eb625e6f1399aa343e542f1fc4b4ae88b6148067a47083e8354b1dda2444d
SHA512a87f2355c28cad933637b52c144917e84db5fd0b8fc4c97f3214cbd5b2c692380f20f3425072822bd117f404eaa0f026109ae362a14b01ca38ce3aec616f6ee8
-
Filesize
4.6MB
MD5e4327b39dab4c05932deba4c91980662
SHA1b86a3fa661b4459219f4c3c6b29c49b6adc79d32
SHA256c0b1d7351714f612014dda34265ead88e31e28485581886a65466684b0ed418c
SHA512201641201f7f9540e2779dfbfc83c0a215c367eaee378f1be772af7f7b11092ca9135f06c4aff5b0200effcde3a515f656224e6108dbf387c7f602f25a369dbb
-
Filesize
1.5MB
MD5c2d7e88a172e9804569c445292f8856f
SHA11b87d4638db6f1775b0ec8ec1c9ab5211eccce8d
SHA2561b46d89e0d3a202a7dd192114a8c97bb8705b659b2061a77901e25ec6a57addc
SHA51228639a17d17933227dc9a5fbca4053bc6bf30841abd3e31ac53b0e8772ce08a1c2083968cf82236f016e95bf49eff498bb29666443a57fca7c9968937b3a7f01
-
Filesize
24.0MB
MD5e582a906d160711f684d3d56d3f8facf
SHA19a96ba43b9bf1deca0200e1d37982ead59b9798c
SHA2567f3a873f5a1f7dc4b0b4509006d59f638b76e733b69fd4eb0849082c253e0c32
SHA51233c0f35b08d4069e2b784e5ca5cbc7320585465ad3e1f06d11243d934ab903ffcbb02b50dbf3f8cf349241af6e19539c938ace5569002cf89df09aa1f8f055b0
-
Filesize
2.7MB
MD5232c1d5bdf275c2cb1eaf9b69d267220
SHA1431642d632311834927a7189fefbba449adb5f17
SHA2561f910f0824c1c1a39641d0cfaf5bb6627333fe61a1416512fb8662edfe439c8c
SHA5125600d9ebb85c45da488127c07c2f6f02e7b442bf44ee09dcddb09e36327672c78a0e1a8bea1d3e407c437820742388c9daa462bb0b6688aca4e8a48a16f9881f
-
Filesize
1.1MB
MD54d6805547b85ba44630ac176434132d4
SHA1c6656f7be8eccacc7ba682561f52625b3d7185eb
SHA25682666dbe8a4d808bb9bdbff4d3150208d2735abfb218a13df618f4a73114a31f
SHA5129ce0312342b618b10b7285b19f56c66f2061ca11a4c5e25962d63461d07c5819ac1a0159609040ebee7ad409b6703f46b4ccfa6bf2152e7a34525da27e2c6b6c
-
Filesize
1.4MB
MD539a0ccdd3534a210e9cfa231a1656aa9
SHA16ad9acd92f79709bb4a072a2c06b4e5a4236511f
SHA2568bc8a13d17a399e1298c015beac2297ad234cf197b2169c32a67086322ca9584
SHA5126b5dcf5b5cc115b13660a6490badb31925824128bc8283f960b3203d55df5084c047983eb983b7ba7b4dcdc74044741bf8f3b10580bb61a6d0145dc08278776f
-
Filesize
1.2MB
MD5acddea472543f06755d06e5ac1ae5370
SHA11c693717a97263e049f2847cf71f7186686a4299
SHA25664c853ad208439dad4ad0a335185aa9bfde32468567084325728883b5a6ce01d
SHA5125b617350814e6f14cb62fc02bbca24007296230b02e2d7040404a3a36d0cb64e297ba463f90334cc3d823e67bbab3bac63da92a51fb8cb212c86bfec8797e4cb
-
Filesize
4.8MB
MD53a98d134a2b6f247357cc53184d33883
SHA1313d7b480b9a9b132587df8e0185be1921c16b4d
SHA25682da947873660519df2b2d246de75db556ff7cbea37d86c2c0b0c6ee115aa51b
SHA5120827575f3cdab17c8e7123f8507066463f1eea60ff024e4ac1cebbb8650250c5e85b3dd19ccbbbef7182fe3d9ac36cfef2e8e8b0b93666a10d6f864c4d42ef80
-
Filesize
4.8MB
MD512276b017f5954332ae1b4b4e35834a1
SHA1db757a7efd2ecaae69ec4d611f7038e5511f0ea1
SHA2567090a94bae48bea7df32d52038e1dceb9cff9fed6b8b498264fc8b4be97728b7
SHA51257a34d1fedb746ea59cc8efa8b1ce0b7938e0afe26ef2c66c7945b1f9a8a2fafcddf824a7b7bb8e5d4fa571d47d4729af88186a01eb62b4fe7e82bc3b0034cd9
-
Filesize
2.2MB
MD58444b527f049a1055dc055eaa0835b03
SHA1df3f4b9f63661261ac4ce10963d821840d8dea1a
SHA2567cd77b8b0c2b65c0f168c5d16e4f624e8d1e09b4f0cb626491035b818c0c6ba5
SHA5125a224c1340474072e293250b3b0ddbb5178cf5fd005fdbe3a06902ae834d34220be6afb953d6a8970f6f0debe70ba1253bb57809cfd3195f76c87f50fa3f302a
-
Filesize
2.1MB
MD53b77dc495b547c184f09f96430cc2dd1
SHA1fdba9549fbb18a3f7c98aa75825af5e1c0133bc3
SHA25670804cd7208b51204e60a20fe816a0f65166fd943b3391c5aa24b914b29e0959
SHA512c9fcdc2937674ea45e5c87a71862be21df33f6f4594951fc293e150f94dcaa9a83d6fe6612a4258d0221a3e2d3a8056a2e41e218cd9b25414747a47bef0dcf54
-
Filesize
1.8MB
MD55ffd154097e638771cd283982c5ff7a1
SHA1f60bcb33430c9168697f54477bd9e489ea267fda
SHA25680ab7349f457dd1a405c9a95f67526cdded640fba84fc42c73be2bb3284ac8da
SHA512b42106f60e8404c0249413c73b093de28eb82feaab73c6f5cadaf333947bb519de4ee77d4f34d236dd12ba5cb1265fee4da0901b63d01f558a860643ccae7add
-
Filesize
1.5MB
MD5cc5de232ee67f7bf14f42c1ce99e188c
SHA1dd4bf2a7bda24c5998ea4606cbf88d9112df6a25
SHA25693d024c46083f6d885cd7fd97334376009b5ede0ad1686b765e5e2be255389ac
SHA512b92e3377ec8b597e210955043284508c9a9ad8b7dd8034c4b2c1d93a537200089fb4cd7c9b9463d7c40af5c23aa77ddb1e635544945d8a16363d42ab375f06d4
-
Filesize
1.2MB
MD5d81274981d1fe04a078e38cf19b9ec7d
SHA1dfeadae022c6f26ec698116d7cf776ba609c8a1f
SHA256e1ffdef73dfb4c63c450c7bd161890c925698b26eca9b35b6c98e9e894063970
SHA51271d81940a6a11b4ee10cc5b11e7c8e4369aca79e5c518f707d94d92f038b804a5c555d46c3535a510f1747088d8f5f620c8d7a243d3ee145a75ede15eba735d7
-
Filesize
1.2MB
MD5076caaf024161202c60c13a536d2d0f5
SHA14a3ef236151e44c6e511dc62c4646a09dfc5fd27
SHA2562e0bd1052bd969cabd309f2c75bb7cb6d880a9a0f76d2ee69055047ffa282255
SHA5129b4ee3a9ceaf957b3e8df74d184ca927f8035dfdabe8e6f3b2f4c26fbf78c543273dd07d188728a4d624e93c2c66ec6473a1373b26b43107b00b585b32d12336
-
Filesize
1.2MB
MD5f101facaa3d46b76c60a1d3737b55da8
SHA110c37dc228b3745e87d714a13d6c8c103c4228d3
SHA256174f4e97cc3cf17ddd2dd4fc986390a9fe3dd84f25bda38e40274e3cd58a755b
SHA512696edd5b8d07e477ee6ae5b25ef2da7b98355e138744eb0cb0b235fc28a10b380102b2adb0fccd9864b5b3599c3f2bc1591eb5afb60078f4b2fe0eae6c90ade1
-
Filesize
1.2MB
MD5635fb7e4b5284ee05e389ce17ead45c8
SHA1b0d87c31d968a4d9cb5e3b59eff4c33a45b552c8
SHA2560fa5d1f66d65bc7216930e4fe256e9843de695c2508431f90f4ece7470f8c002
SHA51250e696c82f7c477232220609871ba62aa7d2c2d58af44d2622c4a12096c219f5385f00362be6bc27e34e89a8870d91ddbd7aeba623ee214c650dbc6f7340acbd
-
Filesize
1.2MB
MD5fbfce60465625e40d10396142b4e08c8
SHA1dc37261a1ea99af2b2ac633a80896e65e9d9c8f4
SHA256ce24f38cafa65584ced466783b74295ea8290e964c3fc60720c35ad5943497cf
SHA512312e34224b06658f89c6be232f0997615d1d2ade54fa5f0c366771e0f8890d81a23f72cae8c710720256db80f701f1312efee474be86e75f55b9f4032f1dcc65
-
Filesize
1.2MB
MD5b24eefde78ace3c110d92b3672aa6097
SHA1c171261fa2dda4d93376e9259c7858d2d7015290
SHA25622e6a99ad3faca1cc368a1bf5d3228964b4ba3c9104692b898f09680ebd5f08a
SHA512b81e0743ce3751422767a78ee61020b92f59c543a14d33e760b9e806ee123f3f6326252e77c1b1e38d02d7e7d60360485fd1132e1f5dbeec80d059139d1a9f85
-
Filesize
1.2MB
MD5541f99ddb782255196f5d8728d5c2bd2
SHA15c27d204493c00372926798cdf54f38b892a8086
SHA2568592998a08565c4431e1c2d987c47e5a5d212e619eedc1b0cc7285eae8f88737
SHA512f09413c7605de92953f725f658910aa6b54f7aabed34121369523060c28fe6cfaf84d4290c3e21ff5c5c1e5976d57c05a55818504ab447c00214223250ee72c3
-
Filesize
1.4MB
MD51995ebf58d2a04fb194943b0a3e2fd36
SHA1f0b130aaeb484e40beb184c9bdc3d8b63ac5ff86
SHA2568f85a8fdfa63cf62f6e0c73da61069fc1332ed8c88699fa502a7ebe8067fae19
SHA51225520edfbf98a701e615e8ea3cdab249b1cf94780a7bb66a7efce467d075a5ec38944c0d2ddbf7faff0db4c641c2ffe25b3678cfea13fdf99741d5d9e4471848
-
Filesize
1.2MB
MD51403d17035cac7b55d829086d566d6b7
SHA1882264176247f35c60e88aca69a8e4e0c88f1121
SHA25657dece893dc32f76a0e68181a32df724b98ae94f7d14626d1d14eea7e4dcec0f
SHA512654cb8024eb104b84109ee76e63ae9198bc8f56434fcf986192e61cb408356cf7ad644999e31da9a82064418736a29b3eb693d191e93f6d52bccb21348bbe6a4
-
Filesize
1.2MB
MD5e35c4856e2fe1f8a3a4b7242629c7e36
SHA158b7f2bc33ac0edc33bb3bf0d1bf12a4ddf2b870
SHA256450f052c10c1e3aebeb2b6e6e9c3259ea40ea65f291095aa63ff0da2f3e7cf9e
SHA5126d810681b388f3dd9d32364d6c38cfee846dc38aa1d657c757e3131e40c055870b4ab7cd3f815aa733b4efd670213a455eab85a61fe7121b8e5228afa4baefcb
-
Filesize
1.3MB
MD5ee35158e060bfe2cd4405bd1d175ad0d
SHA11947b50c5fa710babe105082ef3bbcdf21c99cf5
SHA256e60b2417b09a9be1916b7e97dbe45c31e7f37756a0cb0fe09d3c170e3d886271
SHA512984d2b7f2836b01a90ee92ed140ca1ef8e3dee46e0b509a1bb8b8d468daa5fe3aefa1322cf3e45e392a6edbbe8f61559c4051da1ef4b44142a9ad644f61d5048
-
Filesize
1.2MB
MD533fc6eeb011f88a6355bc25026556167
SHA11c294bbe52650f087a2bc8b7cffb468a51ca20b9
SHA256bccd875380085d180b4ed347f255c886e0ef9c546eb6e2c70e3dc98d551e420c
SHA51288b0b1c8ba5dcba03f9ffe09acb7eb98a3e0ab9a886ca8de988869ae58ef1e118eaf6e7aebc8023ee51c8bc5601e5731e37cb1bea1a53fa8a88ef7291ed9c3c6
-
Filesize
1.2MB
MD5108a0c1a4c7956422ace7826ea83fd18
SHA1f644a51aa227a4b6724e852853cb6bf2a46ad928
SHA2565b5f5e7ccaef7868d87265c3e65f718cfcb2d02367e2af60b6c38a04bd7b0666
SHA51274600e012d0fd72fc8d829362f6be065769999bdf00e0d9be51887f5cdc84580c25ff7f38b21bc2abc86a093e80eba413fd15c4c52b7f05fc45b3d1738517358
-
Filesize
1.3MB
MD54395bfc37831fe978f5b1b215c49ddef
SHA19eb44ee8ae8748708d7de46351b6e2516d255d89
SHA2560138c78acc7d5b8a5387bdb3e88266fdc6b5c1b5d16b71cc35f874a999f87c69
SHA51260c968918760fe9d5a1e3558dabe9e4851363bb235acfb8c34ece35c2777d578b2ce8a14428c43414667fea7e0b7d61d4feb5859ce3624954df049fae363563e
-
Filesize
1.4MB
MD5c0ee8ca1dd71cf20ea8fef545e6d48c8
SHA1af98a9f8cd11f052267fae2b07f594a8f473a7b7
SHA256f037ba3b38d118461acbb598db81144823b527d024f19783cf4dc5a7b9fc4740
SHA512911d5b60ac5ab4e2398d08854aefc142c6403f1e9f30a63277f67f5f5e10fc5f8048eae72efd30fcfc3c6e0446b386d0f7953ff665dd36cd5ac5f42fde311a7e
-
Filesize
1.6MB
MD5f5507bafa87598c7a1e11cd2c659a4f4
SHA19a6dd26ed7cd5449803a7e5866ea130c820b8787
SHA25677254ca3d7060acb81f3fb90a9d7fdb7d0d98459b0d5f07acba344deae7381e6
SHA5122062ccb2f6ced80ac855a79a2ec3086c422b58adcf9071603343b9ef151ae503d57f3bcd76cfe7db4ad1e04545b60ebcb2b1f14a0192c7c94addb803b75d4e00
-
Filesize
1.2MB
MD585fb56f076b3c40b0d5b8c541efe6336
SHA104328ed47c632d70de8549551229a7640832bec6
SHA25608e6a8730216a35fcfcad98c4f5eeaa8f6c9d7612f4fa82bfa0d8eaf587b9650
SHA5127c6747bcaedd1ef3c40f1433afe047c0193ecd004e17fdaef437ba885e3c726e441771e901a66fca8d97eb033d4ac08b7a5fbe7131a04026fe834d00bfc6c4b1
-
Filesize
1.2MB
MD5fe340ecb6b26f2f25a98c52d279d7e91
SHA1b20b956be908e944830acbfbe45406de97faef1a
SHA2563f5e5389f7ab87be956539d4c923d4bc3340d52ed98432369a38efd34e991fd6
SHA512bc2fff652b078a8e576c5aef378a9a6bfa61dc3d480b2505203ad50351104b5bda99c31538594667031a41602dea9b0fa0cb63381c3d4ca7dedf3f48a217172f
-
Filesize
1.2MB
MD58209dc70eab75ce694b7415ca18d2e5a
SHA1556ef8ee7998e42b057d33017e6eb0439a7134f2
SHA256779a728903579316970b643a20040eee89fbc00fbfb90c5ff61209e8df1c4cc7
SHA512de23a4ccfa23c224dbe8efdcde11f8b3198070b3bae98c29ff1a10cc150bd4297b92bb0eb1ca9e43dbc9b67699a2f20fe6dfcdbfc2e656a623a9bee013c98633
-
Filesize
1.2MB
MD502052af03c46fd3e87c0e4cdb4545721
SHA1d021a8df1681bd88a163158ceb29f5586a43e533
SHA2565c4a0a260e13c7e03fdf27e904abd416add1f0d6fe1e350157f8bedc8ca9aa28
SHA5128f346a986b73e43cf63e490a76c02485a5f118e7f235fa13652953ea90e669d1fe152b3e709cfd14eb7c2c94a4b5741da2aceca2f616ad684f987776c0dc0adc
-
Filesize
1.2MB
MD5175b5e26ba6915b2d6d8fe31f5b01a6a
SHA1ddc77c5e0ac0690691bc7b8bd7f390bdfdfc4ca0
SHA256f6f1dd3022054572ae10b7bbe453b6a6eacbef681ea5983ab43ae82798e55582
SHA512f2cdec4318a21d9bb8a1a1648074da2c83742d244a10e3f3e298eb7853322275273e3c160255b4732269fae4dc8eeaa39ab72b8d1bab62e1e6d0d11acb9e276d
-
Filesize
1.2MB
MD5b303f2fce8ee604bb9d65bd69fdb826f
SHA1797f5983938032b0d59721bda4a0cbe32cd6c053
SHA25638361b0c3557d792a8db7f7171c60111454bd92d0f8c8277d8aa9ad50620a06f
SHA5120a1a7c4cf027739d4956f2b34b05d9b2a7747dbfc9cb07cf0ea1abbe59578c843ade0e89874cded37e0be02ddf2fda56f2b447ee15a50965bd4fa35fd73d9947
-
Filesize
1.2MB
MD535279cd51fff7e420469e691448d03b8
SHA170477ccc43fd6bd241839a0cd4fe4917f50dcb5b
SHA256187d7a6b1768927139268ef791a6cfa5ae9bc68effc5015a402cef66cd8ec3c1
SHA512e23f2d66abd07796280dd235e441b6a10a8e85322fe8e3886381f6731734455181da624ab8a1089ba9e0544166f30eb401bdce92d813ea31f2b096f7563181dc
-
Filesize
1.2MB
MD56c57ae1b2ebcbd5128a1784cd97f60b8
SHA107c8478fde1b1278baa7c77170415c9ddb7929e2
SHA25627fb800caf8302da33918644cdbc6a00d6069f1d8774b7aa5cf767b5018b62ed
SHA512d5d7c900e14b779acfac2939a678d505306a0787ea8308c29756ce1f644db7c4ad7595c28a53f49507f2155da4f44177d6f91b8c20e8cecbfe56c8bd215bd7c0
-
Filesize
1.2MB
MD59d4d53f1b018543368b453802d0f686a
SHA1accd290ab7489483b65cf275cef6fde1cf33ea8c
SHA256b5d8b2dd2960d094230f1e08f1bdb949b0fd39e9a6e051befec4e5625669df83
SHA51234ed3838b2f5ad181300f0aa51f38fa09ae062d950cb5e2a453f9cd4d3973530e406738587e82c4e624ae1363173a7ef4d1e0339d4db744e4bd301a3f31dad2a
-
Filesize
1.2MB
MD5a8ffbed476fde696830a771fec5ef5db
SHA1a89816ce61c8cb08c83eb44af7f41968f9d0bb94
SHA256fa1b20e43a3bf7e4b9734ff1111e599528f9f4a05133ba5c1357f35fe5f76779
SHA512e5b08f5311aa517c0fca4461500b7994e8b315d5100649cbbe5ae2a509549452aad6e1d6e93355c22115496bb13a8cb82afcc6f06a4f77a9bf62b44ec79c10ce
-
Filesize
1.2MB
MD5394ada5a42ab47a5d2024eaf9e7ee8e3
SHA1aa2e0de4e185f39f9dcb10209115b07097c0f353
SHA256a59103f3154e132cf8de84be52d1d9b6c9ba6c956bb592cc2763cf79a5ea7f58
SHA51290f44bfca88d8ed0323df617fb49470cd2d772adfdb5eeab992d594663284eb219cf6351f5963d2b65898b8fd706c28f0727773296520e6a866e25b822346189
-
Filesize
1.2MB
MD5066c66a14ebad65f870fb7611cb9c6a9
SHA1ec33a8293f96613129f3ce0467735934da5e8730
SHA256571e23afb94a4bf7532ca9826acd6895d79d3f5d610ba297a9d0ffc6ea0c5b37
SHA512c9ae3712b588ff57708ca665d54036fd6bcd4cf3bfed5708d05f64fe8ad8820f2604e166ad5639b9b39681c2ce74bb46eed19a207e99c63142de271b6679cff6
-
Filesize
1.2MB
MD5b4af76cf580e55d8dfd726ffed25b7c9
SHA1175d4aa13f922f40d7f19f9cf9a6227108ef638c
SHA256337fefd2e651904aef5221be6b1b8f626c670f47750712c9cc08c7a30cf89a98
SHA512d7fa57d7744b7396842558072c0e7cd87df1ba08530c4f1847f04ddf00757eb64b9237ad4375d2061bdd710f1b47b6ba8598fb6564423e75dc514ee3f8983ade
-
Filesize
1.2MB
MD5c7ab65608e713f4020b9d08d3d4d103a
SHA1fdb4ead4b35e1cc8a03852e0c72225ca6f7128e6
SHA2562e3a5deb02a71de57a19c9c794d47e8812e7d4cb76eb9f50b3d691b17c0a7243
SHA512dae7d9a5431f238066f84faf2efe8d1db4fc8549d4b81b8a7858a09c5e3b46815a3e966a05dfdf67c38419bc054de720bcc6954a5f0b367b25016d03d5778b28
-
Filesize
1.2MB
MD5b4b622e5285e0eee9f6ff9f7388c2b7b
SHA189451b806712b03b2676f3debba0ca1aa7d70121
SHA2562bceb74fc5d4d9f5ae20e06b9a8fe68017a4d8a2498481a65fd340ff4c67d272
SHA5128fc9fb9a96dfd84281fd73a38ceeb599449b14fb0c181b882f641c9c8461ebfe08e0ffdf755ffc7d11f5d6a3bc69a15d548d33d9f98e70c77b13c4ceb1b9b843
-
Filesize
1.2MB
MD5c74fdb3c614b6d280cf49d09471b0ff2
SHA1cd1203b1c8f5690dfd8d5d128770ba34fcc5ceb0
SHA256ccac503d535299cd59d8e0dcaadf3ba5113192559d58e6fdd317aee7a9a4dc3c
SHA51247fbbf0d9e3efd29cdd8538065d5b4c8807265a80310d56e15c88c19f533952c1afca8debd82991796be54fef8abff1eaa14ad44f591a12037ea5b732504c652
-
Filesize
1.2MB
MD591f12d80a2e225b88e99e13efd028e12
SHA1ebed571d5be06b14f4286274b5257217aac572de
SHA256753fcd83fc40a0714fe1217d9dd41e875274ab8b5f0b75b68d53f8d2fa1afc56
SHA51286d18121c8b31df04259998fec4fd049541e652724ec9cbb67799147ba0c00fea87dd847be5c440b6b475393bb5fae1bd9e69bb6a80bf155af9247cfd90d1cb1
-
Filesize
1.2MB
MD50445269c9bb30524ce8b5dadb4dd223f
SHA10744e41f6b583a9564b0e6fda5b0fbb9888215bf
SHA256f88a3c72b5d8771da74bfdb22848009a41cfb6aad97fc8f8bd770946bc674203
SHA5126882f994e155e4c19f0de30aefbd068a11dee029d4b39ff70ab698d795b7ebf17360515c7c5519a5977d01c4c88733c3fec91dc2151df6acd38c8b1658a9a09d
-
Filesize
1.2MB
MD5a750a8e0d6c288589c861c9a7c14f312
SHA13341b14c214246472e912e44ac7f1986b16c894c
SHA256ab397ee62f3f09de778d5b4d0873d0c91450d811ceae63ae1593a12fcca4dd3b
SHA5129bf147be781f464fd25eeda1704ccef58d73f16d82bbb2b920bd314ddceab841460ee2dd3e6e6121bd2a4d3a24113f48b769ee8cc26ee0ef3b072a3127a9b39b
-
Filesize
1.2MB
MD5cd1022427ef792cf4366045572c5bef1
SHA1d6464c1057a43807323980ac75198fc9a37f3285
SHA256ba3d4f49c72a21460ba6cbb3dfbdad11613c7e45d27b5709fd0a27f6787ca78a
SHA512cb025c5ce8ecd8fb10188d1205838193dd031f03aa29e41a09e878d982baf72cf8bfcb799cce14dca49385eb48e2069bda19163d9f84a650a501a868920283f1
-
Filesize
1.3MB
MD5efed3adf1f7e5b475b07cbb428206d00
SHA12277f24bcb1dc682ae2bb0492c843f7c52ec7287
SHA25655564eedc73575d7bf4c0c663666297f58a5a33e297241ad60a2028edb9af658
SHA512d1c0f9391542829e3770520bf7018b755cdbb35c9f1292406445a9d2059020db2d968380f9bd4151d3eecc3075ae24100f4b317ffa9df6fb313e30b1c8639b52
-
Filesize
1.2MB
MD5136907e41a6bece259cf21e239b4ba75
SHA145e721140d718af5aab7a8ee11a452b103b85591
SHA256393285a4159b148d71e9ff51c0b98c16cbffed18e32eb12745dad859c324bdb0
SHA51287794f0ad914ec110de231f9becba4837323c2b5949ad3cfe01d8e66eac140e4bd28cf88d379ade82a4b4c0d20e6d0dfe4c2165da6ce64127e1a9b07a7a3855f
-
Filesize
1.2MB
MD56cd1bbda600043886427bf0a693349a4
SHA1c4a1c647bb4564c4a8ad7e02631d9986808ad332
SHA2568798368a08c57d2293cc062a6ef0388eb912be0e60c486d9f0b4ad9c6573ad20
SHA512c5d95dba60469c53f886510e535932cc57aa0e963061ef90ce7415d03ddfe07d3b78cfc485a2c8411d2717560ec157289f757e2d7012837ac6327aa1a2ee7c3d
-
Filesize
1.2MB
MD5449722e09799946c45dd37e996f7efab
SHA186cb69fd4ebe90736af2471378877ef389f318a1
SHA2568364e51d7b203653aa2a9fecac6a373774dbf3ac32a38a6ddbf4f324ae12e5e9
SHA512f37550e6a9e19013683c1ca722eab9e034985d1e5e93d45d6d3451dade08235b064452ff0d2e3e5c775ffce514b3c99b1125b56507f9488d3a748a01a0cb7ad7
-
Filesize
1.3MB
MD5f765d81ffe49597b1b2c06f2078382af
SHA18471fb27420fb2ebbd621c5e3e8b10a454eda751
SHA2562b46cb71fb907e54a2f846d2cde71bc9e13e6b49be4b1bdced42d3fca5f8b14b
SHA51293afcbd2dfeda1b0d6c95efadb03a91d72883dea4c4b96551eac524bcb4abad1022eebdb469bbd488a3d91e12a927b977c56776f66fdf8e35493c1eac4bc8197
-
Filesize
5.6MB
MD50ef37e8ffed7a4d70d923d44a5b1ed72
SHA1ec1185ea7af28014b38003f465591d298069f13a
SHA256aef5fd9d3743f70637c9a3807b99b59840e1fa1de84a54d3b0de3235cd888f46
SHA51239a5be12f45753df89d295621e1eaa831a9786f76c6bc18ffcd90f253b49534dbff0b04c06dc19b779820f8ce188895168e512bad6efdbbb431f093a8a708263