Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 03:24
Static task
static1
Behavioral task
behavioral1
Sample
81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe
Resource
win7-20240220-en
General
-
Target
81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe
-
Size
805KB
-
MD5
81e28232e0556eb0385f23d2900b3c00
-
SHA1
0533aa69b50cbfeecb4c76ba81936d43884f8d06
-
SHA256
11eee46ccd42bb8b8e7c93b401450975770f7b7ab8811d4ec3dbe3ac90a4f2c1
-
SHA512
b51eff6bf2d94816dd45003d8bff50e9eacbc42ee0c537e01fdca081a72bcccf3c9856061f1ad1f530f5fe57a3ae929f279127d2ba042f46017513a45c98f3eb
-
SSDEEP
12288:HlGp0BpeSMIO74u8k7UtnzPgGeB0dPoIlaNyF/ofCVGGfX134R9kMKy:HXHet/HU9zPjeidP1Yi/dGyA
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exefxssvc.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEpid process 1920 alg.exe 1320 DiagnosticsHub.StandardCollector.Service.exe 3588 fxssvc.exe 4020 elevation_service.exe 1316 elevation_service.exe 2928 maintenanceservice.exe 4008 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
Processes:
81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription ioc process File opened for modification C:\Windows\System32\alg.exe 81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe 81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\417a5f5192be0f3e.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe File opened for modification C:\Windows\system32\fxssvc.exe 81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe -
Drops file in Windows directory 3 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exe81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 532 968 WerFault.exe 81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
fxssvc.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exepid process 1320 DiagnosticsHub.StandardCollector.Service.exe 1320 DiagnosticsHub.StandardCollector.Service.exe 1320 DiagnosticsHub.StandardCollector.Service.exe 1320 DiagnosticsHub.StandardCollector.Service.exe 1320 DiagnosticsHub.StandardCollector.Service.exe 1320 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 656 656 -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exefxssvc.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription pid process Token: SeTakeOwnershipPrivilege 968 81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe Token: SeAuditPrivilege 3588 fxssvc.exe Token: SeDebugPrivilege 1920 alg.exe Token: SeDebugPrivilege 1920 alg.exe Token: SeDebugPrivilege 1920 alg.exe Token: SeDebugPrivilege 1320 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\81e28232e0556eb0385f23d2900b3c00_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 6202⤵
- Program crash
PID:532
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1920
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1320
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 968 -ip 9681⤵PID:4628
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3612
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4020
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1316
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2928
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4008
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5b01e4b134fa4021325b7a913b6828fec
SHA10fcf4823a2ac58fa2f2df7adb276186804b7c5ba
SHA256d5785baa663f6dad85b9ca38841d74f310e40a63c07912ab9ebd2e8975b6dc0b
SHA5129f8d15bd30f3e20eb4661c75f5e95b3452e3001b813e20495a29c309284b4275eb05d1e6a8b10745035a7403f86df3588e22f0c74cf8b9f808411f9deb006c41
-
Filesize
797KB
MD5063d334c3da959b6e9610667f549fd22
SHA1419ee988fbafe739c1bc46dad6445114d3100b81
SHA256c31010f4178940bc72f4521dd6c205a1503193cf9d02145e0ad01ce8c48a38ac
SHA5123ccdabe8dcb46ad399caea800ac4bcf5f029c4273a0601a8139b562cdbbb8976fe04a744f1a2a942d78263820c1168b593efb2b7953bd2737b30e17d68f3d6a9
-
Filesize
1.1MB
MD59d155031f87321304a1d0523094db9dd
SHA15cdca02fb17e6a6c821cfe5e3f2a428267f7f84c
SHA2561058e3a779105203d72e3b3c2ba5729de83a7ca8cd37f7064254a5ba9f6f89c3
SHA5124d4e4cf0138969093453ebf24e19ed30f62b53a3da8588938fecf2bd97a5ebcbcc40c01832fe0cb80b3343cc84623f12da45388871a545c95a9065923fe35acf
-
Filesize
1.5MB
MD560ec1d14275c9bf597c402f6a36a9ba4
SHA1844fb161b46fd14ede76de6e9221cebea0dbe709
SHA256ab421a697d1a2e347e9ac81cc45a2711d00923ef289198d893d6e721cecce18e
SHA5122f871da0726ae1f1bad57c69bbfdeed980ab209093e30c6e078cbd057d65bb91b81df0b5406f9f60eee84fcb788312e060d6d837dce10090401162e53c8a60a8
-
Filesize
1.2MB
MD51f36a911a01002811bb77be0e479ed8b
SHA1aa66de674f5a48f3e017e97693819bc8f8b36806
SHA256812f5fd781395ed760c810155174cb227248a3f81d16aba85fb2e10b90f90e89
SHA512f7f130dfa73a1830f33c8a373835e19d0b7c5706689b60da5c16313862c121157658c6d886054ecec37ab622c2701b09d103db4665475d67c9bd7e53928efc12
-
Filesize
582KB
MD5f77a75e3a62d94ae9f7a727e8e5f3b5c
SHA1ac3bba69fb0ec014fcc30629a797771855634fa7
SHA256d9e6d63d3fd7f3e714bd068e6efe22d21f7df72f79cc6431e34e1c3db30af38d
SHA5123983a8eb4da341ebabce1330fd9073f779d2dfee4c27099dd5b659f51713e782153a13e8c38e850bfc265533cd5920ee2885e750a4bc9f0d6b4af5466e1450cf
-
Filesize
840KB
MD57bd21e94d36cd1094a17547edd50805d
SHA1a865bdb6ffbefb12c3c6785c49b911643dcd9e31
SHA25635556f26047d5229bb9d98ba69875f03c5ec932f3cae442d2caf1524b98da3d9
SHA512709586d37fb15d28255173ac483c70ea4d3fa958d777915ef085939d0a2cf24ed70a4badaa3d59386b5402a4a64acea82c0ec0303b202a9908232ba7f3d4be16
-
Filesize
4.6MB
MD54c6e08704b348829c77a2dff22bc3e69
SHA172891ba258497ffb697f9bb677bc744854e93b6a
SHA2565320562b3c00536af38324cf15c64bcbe0c9dec8a7d1c491ad06f9664a4f825d
SHA51224bc474f562020d444fb8725555be17d8c12872dc39f55e2ef70f0b45b76d1bb30f09f14d17cadc80562ebde8dae4528ad07a4cb583f2dd526a009069c4811fb
-
Filesize
910KB
MD557d2e266745c7c178fc448b7473b14fd
SHA1f711f9bbb289a2251b945cc42a6e04874d5a741d
SHA2562d0a2777adb9fe1811f2795ddb6e08f5a57350c094effa60298662b45b78f70e
SHA51296c9e15e582a968773fa5f62d3db99d8313e3757ec607013c582b3b4c407404c9b3ccf795cb9cd14a943143431605e9cdb7aa41db15ce2850c33ec6321fe2d9b
-
Filesize
24.0MB
MD580cff25b15222835b4c0c88d91ec71be
SHA1c47a5e80dec0de1e4c3750b1ac95d10a63377187
SHA256c59257e6c52d1914272f47771d41148f87b2280464f32772380fc02bb3e25113
SHA512e0a368a87786ad3279cce9e591ce54af6eba73760bb5d62cf6e9702df1c45347bb43d2e7cd9f7f7ebef9ba91f4bb823eae3d3debe72013dc37a7796db2fccb34
-
Filesize
2.7MB
MD53d80787f80f56c794b8e5fba53a17b7f
SHA12bba23eb16dfc3f3445ecb0fae280e117db38d88
SHA256815fe9645de4365dc436fdce61aa6d2a3b888eee6085d1e405412d9601eb67b4
SHA51292a64ca4b7fe9c765dc1238d37b64acff13df03d49a4310374ca5177e81475072c996ab00df3c96e11ac4cdbfccb5f62cfff246d9b2e111445bb252f760e962c
-
Filesize
1.1MB
MD578394f05687c56375d7d55d10b829310
SHA1937f8d4d1b94746a182f69239eda982e26448226
SHA2567ff3d4aae96e11af500186591760f43dcd060dcbd76021f5e8d5fa304d279bb5
SHA512e7398a375a8df6e78c1526bff049597704ff959d5d2bfde6cd926c231fedb6bfb4a777079c5284568c958dfa6b49c054b8003040538eeef3acbb859f73764c2a
-
Filesize
805KB
MD5100edde510f4e5864251810992ae08e7
SHA1271d9522430bab55d233308b07063a0b48b89e4f
SHA256b116393c5cad1437ead74156a99ac72cb5d3815ed0c00a314529d2a68e232e9c
SHA512395e2fb2af42a06888ac07aa5d301fce1ef9896a3d60d913a0c815457df787a513fb03204c1da86b6c59633759fd0926ab394946f11ee2504ccc462b085517c8
-
Filesize
656KB
MD5c740df4bfa5953feab53d60bc81009ae
SHA1b47717e5b046c8df1eccbad784cd7aa58f6e05b7
SHA2566ef9b5408900b24d828f5178cfe53849533f2af950983e81b67bce51689e1b93
SHA5126503d953ecc4c815254bf91d46d6ecdd38e9c8ea5aa03c24c595f3808f95246ba2841ce0f8508fbea8cf991f938878897372db1394e3e7206eaec940e85ad748
-
Filesize
5.4MB
MD5774af54017303f4bc27a10b0a558bea1
SHA1d58fa1d721b599e444bb234bbf3cde69bd04d854
SHA256f0d09782383184939b3837dd5c533b8aa35d644e474a6e4d4b40486d2172091a
SHA512ed69c3ca0cd22cdf02c64f12ea65b43aa5b9997de1d3a6be5b85c51fa825df1871a85c57c33505b19a2c4ea36c52e06cfdb83d970e3c37b9887b861c000cc0bc
-
Filesize
5.4MB
MD54b66ce8349d5e4c0d7e6a092ec74630d
SHA10addd5d8d783b6e89625662fd7caec42c1b8f657
SHA256548e3858954f602af9b9d57918d2353bc8349b7018fb41c9b554b7caf7657934
SHA512c138c2713a8c6954c495ecb59b6bb770f4fd47c4bb91bc2442d4560226ac0953d14401516efa805c925ee639221eb044455c26596385ce22842855cc72c0c5a1
-
Filesize
2.0MB
MD5afff5f7f09a8f761c95a7efb537f0b50
SHA1870b9637fd35519697e734400fbf706ac084f3e9
SHA256c2291d4322e26cb3308b0785ce3f5480697ff2e7f98cf6fc067a0a0fe15a8e1b
SHA5121b8c39da99e4b203aa38a0f1e27d82d3477b792f853538ff851807cc84fb18c1c361c9fadb59431e597bc59dac8e678abe6219723e1ecbbe39338a14f289c3d0
-
Filesize
2.2MB
MD59225c1231290ef1de73ccb7e26f833d0
SHA13b3a8d9194450b02896895b05dbd437776898b72
SHA2565e3524300a009433887c401a092ad4f34d0dd674cb3ea399dd55521caef6ece0
SHA51274c14b8500c591ce461530559b7d6c9852b0aec5f913e0aa0038acb9485b99d9dc884e2c1c6f897fbe9b587c0aee5f416762f1897c5d66b8ce32348daca27e12
-
Filesize
1.8MB
MD551b43a73321a7873631ad0efc66540af
SHA1ef5b6c99693c4a61314c854d0a2ad0562ba56098
SHA256ec313097cccc35e2f849bcbc7e1f43684b9aaa7334deb94b36226baf7d4ec922
SHA5122dcd4901ab854e52fc8ff926bd341621d8e54385a709eb42f66502c329159588dc45ba1559d084f54e4d244366452297af82ea4771895d5c6f80126500d37ab2
-
Filesize
1.7MB
MD591c7533ba9d3fc81173da0573253941b
SHA1ad36d26bc0ac164ab78922a79b27d098897ea8e2
SHA256d6778c5cd687e74f156d0ccda70dcc145791b5d5e609941c6c5ac13d214f2d01
SHA51262bc169bfe874ccb6ecc1a53d249d414c3099e11daf7b4048af156bb47565e71ae4975bc22cd817527c510af8343a91ca1f1a4f79c8654ef81395347945cac5d
-
Filesize
581KB
MD5c292f6757cecd6f35f6040f27816d7d4
SHA1f18403861d2cd17bdbeb57e24d34afdbac7b835a
SHA2563a0fbc982e57d4e1c74b53a3bb5aea9270d998c8d2b110a4b2887272b2e22ede
SHA512cc2ffdb896a804595c26523ddaf3182af96d35197bd38d7d2ee357b293e27e5cedb4f693f12abaaf9c082729dc9df2eaf3b97b461a1b52cb289b87dc3f1848ce
-
Filesize
581KB
MD5b1d3c42f77c3e40b53b880f258058033
SHA1e0283ef20db110890c4449e5ce68349fcf77a8ef
SHA256134fc5ca774358309901961831939babd857a5fbf8317376c74d0aaff698b7d9
SHA512b64a27d48258f3d4421472e4891b5ef7c1fbe755c2d8a5137c994f106851f275ebf42ce386d39033edc47871e441eb36bec238e37fffd597166e755bc134eb7c
-
Filesize
581KB
MD5ac74307d1a22e36b1592efb68e26ffab
SHA1ed510bb50a4473d5657cca0b7efcc0567f9b1f4e
SHA2562a883cec315cdffb9b485c8a5f120067b1a9714cf555b20776bdcb1ee3388076
SHA51235fc1e97dc93d96dc9a9e07f3c7d776ff81d31e7f6d8d07f8da9daa6bd023db8d70173162afb9482a2fc0339e9c3aaaa0a5835c71ed593d8c38fc0257b55ce7f
-
Filesize
601KB
MD53aa10f0e2b9780623b13f51460763c7a
SHA1a4e9158bdd1ba8fa017b83a661b0644adaff6b76
SHA256319aa8513d99e9ada0258715c32e90cd50746974bccc1407abc492fead8cfd6c
SHA512fce239621effbfb8af00fc16dd40cc97a8c4f8d37a105fbcd281c2fd54bc35b271bcae3d1bfd04d3f6b555eddaab09169346dc1151b10817c11deb3f60468f1a
-
Filesize
581KB
MD5573d51d6d22c9cba8eaff2ba111c3d1c
SHA1189d5195a7b2ed94cc88dfab5b280792fcec7b9b
SHA2565955e5c95a86d3bed75557bafa0ccc1d65d2d1ead0392d6041fc2edad7f513e0
SHA512eeb654ceb9d98f46942f935543953a5ba76003150ac545fe90209e91d962bd6c6037af1da12d7a182f4713d60db4549bb6074871e690ee9be554e8332775de64
-
Filesize
581KB
MD557c4244df8561ddc0b5adbedc7e679a0
SHA1f7e82acd6bf16fd5b57872557622190002c02a65
SHA25607029cd777fc7e926ce60adb4f008c630a76217273361193e04341aad01292f9
SHA512597b59f793a09623cbc061160807b2d7996766b5fbf32fa5b56c80193778669fbd02270e893f2cc69439aa039d9350bf45b5913fa6656a44503e0b45b39f4819
-
Filesize
581KB
MD5fbb7efd82a26f46229910f2200f7b450
SHA17a75066f7b17869f05169c3efdfba7c370b7ead9
SHA2561cb27caad39d5f8b1cce9e05488a9cfeb4935e29ffd4626a0efaf6c6f00791bd
SHA51277e37a9047b365331b454e7a9a2c72255780dfb95b67b4a347e90a4d7514c7fd10f57237075132ced7e3548dd01f7f1e59ff212e8979ffcf0e2c88b4b8e79217
-
Filesize
841KB
MD5a079515def0604e49634f50b70b5f12c
SHA11f6e2a4d2fce507d929c07c976d70274971d0897
SHA2561cf1d45e3af00e8f867f39f5b6990721dfeb0562fa2a62c3d153b7fa68bf07de
SHA5127cbea8a6247cbe3352f7ea697a269228a68173698e31902c6555e47682319347297dfa8b2b8eb6b061ab4f13c4da1f243e1b1c9c97335947010b4c50aa2d3685
-
Filesize
581KB
MD5799f0d8a1fcd0a6fef32ba3d09b1f026
SHA1b9ac6bdb4a1367dd48ec1f9e5b2bde2cf2f82877
SHA2568086f621db40a0f43e49e51639c534ab1ba37dbea77b6f74630a3b7669a3fcd7
SHA51202d84f0661c64e272ef42d8761bea4ef026958cae9f1a21f32d3c5a0ab15d9eb665dd7342368e4803af38d656dcea42cd6911a1b4adcc4bdcc590fd7add01160
-
Filesize
581KB
MD5dc42d954492db9c3fe8b1fb00a1bfad0
SHA1d6d652b91e46604b7df10ee84598b5e373b979ed
SHA256aebaceda47021fbcde9930a146e9959b82b8911787c603fbf31c6b9ffb242549
SHA51224cb8f7472d66d77f50dacecf08b7315baa056c5efaa9037ff6bc01bb2c38d663f2957df6e396ecc7a8272fb1845247576400f2c1599f0c17ff4305f24088160
-
Filesize
717KB
MD5f5c5807da4f1bfa678dec90d270fff1e
SHA10bdce8f0f199c5aaf5ee914352825f8f3ee59b76
SHA256c8f2240be239cc7d46b19c8ec9ace238f3ab2ed312ebccaecfda2c2dbdf91385
SHA512ba0ffc5da627452e11965008e3479cc6bccf2dc3458287703b89e99c4a6ea45fc60ab11e12c61409da804291b8fc6886ef19865ed33e33e429a94e9059a5032e
-
Filesize
581KB
MD5e6bed40ec54179041e35597ae9184c09
SHA1ac3a6b14a3363b944e9a996b208a3f7b45f1f152
SHA2560da1f96623518700bfdd77078fd893b128fc591860336e6a3a3647696fe9243c
SHA5124611aa0f7690ee481b7d20323792a26b57729104b37d55e7cc9f7c4604a895ca2b85f5f64b4cca20ede8562b17891bef2003bb7865d644ef1b6caf04b8f1eb2d
-
Filesize
581KB
MD5a40d4138cdc07799535b4f32eab7d9d7
SHA18416ebe970ddd1164e754893f1bcd84c8dc52af6
SHA256f85dd65af7d2cd7b8233dea80afea530d4fc4034e3d045c9e99a9e4529a4d915
SHA512cf7869140930f3bfe096c43ef90fe2ad123a1d3db2bad8615da6bac9a4683bed03ee137e004038f5182b85ccf0abef95fa02b72ad110e11dc746458900d10117
-
Filesize
717KB
MD53b4aa3d2139686cbf8766c1d4b860f4c
SHA1fdef070878e066038f1a25f67a3e8ac6a3f658f1
SHA2563524f2e4b32915375199bc1c86d426176efd5c719ee521eaa65ac73ed848e3b3
SHA51286bd6efddc509b1a0bd001adc1dcd9dd78b8072e5079e953150419ff57ed60cec727aa28048597db90fcf8de17ea7edc65f5a638409d37ae4bf7fc19d68843e2
-
Filesize
841KB
MD5c6f0e576a69a2a714cedabf846ea01a7
SHA17941289073077e49a5ceecb8de4af37855dd1bc3
SHA256b810f6ae8210501b2d16b1f0beca8c864abb4c0fc53863cd20020ab78f57083c
SHA512686fe75015b75b28dce12ddd62aafaf0d32944da381be927f44f1342068e1a13693e5659f7a846c48788e1bc2cd68639c701ca86bbd2c28eed29193886ae6231
-
Filesize
1020KB
MD512a308b756b8de73b6cb512471c3300f
SHA171ac30975655b8918d8a3e62c24ef5e1b4922a9e
SHA256bb05a6c0c2734e4969891c8f3cccc2e715289eb4b21148f44f91a74e203798d1
SHA5121c78204e7f01e8ec5a34a05a9d2a3fa4319357656e18731b1b56dd8879fccadfce1956f5a4253d961e544a6401035432ec7bd8a47202acec6d7f0531cec78a82
-
Filesize
581KB
MD55781ac03978445cc55e84de1e0294a89
SHA1675166080f605a17acd02c3b762623d904a17705
SHA2560759fb254f54f7354eeaea8b2ded5bb5c20113e3cb16a101886b13f37769804b
SHA5129b10209866203ef03757bada6d861c41aa92a18288389e2f230eacd244f9862d1df55a0437c29f59059c977e7d83ab1e25306ba684c82291f5a21b6499b361fe
-
Filesize
581KB
MD58a52d5444011b85b2221014bb632fe82
SHA1c92d0e8361efb15c10ec44bbab76ed268a7422b4
SHA25604125dcc34b81951424b3abcd648d3ca671c2b80de549a6cbd78641ff0cea116
SHA512634ee864e39640c8724e83a7422186114db56454d77f9210014aed65add141d7cb0bb8230d85c907e4f550fce282dd90d2eccda08f0dd557ec6ac339be37a8af
-
Filesize
581KB
MD5bbdf085a851ae94dea1f5aa6e18116fa
SHA1295561dbcbb8fff4c76330b3bcdca3d01f126f8d
SHA256bd06d4150608971f81257353bc2649d05a7ec4bfd484c172c8a3708c55576d0f
SHA5123f81f18a5df9075279fb43dead6af08d225558eda3061a2523d0ec48d0b6182c9e08beb29651e6553f16b0a0846cbe52aab303131e32ecb281047f972ec818df
-
Filesize
581KB
MD5da8667899eb799d2cda6ae23d285504b
SHA17ee2a45467c26dc329527af02ac8261b7c07f4bb
SHA2569011a01f6711dc410a1582e6f6a9f503dccd4832b2ac82a957639ca863c43e6a
SHA51221034b5e750cdbac833b5428d7bc654e071d2c77cbd1f262bddd29f20f35c9ac39d4f53dd26c07b870f3e985f86c5be8d9c2110e100136c0e678e924fc26ce3d
-
Filesize
581KB
MD5fb139dddd8c64890708e47268e46a159
SHA1259134034cf0720a16150715daf31221fa6cf13f
SHA256920b0066c99374c00ffbfe240eb651dc445759ec2cd69dab66ba1a580d9537fd
SHA512fee5cf69f3eec2988131babd683902d620f5f7416fb43fc9177ea598c97a41996571907ff4858b77cb8e973beceafb93c4b0cda2c4cb7d943bcaf6631a3c8e56
-
Filesize
581KB
MD5de59d52516d921b88b76d06aaf6f3585
SHA199d483a926e401bb2d95ba15be58ea18b550f067
SHA25611aa513c3b4bf098b74affb569d607a65ec97a64f36a8697e3c4b5c17f42e7f8
SHA512a44018a80408ba58e0e53d6f7b979127246792e30cda26ac78b31bdfc6769df87fd4713aa472021cb55dc2bd3b776970274ce932da6ac885f929cf14e8ed9c52
-
Filesize
581KB
MD516030f4dea3eeb236e480f9c1d8aa545
SHA1bd15e627571878614db8443dabccb04855a0a934
SHA25637051dc7401dfa2e1cd996bef4d1ebc746392fc49bd36e9e4bd3cb493b0d4631
SHA512f3291710fd78f3e18ddedb4ea18445566ec53b09d4479dadc518e2ac895d704b751ec1ca6ebd07257cf4e667c625a470f302ca4ac4358330a703d6d1d5a7e73e
-
Filesize
581KB
MD5feaeb00b22dd4f707d0ce4d1b1da233b
SHA13cd2484cd4233abdc3eb998c2f4c6acf8fd6997c
SHA256de8afda90d0b594aafe5359fc67ec0a2a71233e4c7f038348e4fce4cd9146846
SHA5126717a1bcf970adea4e5ffeba4df835f5ea4ac3ef1a51b64cf76562bf19d90e4cf4fa739b1171c6dfa3c01d847404d437b3a4134468ec7701be6e71c33ff93543
-
Filesize
581KB
MD525130919962a7119002804abeebd6573
SHA178d66b72c24ab963b91140d6ffdfd966f40c750d
SHA256715fc38d6b7b3c8c4aaea2f16c88762d07253e3ad6ca8f4f2a10eb3f7efc630d
SHA512884aa1f1eed642e86fd83e55c8ad0606138c36633456be2fc449d2190763d108b04ff28da970e654ad95f6e083a0bd8f571fbb16a46f2536aa849d7db9b9e4eb
-
Filesize
581KB
MD5bbddbf7b98ea9862e8dd0e9012ad7444
SHA1d77cf9dacadab684a780d18a6e3f7ca54bc89fef
SHA256b48cc09be10ad4ef96301a3df5fa6ca5ba5395fb4f0173b8b1c5a17064941c79
SHA5127aacc9c721edb33e6b1bd4b9bf7a92ea2702aa0ed072cedf433827445d92ec82557e95a0a2bbc33c5cad72e998ce9c423091070f5ca3da95d60cfc7e59a9d2fe
-
Filesize
581KB
MD5baeb9d509b637fa7364c8129f51bf835
SHA18e4072391e85ccf1f3a70bbdbcd16ba78bd95005
SHA25610caecd46fa1491f192e2f0127776d70b1ee74cc75346915c8d19fc663c13ccf
SHA5127c2b74061edda5decec9f1a5ea87e648b6c33ebfe32128aff522a337540c68a47a81d126ee212f4438bc6d945412cd2140530468c23662494b3b30009ab18b7e
-
Filesize
581KB
MD59847641801b8356f16ee983f22579761
SHA12d9123b705df575c185781d31ee3e4a52db8bc92
SHA256ea49d4841e63d1dfae424893de72fd5f983a679b2a3e6a6692a312d188261460
SHA5126d9d8e6dd0360603a8e9555f54e0a4a2212e16b25e159eb6af14c1f3a2fa55e906eda0ff7e2da7aa6c613c23c03f13efded3009872ec788d4a1a73310846c4ed
-
Filesize
581KB
MD52bd98cb6de08a382e7b062649eb707a4
SHA148d5f75493a2188fc83e5c3614aabf2b6d97054b
SHA256098d0e2c527d886dabee4f27ce02421565c1f711af2785a1c8879b5c4549d55c
SHA512781249f01a0fad3026f1f297b09ae0970e883d9cce89813a609dbe68ba822cc49396608bf4cd46de11b7b75593e77e8d9c8f2aea6e3534ac53431f2571e92421
-
Filesize
581KB
MD5947580a0a9cea3bbad27b15f40d7853f
SHA199d8d1070f5e03e0d4c4ca91206b6dec6a95764b
SHA2563ff5b6346f01fecf949746869247042bf518f9826334d4565162699332a4f816
SHA5120bc338b73564f3aa42c21a90e2a4c2ad9907eec0c1219f570afd8400acee84b038de805d23424cc463ddf2b61ff7c97bf56b0d8c9d3d7d61ffe069ce98fdb272
-
Filesize
581KB
MD5ce7268547275dcd3a5e185d9d1d09ffa
SHA1aba30c48a8cc452802c4ef2b7c520c80c5b16aa2
SHA2569c6f72520766fd60f4490b1d35f961d9adc96838ff34aa3ce6d66b3dd79b4056
SHA512b25fd2d0e3d608fe69899f8b7a01cd3c3811d8c3e59ca71bfe8a157f972563703ae59aa37624555c1ceb6eb410cf9d17c0cd545544e207fcbf5b4ee354303cd9
-
Filesize
581KB
MD5eef878f8e99f0a018c12c566d59ca0b0
SHA1c803cf64f4b118a7cadc7dbb5a98a0045d46246e
SHA2565ea75b50da0f44472cb655ec33108f24c7c72265b8bd5166ad50729914a05bea
SHA51268e19642190fa21f3c5e286299614b47750378b789247b5f69ec6e673aab040390309caf4a948f417f6329fa0b239357eec0d94be4f405529272a866ac3c874c
-
Filesize
581KB
MD5c2283ae9681f8ea73db5ac09bf2d5159
SHA1173d7c4c4b43f909181ab9d2fd2b62e9d0834475
SHA256c28c09d791ac98fcdd76c22e827e849b4a19dbf1ee93311568f9029e8e44c9f1
SHA51244cd1349754d170db0e9465c02bc8735de3b301a01d59e6d3488e34416c1c7cc89f9d3040c00155ff2f53c92b435fb0f867bef2fefd298f394cdd32d21040284
-
Filesize
581KB
MD591dce964144c74b6456e0b4f8ab4791d
SHA1e45d98c30ac7ad797fa647a97171cb3343b0b225
SHA256c2d3a687feafff9b667c4a4c0bdd86ad43117a2f5fd68fe02e126eb52e7e81df
SHA5127896467c4b7e45497d52dd8f53f2823de1a110e6087d1fb0fa48184ca30720e9fade0b199e10db91818bd794f37faedaf1c33b35ec6326ce9bd1b24033cd7b63
-
Filesize
581KB
MD5384a91afa60386d351820f46554152da
SHA19b6ddabdaad87942f6a3d731032bad373a62296e
SHA2564b498af941753c00e5cd2d856f6bfd02158b51941d5ef611d092341c81460c06
SHA51233c71458826b964c938db27b32d7ebafddfa5237e23f1cb5a8a8f783b1bf25448f3706e79b40f16321f4056e9521b6a0f8439dadd8800cb79b3ef970cc4b71e1
-
Filesize
581KB
MD5fce632a729836c1bbf7fbf82d0d670a9
SHA18a944b031c98776efa62ac46fb13d5f0845fde17
SHA256e5c297eb90c7d2f918b1147d85a875fa7bfb22044824a62c318725c441086583
SHA512c358b7cbe148899b567fc00d574a0f32819bbcd3dbffccace5fee6b5ff4c6f633568b72b935d824738eef700a3e31752877ff433eaab2bf4acc514e02c485f11
-
Filesize
581KB
MD5c4462a862abb815edc074814b162aec1
SHA118aa6d737e28315197bdf3b9e7f02450b8eff3c1
SHA2569db9b78a8934c2a8abba10fe4c414be46ff7f3180db65e1f24eff3653860584a
SHA512afbd460474d2069b85b59c25f8438512c06b9061ce5844715b62a066453107e04aa143d769120cadf91e9b3335404d56491e20d6adf37212fb4883d87af5be3f
-
Filesize
701KB
MD5fc3a1ae23e7df37eda3bab730f2fef03
SHA1d6a7982fbd1fab0efb2ae18e525679abf8c10eb6
SHA2567f05758dff02ee55466fcbcdfaa9a7f06e895eae80a1260c3fbb072977e562f4
SHA512e444b5703ff59484439cb07a1849b5f2ad4e1bf77ebd86a85d71982b380c2b7475a45202d9f4aa4bf7c3757d74d9f5835d1e2c813cf239e8777ee8537c30bfe7
-
Filesize
659KB
MD54e17cfab252f5b4878d58ff42ae2cc76
SHA1edd0c2822f74941ddd484c058d9ca6112ca8212b
SHA256d85bc5dc7aac01401f36749330cc728c0f0812644eed6255c52edfa4f8e31488
SHA512939a0abcd33c2e40bdb2d8ecba2fa8dc90139edf82b382cad6a0b4e141031e8f660cdff217db7acb537eb83d28a88fde81f8381553157f0d375f102083ff1a73
-
Filesize
1.2MB
MD5876c5c03f5af3029b9f6dccb93dbb569
SHA1ca01a97ba451126c8079a3e5635989b7ae2ca611
SHA25655224fbf34f67dc8e8c0351ce0578a4b8c7f811aecf2625890a71a923a76b269
SHA512724de81af10aff0781ee6a18618310cf07887cf9a0703d49cafb0a62a686f0b85559f7581e5d466e06bcb931489834e363656c631e54d21601fb1c4204b0b132
-
Filesize
661KB
MD5078acff30ef09f381629487e2bec40d4
SHA15deb70b049e15ab84a9813a318ab2dc86de44589
SHA256f028821dc196101a44a084d8ab8cdd74f22c451bbf1a5e7dcf044fee7f016af9
SHA5128dd123d5302a5226fd24b9dc33e446d4b8345c4d2ae983377244177c40b101638d3b5299eeb28d42940f9ac29539c7ddeaae5235de1a2e0cf86ffeb7ff07c95e
-
Filesize
1.3MB
MD588c9b534e57477a369817f3d98d0ca98
SHA11c035555d99fdb365b7ee169119a6ffbb1082196
SHA256229e6e3f12b438a2d36a097c18edafac44d34f642298d9727db092b0a3367d27
SHA51214d8106b08421e5e868ec286eee9188eae4792e7fb7fef5cc7cc1be2a5c1f2269529d50157af680cdf95bfebbed027f52c95b4c9caebec752216eab996739b76