Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 02:57
Static task
static1
Behavioral task
behavioral1
Sample
7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe
-
Size
632KB
-
MD5
7d4811b28f75404e7b666bb10651af50
-
SHA1
efe8751b4c3df9e6bbb336b0c435228831031bff
-
SHA256
e3e99e31c614ccbd645156b25469d87c139003814fc0975a1a530f8ece39822c
-
SHA512
a854b9d140946d5e3c545a155120a88ec405fc598275240c8feaf6b17f2ad8c4b942751f4da67678d817d1c4c0607835a839321af999c6cadf22d8858d7020ed
-
SSDEEP
12288:+58JKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:eJ1SwPHU8X31PfU17DhZy0lxHZ9/I
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exeelevation_service.exefxssvc.exeelevation_service.exemaintenanceservice.exeOSE.EXEpid process 1396 alg.exe 608 DiagnosticsHub.StandardCollector.Service.exe 4656 elevation_service.exe 3096 fxssvc.exe 4704 elevation_service.exe 2384 maintenanceservice.exe 396 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
Processes:
7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription ioc process File opened for modification C:\Windows\System32\alg.exe 7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8eb687aec3136770.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe File opened for modification C:\Windows\system32\dllhost.exe 7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exemaintenanceservice.exedescription ioc process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2512 2992 WerFault.exe 7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
fxssvc.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exepid process 608 DiagnosticsHub.StandardCollector.Service.exe 608 DiagnosticsHub.StandardCollector.Service.exe 608 DiagnosticsHub.StandardCollector.Service.exe 608 DiagnosticsHub.StandardCollector.Service.exe 608 DiagnosticsHub.StandardCollector.Service.exe 608 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 660 660 -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exefxssvc.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription pid process Token: SeTakeOwnershipPrivilege 2992 7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe Token: SeAuditPrivilege 3096 fxssvc.exe Token: SeDebugPrivilege 1396 alg.exe Token: SeDebugPrivilege 1396 alg.exe Token: SeDebugPrivilege 1396 alg.exe Token: SeDebugPrivilege 608 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2992 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 4322⤵
- Program crash
PID:2512
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2992 -ip 29921⤵PID:940
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:608
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:840
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4656
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3096
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4704
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2384
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5ba4c9a5e6bc2e29e78bb4363ebc98777
SHA108934c60cb10bbcb2780058def4b3af7c3b0010a
SHA256b98570bcd1c3a5a3c3e1f9855ca3a2a2b14fb0742734cc47af05c01c4fad04f1
SHA512ce05a204475e1c3e1bb13eac2ef6dff75d1af93108b1e00480690680dd879d4b1b22a3ef39cd9ea7a44cd31d0494264599d10a5dc0678126b81005ad08bb231c
-
Filesize
797KB
MD5a8c5170cf026f489437ad5ba667c50b5
SHA1bdfcfe27a0232421da78a834da6e39bedfe0b964
SHA2569ecfb67c4e0a34f74937fd2e11ca3670ae4dd38bc6c194fca200bac779c2a47e
SHA512a2b63a069c4d1659ea57aad5f31f0c32a8a16185325fe2a612e1ff8a2d510fb6343195dd25dec3a897d2fee0e7e183d51398a849740cbc3120a2933966772193
-
Filesize
1.1MB
MD5b1679cb3b3c7575f17103f2be0990296
SHA14c50c9a82b8244f1d74bb1662e85ea1e3c71a456
SHA2567902dd860ac525e64f6bfc341ea472cb554de59c15a0c5b8423d25bd05b747cb
SHA51298796fd924da0d99b0ca765f679acc0922b79dea16403147b612bd474e991935dffa26be8e787dff07a8f0e0fbcd2477ebc3f120d912023101ff8c709ed52436
-
Filesize
1.5MB
MD5f5b86ab74d90f4e77e26f4e00a676ce2
SHA1c47ee61d7b4843c93ac2222619f1c390150bf408
SHA256518b53cb35af9658e667f5af5a5fbd3d95fae76caf7ddf54144f9d12844478d5
SHA512d9aa0cba95b8aa83b89ba4dc7c9b463e606c01bc059b31ee2149ad66fd099c39d6cb104b83cf25ae781438e4327badd145ec05616625f7e3d8921b84bf6eff87
-
Filesize
1.2MB
MD56c573956ad3ef205b005294feb45fd38
SHA15859fc10c4843ed8ccfe6b456aea19f9b33e8692
SHA25681d70199cab00269e275d380cccb2900bf72983d768100481e7810fdeb33da61
SHA5121e252df910a3cba4257ffa05089bb01a16e002f516bde97d2ef5832e9afe9076185eef2626f1ca0bed492b3b45c0d07e67a153c0f6593f3d78a101d983d25ec8
-
Filesize
582KB
MD5be31470b86c6d55aedc9c7300a4bbfc9
SHA1384a3128f59469acb083723749a30c63b6571796
SHA256a981a5995481100c6463a3c5e759dc4a7fc7c107dd8acac4ec44358035324967
SHA5124a6618e6cfbc8c205dcb707dd2af52d1014a45ec1385ea29e9e3aec7548021d6d05c370d081dbbb22ae50157a42d680452b82aac93e1f09f32c20d345f1204b0
-
Filesize
840KB
MD586c96ad0492e87490eb2e99d8cda8aae
SHA12655c602e5ff2931df49794b581283a01d5e0054
SHA2566795815176e3f1836eadf6a5929ef30a69000eb05363cbc005a73930614daf27
SHA512d0df549e969ba9ae701c43435ac71473ffa178d71b60c70170ee759e4f89f9f455c01a6d016a8d0bc0d1ed3c4747b8cdb9aa719ab5a32cb43d8fa2255b282fb1
-
Filesize
4.6MB
MD501eac6b070c11b4444edcf7bc3f758bb
SHA1356d147729fd215cc17afa5c003a0c52e1cc4443
SHA256bdf1c3a2efbc5e1ebbafe60ac51f077839b69aa0037ab19f946a9d0039d06cfe
SHA512d4ea92a350afb02e69bef543a18cc1dff43c0d515ec3deda2de5d0882311fef83c8e69f403f86926215a7f54f55f73a21496d670febf9419e6da80473a788a03
-
Filesize
910KB
MD52cc7790103d417cfe8409095406f3246
SHA1e3f60e69e313d58aa85a05f31bac10f4a9d9f270
SHA256ce3dafddf8c83be8b818a405ee769f1c03a29b8b7ba351161ba642442c1d860a
SHA512852adcb281ea768d823b3cefeda8524d0f4efda0b94575700adad9771ab0c4b479f31b4658d166570e7dbbbf92924c4308104278192192212c325ba4c641d7fb
-
Filesize
24.0MB
MD5636b4cbbac161ea213376d9f361ac4a3
SHA1f8fdd3ac9879233c35f28da59e31cc3ba62d3360
SHA256dec449c17de64f6f4e669abc5436907d060846f8559fd97e9c0208e21e42d641
SHA512420c630d24d645eb6635148774e3923d4bcda7d713e5ad09f520ef2729988a2f6cad68590c87e823f1633392cdaa99b2b7332f784b06143d76b5c2c4c058a7aa
-
Filesize
2.7MB
MD565bfd4404f102c0709c883034e4a08a0
SHA153c08e610faaa9c74d4a8d622885a57f735fe2ba
SHA256f76b537e49125a03c9ad482549224776189b755dc3fa0644ce0536205f348605
SHA512995800989e3df6efa873926b3e3a5689eaaf0d2ef87b9133515b67a43caaf32c60e3bdb5841e88cf61ae0a33375f0ff18592b558f77bf85afad32a4c4621a44f
-
Filesize
1.1MB
MD5f5b8c85dcdecece315363aefbf6e2629
SHA136beeb3523e89a28a670a0ec3da4b407ac528e9d
SHA25606126f5f619e28b3a120efbf1d505a8cc5d5c970669839b583707decc5518e34
SHA5125603de8e0e56ec3d6f01e6579c3b9e5e433acb93ffc48b5af3ec7fb2078a43a30191bec2247306f61e7b21439caaa2aa548ed6dcefd8a10f689a4ce963450d3e
-
Filesize
805KB
MD571e7ecba31a6376dbc27dd98e5b812da
SHA13037ed5ad4c6077fe1d5a5ea495fe1e4324f6579
SHA256a1473d4955a30d7cad08005f17dc883e8ac0295c2f09989998911176eefc202f
SHA512b4d43b7af316f8e68eb131d404ce0169b8bb2b05f176e27d1563fad9cbe7dfc2446e325d6c63544d22e9be4fa115902b711cece6221ac25f3b6c6deb2b698d0a
-
Filesize
656KB
MD508aa14b98a563d6395a743b8ea65cea3
SHA1e36532966141b93ec0c738480dd27f5d43d5ea6d
SHA2561852169198efd547cf2b06779f6d374ebe9e8cedcbfd8a27d291aa9eee73a47a
SHA512486c594173cb2302b598ad127d180924891c823057b7b875f0b43cf82f61690ba2ec7a3a9c11feb402aab9d228a3e4d5352e021dec4e958d649fa86ab400adbc
-
Filesize
5.4MB
MD57dc5ef2dedc85d61e343e1900a805423
SHA1aac46393c78c1d08293366448012c39307d6573c
SHA256a533e5c3901b4f99d9bfb8980fa221d340a493c6c0f6c17c432e9ee607984c94
SHA5124477a88a01ed0ac50327008fa2b438cc75ebee5704413090b610d2cc8d17601d450ded4c163a7f7d9aef13b913e3fe498eab3662362ca27581dc6603f2968a04
-
Filesize
5.4MB
MD53ea8397f6550ae6f46772cc739485872
SHA16ea197ea71ea8a6f689f2f58665d23ff8d2ecd1c
SHA2569ed40a3e19c07c48754cd403e6a186441fe4d76f03df57db0c1b7fd2be0eefb0
SHA51210021f108e1f49ba56d3104d5e3e2195d9405b6e5dcfd6f2802d4b01616d85e41044e33110487b340e455f8b4049b7c9be265476a4793ad3ee2f4f2356e26669
-
Filesize
2.0MB
MD548121fc1c127fc9971119fe69181b5b3
SHA140400e4fb599bf399ba21870910af255d731534e
SHA2563f88edbb86a719b9010aadf0342dfacb8ae7363991b0827ca081655dab675a20
SHA5127c2adda3bb089415904733d41990d3805ef6f235f21323b37d2d454e5ad107eef28ce1ef5eed062a1dd60ec34223c819f6af1ff368cd3985860d14692e1b6a31
-
Filesize
2.2MB
MD566d4609f1b1df64c74393c59c4696750
SHA16fc01664445f2fe039f21aa642dfa9cb5c125277
SHA256d51c962dac8a929876207b10dce8a55f0e4425be63e2ce82fa379b0c43286f3a
SHA5126dde22aa21c97a6b6f71d17a69d611725823779cbe1c89adb4a7b676b29ca5f6fff3411ad5107378f00045c5d8ec22909922aa178b7a2fdbd3f7ce71cefd510d
-
Filesize
1.8MB
MD5ce6df6efde0f89cc61759e3f91b02bf6
SHA1cd1a9adfda5f58176783ef6c80a7649876bdc8f5
SHA2560eeee2db21493279eeaf2b346ea577d4d10d4d8513cee123498ac1278af202af
SHA512a74d28f6913fcfead76c5d15482c879427e19ea5450c2cd1a313082e78dee114f92983fb56befd9b6ae919acc0af144097c33f83b4280fb9bba872995224bd12
-
Filesize
1.7MB
MD5629cceccd16a3de60d4f3fd5e1393665
SHA15ab546427ef21c329f07a9ce7adca6879addbd2b
SHA256cfdc891b45c1ca241ef3898570c4da2ce65ef53d0f1415606fa76a0f5e3c794d
SHA51291fa4cce55de946ec3eea074276cc9473ba082f29ef664f79e639ce785453edd954a16f4eaca6eb4970d73d588d1bc3f62c304ff4780fd446ca976ea4946e8f7
-
Filesize
581KB
MD58e39b7d1eb3163ae7d688269afcdeb6e
SHA1ab907cf691bbe0d0f5b3e7856151352cd3378b87
SHA2562bd7864625c605eb8aedc1a2eb9ec5e93ec9bbce985afe9315ce56a474b0797a
SHA51290c5310d73c138ee9e6cd757a8eaaaaefb3201adaf2c2e24f3c73ff4489a22a3db6c9710ebec659fbd554fe9c2636a8246c23ca6fe905c64cfc27db43b39d709
-
Filesize
581KB
MD508436bbaeeb5235b249d878f651658a9
SHA1fe851882f3e027424c47ea09ad8fd52973c55ea7
SHA25649c3b3c7c65d71e309487154485d71f4daf30c21f8fcbc06b6527c7fbeff3cbb
SHA5127d0f15ad2bca9af0fa74b58bd9085a12a3beb4c26f9616de53feae4b2825bcfa144a68077ea24341a666eaf202459c753157cf2e43faf3fbcf620c178a29c60a
-
Filesize
581KB
MD5df8ca59ec5a5db713bbf0a69e7e54988
SHA1e02c4da111839919fb1891129e1866122d173330
SHA2567fe574cfeb6f16bc1c3e72f418c85cc174d58f5925142614a171d9b1b7158560
SHA5122b8d6b5a19cf44c3aca9bbffe062f51b296fc255ae09195f67b32b6bf267acd0393f79b0662ea75bf1f507262a8d7503ec707525c0364e17fbcfd55a427be474
-
Filesize
601KB
MD5004f1afd01fc57dbb20b152c7c9c617c
SHA1a77d73f16ba0c78630b5e0652e4dc180ceb6ad52
SHA2568be9d3e1313b3908fe44e9f1477746f070a54803dfb69414fdef3ebd949c26bf
SHA51227f05e3e9452afef7b3068a2d5c73b9459edf74b6260173d64336f5df38547d568fc9aac244437f37356f49986e75698905c2e7c4d16ea42e22c605bb13bb798
-
Filesize
581KB
MD5f126ee606bb7d7d867bf7e4ddf3bfcd3
SHA1e7e51b769ebc04551ab4fc19193d1d621f660f69
SHA256c7409df4c2cb751b54ee9866cead17fb0b1353111b21227bbfa627987987614e
SHA512d39b8061a8648b24bd22d722022f0d05d37b9fe9dcb839157802c39f11face036596f60a9c1adbfab00c1cbaec4b9ddb12a5a94b1345dd93b1be7ee4c631e2ed
-
Filesize
581KB
MD5b70fadd139c65b0c06862f2a0eb8ef88
SHA10ff06193ba8eb39337892168715d4becec817348
SHA256f956677aa55757553864931e5dbf437271dacda171af27f58b42856ffd4056fe
SHA5126e69e074ff8416d07d41234bd87b50d8341dff5f09d1d0ad896f7db9439876d37ad484e4408b8aeaf3f3e4494e0f56bd624ecaf2c273df4624fe17fe4f3cc312
-
Filesize
581KB
MD54cbdb05400b37467e227920bbe494592
SHA17f5031ef0e680f81b3d4ccbde8e91c5f36a415f4
SHA256660c1ce3d13f813e365f4dad2c1a45a40f24fe6d302ae9c7052ca53e58d5236f
SHA5127f4a1e9825f1b5b069f28168d449fb7d3bde65bffd64e8f1d959ea1aeb0117dc0a74dfc04f482db52dd81946c647d62366254a078e8efb4c8037891858105fa7
-
Filesize
841KB
MD5ab6f8bab14dca31305166bc7d3dd1e88
SHA195630d2470c15cf3c6406041735312263c0348a4
SHA256727e4b656635fae114776526e8eabc8f07d2a6f319d7cce10df0cbf5d080a916
SHA5128e2746e4576253b7ee6287acaf868058c98e3efc98868d729d420ca234e025f0a87d5a5b4a6177651100d51873b50a576b0b048fe80e39edae692b9ea0ec29b4
-
Filesize
581KB
MD5b545f3b7841d98e380ba85402932a365
SHA18d06e95c6a7b05a7edb3b8fbdefc436c83bfe7b3
SHA2562276aea7a025c2e78a6517c05f9be599a77249b133ebb228a1102309fb8c4379
SHA51231605301a5e35e3f5aacc45d1ee9d189c08610e4b7dde9608d9a8d7eb8d390c10124c7a6aa3cf57deac6331c5d28b276be87c59baf71a822ecbd7b8ad71d2ead
-
Filesize
581KB
MD587dff4a1adcb78f3a429c6c63fc6fa66
SHA1ffc517c3a7db30b8b595ec8781032d1d6d72ac3f
SHA256fe29a02ca86509a65b66956f5bace8d69f1cbae88eb819986433cde242527fb5
SHA512ee325a6eee806c1410f8771eb83f97d202e4c01596ff1f679140e70fd1d2f455c6a9ebd1996a6b93778111d48dbcf52b511bcc219b26a52d461e1d6ad6ab9739
-
Filesize
717KB
MD5edf1c0cc0c58bdc5d52a977aebba1fdf
SHA1f36356d54a8bc413499dfa2645416a9ec4d418a6
SHA2563e01cdf5b2ce117270f1f7b00409b20a624e1b62dc7ac35f6c8090c97ae4501f
SHA5122a23d5216cfc33ab1662d3e9ceffc4b0e926bd0a3cdd9d4bfa440affff5aebef980edac60045be394b5557f62248f3658b8bc0cd5bc3e7237611cac5d483996e
-
Filesize
581KB
MD52a986c2fd3bf4cbe906a764b0d584b6c
SHA1570ea8b58817348a95eb42ae53c0986d20baee2f
SHA256dc04c28f52cf31c616bec34afd2ec6ed6917b4626d67dd129dce71e70bd625d6
SHA51278b343e6302b5a9f4b4df4ec56b1cfef62f036bf0b0109c8b30c59f607814fa4988cb2eb4152ec769b01773c1ef8621ae5f025a81198de91bbf0208951dabe9a
-
Filesize
581KB
MD5d9bcf8779893e4de5c87e84be1ab653a
SHA13e74901d3c2663e1009e51f826d431af3e7f58d6
SHA256d5600c2e29f976c0104c6b50f4684e58327e7d75b58c90c1575195f562303b91
SHA512d774d1616047df2d1eccf581d83677e270ab7a1d7110f140582de75e3cceaef3fbd62588b5a93af8cfef86fc2abe4254cce153debfecfd078db31284fb7159cf
-
Filesize
717KB
MD5f8b9d8a78fe6db4fc6c5a77e42da67b6
SHA1f2052188dae89e8dc93971696d8d05a1e39db8ff
SHA256e7e28ba1a73e5aec99f7946e32eabed2dcd06a00d0b948902fa000e468ff2e09
SHA512c06b5f5932101935105dc760244c1a48b95d4422033738f593bec93000c94c4c08955d1a441308affb17f180d850760e9f654c179444c29059b154982c9bced1
-
Filesize
841KB
MD544e521842c3fb7baa2f670304693c650
SHA17a5c2855f0adf3acd7eea61520bdbd1ef95fd8f2
SHA256a7f4d782873bcd0ba46bd499e5a429499c5b421b030bc8dab60065b6df7dcb71
SHA5127955b15827045706542f2122027a6356da1ca50c5abdaa1d4dc6f811a47c6cbf8c9dd8e9f4358be8341743a7cfc65a32d6bca13c21a3bb4f8fa4bfdca989ad63
-
Filesize
1020KB
MD5de6cbcbf6f405f3b856924402b618f08
SHA141115d9efbd42dbb45f3df0221080926e1d07fcb
SHA256c58f53c76e316ea9a5bc07ec815b16fcd3ab181c61857df6740332f529e15a85
SHA512a4cde14b2adfac5d30e7763afa54f829a680edf50a5ff73598b21ff00a05c89301c87f193ce4a85b90c06df579ba6bd2deb1dcf68eef12935f7a195f1c31cf62
-
Filesize
581KB
MD56bd996096e6428ac0d20ab5dd2a72c28
SHA17b5760617e542832aeee1202ba32f455bc4a7005
SHA256af18071e38b3692791a1087ccb4c90391def3151a3768887722ab880bcd0a6a8
SHA51233c280f7b8d1a129689bffa48cc9c374093d90b51d1f93cdd638ee47f692c075658ca9802b8c6aedce82f7f928b5b60110f5c8be2510aef5a22e1fb95b4db7a7
-
Filesize
581KB
MD545401d6b5910aafc06c75824741b15c2
SHA12e48c74e4ed248edb1dc69f2092af21f9bd7ba03
SHA256cb6ea4b3d0788d863a40dba7d8a22445c34c32271a1c2d672e5eea667840b928
SHA5120ef0187fedad874a174ce133f904449166d64bce6304e47e157098508667d1b917e18a8091d34def24c146dc0fafa75e7f5818918fec9ad0210b0501c9293987
-
Filesize
581KB
MD52c6494272f451576685533fbc7afaa42
SHA16856ba111abe51c6badc0f40a84fbc603fc33476
SHA2565862ae918f5174319964a37db2d30a2da7e3113a85193de12c1c97cc7a619678
SHA512fc6b70038266d775042e0654787f3033986560ec4a18ec9d3c5b065c6b8f135b6171f0a33a7d9ad254bdc72543253cc3f3226e0be2d190af02d73a4cd3c9aab1
-
Filesize
581KB
MD5f712f38f0c48bdbfe761487d77f6cef6
SHA18dd74d3af36584e7c2fb053a882dbcf4c46517b0
SHA256f883116a1b052aaca7cebe1e28bcf32122840312116096c72b11c0b1a8900f54
SHA512a52b7d773ec2feef1d976828ceef61dfa90bf4d7aebd1a42f348b5e0963d9334bbb7abadad19f8e8afa6a4e5594e6a1efc7ce7d24617771d51714f360b5ac69b
-
Filesize
581KB
MD50b57635994e1ae9038242a2fe3719b0c
SHA12588be810afbb367f0478628008b01ea487b388a
SHA256341290ed561734a3445b754f83304b81e2b9710bc9c8cf55a259194ba4e9c62c
SHA512ccb0912d91d1e4416088fe1304886c65c1faa54f4122229ed9b288fd6bf620cca2d7f99b70298b847d06000a5e64f041ca9e659f7d1b7fdfdf498a34ef502336
-
Filesize
581KB
MD5bdf39bf023506eedbd0634d41cfadefd
SHA1964bf085a86218f1683568d3e27fd0fc324ba6f9
SHA256decced4a87c78deeddcc662e597fc4c41dd6cad1f575bb6f66e196aaf4944d97
SHA5127ebcb80db1ea851314c120ef14bcc695fcc1f5fca880d7cac6afe65da0704227206b6de290a26b1cc3c5f72740d7aade4f3849065798051e2129cc755b33d031
-
Filesize
581KB
MD57b531fd796a7ef80828afcf6cfdfb3d6
SHA1f2e6b63a8279495aea93a71ac50c8cbdf1dcdbc0
SHA256e55c77640fd4e681be8b548262706f32cc93bd5518bf69081bc952f01cd7c371
SHA512d6c715ab590eaf477beb766d75857b3714e67e83deab5376986c531c62e784f56c5aec25f96f5b57ed9e1caeb31822d8a72c79f929d8c35d322fef96cf1f1846
-
Filesize
581KB
MD513e88288a1641bd13308c04228a92db3
SHA18493e5c2031619842289f01147878bca6e118ec6
SHA256aba04c13fa7ea9c17922039c4abc43c99f112c69b18e2b98e92d0eb23be263ad
SHA51225dee5ec0ea9d26c0f61d4e567c215178838bace06f5e32a9f5fb1f4d9470410bf7bdd5879fcc751305653d705557a30c3f48f3c84e0efdf4ae0c64e577c58a4
-
Filesize
581KB
MD596d95be244b97372f81049f849aecfc4
SHA1c730e544fde73d9b73960d05a9bc9bf2a675e655
SHA256f8999e7479a638b17c91298b8628cea38567b0536f93249f4efbf822dab4e15a
SHA51235b3b3bfb6f7e7a84cff4fa28b5497cabb862f2a1538825320647a6dfbc5e910f59f4fb4a4306a542eda6df0f653e49abe3e8f59a81a21a66a0d874d1cf28c14
-
Filesize
581KB
MD5a1c44a3439a8995acae9c3d61e20b0fc
SHA1a5ca3746ab0b7d4895f6e72f26c76a8ed1de9c8f
SHA2561fdfc951d2caaaf8501d80c3e28570095adebc235cb6d07fc24b01c0f69f57db
SHA512f97ef20a6c18e0eaf7d2cd75a56a63d15258647a88853965bdf793559fec22d075424b2938125067634e317e30c447b12ecafc90fe797654b855916b0410da41
-
Filesize
581KB
MD513cb767b5e38707f7edc930870486538
SHA15d5746e8caac9c925a2781e0092fcd59eb342fc1
SHA25680d7dc2392d409503b0190e592e9490300e203416f39ed834a6b322730d2112f
SHA512853c444c2ff8df4b8c7317380d9f210d5172c2d2baa9f4a194e2eb7223a42a6642af117e1bb55ff5142c7574469646c6b204531df58514c3dd230adbb630d961
-
Filesize
581KB
MD5a10cb971b616492026bebdf393b9b6b5
SHA10de3c6b32027c7c1b7c180196d848ceafc7eac85
SHA2566655bafdff0c93d858e0df9fab1760b6a85f587f7bcd1911d5d519c4dde32e9d
SHA512c1532acd3a59bad3b5826aa73bb052b0567090b44296056e72c3d0cbca5fb3e2a1f4c0705ee53c4d229a1cfe3080386dc4cd5c40c88739e854ca7c6ea49987e3
-
Filesize
581KB
MD5afa26f50992f3cb103dbe5311b09adca
SHA1834b728aa25bc53ed158d41a2a47561533c2d635
SHA256033d646777b02560a4f0b6b4e3faa355dcdd980f8a9ed8fed77ed91a1f5ba4da
SHA512d40f32788cdee682246b724b7c95bd95843ae31c18a55472cfb6a4f5387e7a6f35eda2845f339aea30985848d5f8632a1bae11b59b9f61c1f245c1457be48ed4
-
Filesize
581KB
MD53dd563ae7dd8f79209477ccbfbe5f7c4
SHA152284e5e257954ceed1c18ac9eef9c3a48424684
SHA2568e19c39d3a01bebf51de3f83fa7388dd2d6c6944e96a81912ab28e8dc9306423
SHA51271017a36f96304885db4acb59b3e436e561de494e3440db1e52113490a1d83f3c6b5737cb4eb544d26e346018ec86726e9aea474284bb1704acd3841c0a1c2e8
-
Filesize
581KB
MD557db1127e07bac1604a679ba004f1a30
SHA1699fe969caff8fd21a1c583e8ecb1904b4f0ff58
SHA25690ce753d4e21c4931c4dd0afbf2750fb124c21868ce156e558e8a0b50184ab5b
SHA512ad9fabf827474b8d03a39839a28284bce5add767574d3fbc2a5bf0dd22820e6964e70e5827979fbc9469e329d245d95e59c770d90d835ce8a7f73b8dde3f6004
-
Filesize
581KB
MD5bb33139bf942b975a6d86eda568699d7
SHA1120080fece47d90826bd5b623110084c9f3ea64b
SHA256d2debe867ce1b96b1d81eb76aceb94359106fdb1c626d158e9c9d2725fc29f4d
SHA51228121d4dee59437e048576c11250f36388973c1600711ed1c0228f87f9cee95d20111545c69503198ed11f9b57dffa5a500f73b0479238a392ce6b1935dc0d70
-
Filesize
581KB
MD5714b3cba0a786e1c624b9d4f12cd8829
SHA1f4059fa951722ae3e32715badc771e4a7b241aa9
SHA256721e5ebbb6146953948e46041ca3a789f29f7c28f2ac8efe4298800930f95ed5
SHA51239670fa876464f9954191a1c403bd4f049ecc890b4a7bc00a186a289f792b338eda1a89f1c0c76cb4bf9bdc685d77c912161981263ec5b7f530ee748ab59ac19
-
Filesize
581KB
MD585dc4d1ab6228bb29559ca85dee19b86
SHA1de04d8b28daaaf763c91179608cfab57736f3191
SHA2569a9c7b2064963a3202fc4dc07189621124fecdc7bd6cb2d87e410c3bdf8fe1d5
SHA512f79952bed5d91934a9c8bca9c1e43fe2a6ab8f705989aa30ed6b43c0c7426243bd4feb2b7e916b855837cebdd3bed7639275e239700720d7004b3c0918977222
-
Filesize
581KB
MD59acfde6ebdb80df477572fc645ee25e1
SHA158aa633398280725fa7243f9b69b1b60ff8727fb
SHA256b261b9a3d9a3d366faed99a9d71c93e01dc8212328fde6a43e9a1e75186d3410
SHA512cafde77075904be0a5706af2db3267f97ec97b85d934f6cbe6ab1a81dbcbed3be90c50ba1c3f44c43e6f102bb944bd0a69c87df74e6c6da7d2162eeef3973463
-
Filesize
581KB
MD51a5ffcf037b0bfa189b12aa6940379ad
SHA101b915b77f429e92048472d5aa2e34dc0e4ebc51
SHA256c8108328af7ae3df5f1e48bba9c7c64f35d58c2777050dad18465f188cf67776
SHA512cace5e9201fa8cc2d2cc53f7b2d537e5f8179ad60e06ec261dbe2da499c49f8bc84ccd564a10757a776e90b4fe51a3f60564ace10bdf79a7c0ac7bc8dbce71bb
-
Filesize
581KB
MD545b02f3278b3388d4599817803fcc812
SHA17dce087b4596e07e15b78f7ba16173b5d44bd0b9
SHA256b8849087d1624f2a16a9b144eca8f3d4a67995b83d77702b8b985edf53fae96a
SHA5121a4392ea2c0900f0a5426428a2a12c9c413bffe99c18252b410c9fac46a429c5cf90b84cd333da8fbaa02c3ae250c318204087a671feaa790a041369fd6e568e
-
Filesize
701KB
MD5bbc55baf098e3e8b2541ebc143907b76
SHA1157044a3ab64143fd2295e920ec9fc54c69c7e91
SHA256e662fa85d099c50978197318d09a4f6b7c777db403f3799ff1821661492fc8ce
SHA5120552ce2ad974bb095bbd9cdbe88daaefe9aa46fa48948fa67d6b92c44aebf2ecaacc692f987a123b38a9fe1755375032b6f29f9f6fee8490bcfcd2b4477bd5bc
-
Filesize
659KB
MD59f1bc191d52070abb9e7c544ea16209b
SHA1d06742b5e9f6a821c73209d44a77436177b057b1
SHA2560c3bfce6fda68b4fb4a7c8473306aaf13e3d3a07fb81b8ac3bcb462634841d29
SHA512196d15bb1ba8c6fdefdce837bebc1e1a46005e67db7b833db2f7c4891c22fb933f76ba8ba3fddca9c5a1a60058f747bd19c1d3a27bbeedc8e6ae7c70878cb116
-
Filesize
1.2MB
MD580e29a68075fcd4fa19afb4db67dd294
SHA1827415cb82b684316ecab30edbb6d8bb92e08801
SHA25639bdd276005ab930f23c675449d035d1d24ef117295918102c1e489df0d8acb5
SHA512dbd9dcbad1693d66153722fa1d227923fffd5af94a367d0686029d3d11c2a69a6cea8f13807a59f33d548b56060f29197c7b14353558ab1b5de3bad194abcf8c
-
Filesize
661KB
MD543794df120fc71aa4a58b29601da49cc
SHA1d6510cc3c3a3e17c5aabf14c9184daf9c93dfac8
SHA2564ce76b01c487524606c176d5042d4b492de69d696e6e84a5dd802255fe751482
SHA5121977da907809cfa24185a0c5e510605ded00fef7b76d526b329d444ff9b4190c588e0a9d3f0ed147973b4976da460f215c7853271978199d912a3b881d5f5610
-
Filesize
1.3MB
MD5242c5ba9654f460c9438023039a065dc
SHA1e71662bb63ea66d6f10d4335502d1c7e3ba95775
SHA2567fa84fa0ad40d53069c9dd60798d9548a04cf718328183a0a443b4d0972b90a2
SHA5126a689f0757253390004313db647082dcb6e488db554dbf913060091401a13d1216ab0d952aaa6dd49b7916ef390a1694ccbe76a43d5321682506423bbeb385b0