Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 08:17
Static task
static1
Behavioral task
behavioral1
Sample
b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe
-
Size
805KB
-
MD5
b0a9dc64767acc052449dd9e0d1e1e20
-
SHA1
5c3205ce4c4251013f1a4c4e2fe5639059ce6f77
-
SHA256
069fee5292a5eb7fc8d5711f9cfa0286f1658fef0b3a0910d38ed595d5394931
-
SHA512
a70947113d0cadb6539ec54db8e82a38ab8937470ed2a96794851947953913e175ff39acb74302c2bd1b60d658538394ecb330310ee52319f98973fe4670f4a4
-
SSDEEP
12288:WlGp0BiUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8u:WXMatr0zAiX90z/F0jsFB3SQkJ
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
Processes:
alg.exeDiagnosticsHub.StandardCollector.Service.exefxssvc.exeelevation_service.exeelevation_service.exemaintenanceservice.exeOSE.EXEpid process 848 alg.exe 2584 DiagnosticsHub.StandardCollector.Service.exe 5084 fxssvc.exe 4120 elevation_service.exe 4828 elevation_service.exe 3512 maintenanceservice.exe 2020 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exeb0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exealg.exedescription ioc process File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\7dd5e66092be0f3e.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe File opened for modification C:\Windows\system32\fxssvc.exe b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exealg.exemaintenanceservice.exedescription ioc process File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe -
Drops file in Windows directory 3 IoCs
Processes:
b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription ioc process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1312 1564 WerFault.exe b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
fxssvc.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
DiagnosticsHub.StandardCollector.Service.exepid process 2584 DiagnosticsHub.StandardCollector.Service.exe 2584 DiagnosticsHub.StandardCollector.Service.exe 2584 DiagnosticsHub.StandardCollector.Service.exe 2584 DiagnosticsHub.StandardCollector.Service.exe 2584 DiagnosticsHub.StandardCollector.Service.exe 2584 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 664 664 -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exefxssvc.exealg.exeDiagnosticsHub.StandardCollector.Service.exedescription pid process Token: SeTakeOwnershipPrivilege 1564 b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe Token: SeAuditPrivilege 5084 fxssvc.exe Token: SeDebugPrivilege 848 alg.exe Token: SeDebugPrivilege 848 alg.exe Token: SeDebugPrivilege 848 alg.exe Token: SeDebugPrivilege 2584 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b0a9dc64767acc052449dd9e0d1e1e20_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1564 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 6202⤵
- Program crash
PID:1312
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1564 -ip 15641⤵PID:4436
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3968
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5084
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4120
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4828
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3512
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5d2c949023f29bb8cf4e1b3ab0addcd79
SHA1993e4bbdc1e139e2cb0ec0241531e95f1615781b
SHA256c501f5f5575998fd17671d3ad7b8832a93034c173662cc8e86f45bb0c64689d3
SHA512b214bf17ef48357168180003cfba3cc4940ef66b86d51698ef63b784178fe78e47bce4669752c23668e53e97d11bbebe19f9638209dd211b24f4172bfc627e2d
-
Filesize
797KB
MD5e6f60c537af1218036ce92e6f8e064ed
SHA1ddcd5331f817bc97deef04970e47b637593a1488
SHA256430480948b36336412a0c8427cb5c222e10f0719e74ed709060b5e459dc34ab2
SHA512c14a1a0a3f0f5feab1bc8c65af8eaff50dde10279da897aa85126f16fdc51b5186db5bde7c2d9bbf7ae891e14713c383fcd7da76968d5c6cfde2f36d451d4104
-
Filesize
1.1MB
MD5f03f1d843f85925d78d75e3490902b21
SHA12e896773693af030387d3dfd91d10db3269a9a58
SHA256c24ffff6f192031b8d7fc35636820b21e64f0a8486e91b01a8e5acd582e33df8
SHA512862c92efec28c2b84816d8091c219e81fb7ead6c04a0f4f2e2bce66d478861b321d741471b43a6b3406374448db549b837ace319ed5c0e07eacda829e2dd7949
-
Filesize
1.5MB
MD5eb697d61c73d9993b9e5708491950443
SHA16e7ef61e4475e31ee17063072a55e79bbff38dfe
SHA2563c10676fcb47c3dfc9c9bd5a3b22788971c4e80a31f18a9575772e0a1134e095
SHA512c66b3988d755ced7d12ac953a9ba37834e0565c30fa28a1025156da945bd36938b83a2a018a14e24cdffbfca47fe3856a235e83239629911618a83a3deca980c
-
Filesize
1.2MB
MD57ef56ba8b767c6a7c1cf6629adbe9b65
SHA13c51e6a8cb787a5ae0582924395552be05569bfe
SHA2569d2c0ae6c3ead18dd91ef56861ad48625509093ea19affdacdfc7057a860e5e7
SHA51257447f7459b1c5c51af12244c31cbfaea5f071763548a948c9d2c06252fbdaa64900d97d639243eb0f5bfa4f5860f7292cf7e385f2aca7cd26f7c6cf976c9e9b
-
Filesize
582KB
MD589f6d11dc5890bca06b76399c4479d12
SHA1dcc93041268dd703393f40d5950d4838e1963b45
SHA2562b33dd0e203b1ffde36c478f95b4255750587c0ff50505753217841c1518db85
SHA512758701c45594ed548bb38fe8859d26d28d3a70e063e426336f60cbe0eab26898d24f4fecdb87100424864462c672d8b382aae989af40e77f9cf323cc39ecd1bc
-
Filesize
840KB
MD57d8581187824cdd95acabe89749a8199
SHA1a4da468805de7e352efb5e5b898c27d438655792
SHA2563aa03add32108de0302a849c0b4b51bf3f68f830b0a38ececd4908b0b888c9ab
SHA5120e90e69bdfbc6631d923127785748ce890b99d3774adafb8286914d26d301d560ef42d369488ae255125ea275de3465aa15ec846dec82434e9c55189da15204b
-
Filesize
4.6MB
MD58819f11bd6d436592ae4cbd9b6e96194
SHA1817502912c5378f81ea72a3368249f92b18e5ed8
SHA256c00f8549472f6e73660da5bfeb442488a7fc1ac6b8930a9f9080e8ff73d2681a
SHA5120278ff5230ec54f61490a1e0d46cbed3259e7c943b6fab1b21bc0da785cab7848472f8a7c263468b136a95a8ac36d440fb08ba9854526ccdbd295cb52a21b00d
-
Filesize
910KB
MD5793e48f2b16e8f74645f59fda8234647
SHA1704bb22ee880b0fef24bdc2c0d054d95b81cc7ed
SHA256aff38096d475a63a9ca7769221a5b66016e71cc4ccf72034e7f19c66b1cb408c
SHA512ad16feb97386acf3751622441bbe82cedd148751bebd30bcd560aab753451ffc046ee02cafe2536595c16a1e3278e3455f7137a2646946ad9240c27d8352b03f
-
Filesize
24.0MB
MD55f5b9bdb1904185ede396b29af982f3a
SHA10ede18c87dc66c49816a73bda7cd1e315100fad5
SHA25662bc7e23ae341bb557ea88559674f3575bae1ba2dcdce80be83dc8aad08a4616
SHA512f4a30ef9a3083db0a9534956af145f3c1bf44a9e4ee01f419969057560d0871a94d6f225fd4c515d3ca4571a9c1dd9eeb67047025b291b60fbe267512e625733
-
Filesize
2.7MB
MD5051beccbd3e50440515f5efb0855ca58
SHA10cb08308eaa1a03097de23fa88c307477ee84bad
SHA256969a9616552171458a4892431004be8f1fbc3e89e229912da7090905fccf73ff
SHA512efd67a8cd2144c950f0fd673c1425e59a0af90241bf488ef29c4bcf909957c699b85d0da06ab4ce21cd87004fb3566000eefbb87842b41bb872e71ed44e499cc
-
Filesize
1.1MB
MD5f864465f432f79144474227920a4ee85
SHA1f9a0374f2ef0018e853f3865347e27e8c48b3133
SHA256f4c3961338e8524dd496b0d9ccafc5ac2c4896834973ced941fe83c619885edf
SHA512f14bfc2770de58189aa8f523ff2a7872ef694d2d961bd9a3210c8c377204f64433f7af3c504531f445d5160796b1f18113088a356f0f6ad977f15d30b2e85b7c
-
Filesize
805KB
MD5f6c22b3052b209f294194f4f320a5b4f
SHA115555d1cfe310bbf8d5da718ef14f0044b602727
SHA2569cd4185e3d573dc541766d200c937d2a071ef28d4a0cfbbb2ed7b9d592cbbf8a
SHA512e9bc2c2047f2fd145a80b34e7f29f041e6ed565dc507175776a598befe4a3d63c143c54ddf63bacf13df192daf46ff63fd5885fd095726dee54eb67dc3b4bbcb
-
Filesize
656KB
MD5e8b8754d4447de4b283c29c817016ac9
SHA1ecdf9738d705937534888ad025404ce118aabfc1
SHA256dbead9235be6aaae567a40d7b6a756d7f1d9d87695cbcc7804bf37430facf010
SHA5122c2fac3224e4f0662f0c07c4bec639028c7c84c312dc9dea2d4c0483e74b65e58b902af2dfd99b4838fa58b2363940bbeaa3a0a8997e5dc49c6cabf2feed638c
-
Filesize
5.4MB
MD5ababf8d4cd6fe8ef7da5d6458656e80b
SHA14bf187beadf10e3c881b8b11702e4c494048a814
SHA25643faca4e9fa41f470ecf6461d8d2e7d7fcc311015fb1d161a88e5e04a51ce7e7
SHA512ea84cdb8620fcdd545b9b800a6ddd4bf657025fe8142ec775aeb427eece78fddcd39dfcad7b3f2c3cea770c61ccf50b3a8513a61342d6313eb9d53b299135017
-
Filesize
5.4MB
MD507a427ba2bd9c47a668e64b41263cc21
SHA12b0af9d8f60af006daeb03f2a642f10045687ddb
SHA2566a0882b7e47a58d1ef0c68caf8fc4207e284e7f508736ab62339c04364c57a3e
SHA512f454895643feba8480f6360b75e0c78e60ec2d415091bdb2ab7c7d87e0b80030b2b651c4fa2a75479bc09c8d735a55991bfd2f3ae9fca298cb371dd260589808
-
Filesize
2.0MB
MD5e862cdeef519428ec8246b56b8e7ec9d
SHA156406b23e5be17464de5ca19a42f887a93159272
SHA25604fcb3ba469830f1f08715ff9689c3f65ec3450db6643b8ecdd711e2664f3cfc
SHA512d923259a83cb010a3457b717f44fb806af6caac97bbad1941a5b935e5d34dadcc6df46eeb5fea1962f1db83670eac5e320b5698ca9e6b5024870f4af2d0813f8
-
Filesize
2.2MB
MD56137f00a66bdd96b7972c4fb17a2fb4f
SHA121201e949e8ca574f576a2b1785081879df2c5c4
SHA256cb00438f3e919e1f93fef0dd8e9a4f205acbe7ab9f299b13a2ab7761d4f09ba4
SHA5127451a1148a3c6fcc040e07967fa805c51c4393b05aee1b8b9b642e5f14a849f9740953423394cf9412fecf17874246891ce6b6b4d9c0ff606a8ed048ada39f8e
-
Filesize
1.8MB
MD55dee209390e1bcefdb7a7e0c08afa9e5
SHA19163af6809d52c8dbbeb16f21bf10bb92eb20c13
SHA256a29b52eab01a3bcd88d02091a8dbbb34c852d7f69ddc75f4d1116fee327cd703
SHA5129db7849fb07a435eee28b510bb4775459959dab22f9efa75c5f0f4b642a79726a87804e6119d11854831ba0633b6b4e28c6d922e42e9927b3116ac3dca46f6d9
-
Filesize
1.7MB
MD504884ed1cabd20c8c43a6ba8c95f8449
SHA1e5c93b0fa7449377615bcee384de4b4c9c644a1c
SHA256b1aa788c95c5e50b3d18fa379cea4a156f0f90e9d5780393ff915dd7e1f43181
SHA51272b7e86e511a5d9d46d5e44225bd7ec7e77fbf3619f2b2b7209f9b660db35c882c87e9f7c01d7e801466b9b79a86911cc9d9feea7a088e75ce6d62cd171dae1a
-
Filesize
581KB
MD58665f72361d6aa37ad54824e0e27c891
SHA13ef5f79cd2f5dd5f9b6129cde54a4c3e65e6f7af
SHA2560720e2cf41242ffb3be6c91f02f9394301f9fde62245690f5dce7892d71ca1dd
SHA512d0b7522fc6437774a3b4d14c6206c1a26daa3b6476ccde35fa82c4d1526a59e511a539dc78733072fcfc34ffd02b80f874233d82fa32c9eac0e031b3dfe3e8b0
-
Filesize
581KB
MD5ba787738f15fd0eb3b9d6dcb09340520
SHA1e4695e5848be510a14eadd5f06ed7d61dfe259b1
SHA256d1813303dced780b91810bba9b9974bdd3dd13c3036f911c8967fbc5b954389e
SHA512b6934ebaa7912a974912297ba3b03d14f30d0456105942004f65bdc98d17f5d4e3be6bfe347752d47518fcf76b86a8c364516f385c6e5d0ce4bd4a338eeb6cc5
-
Filesize
581KB
MD519a0c277812551a043a9bc1849944fff
SHA1b5ce9752f2b28e1e994606469797d30e2618f9d0
SHA25628f32c5f4f07b141dd41b60b6d244f24652e0f6f7a908ae5b0fcfc7b5f45f06e
SHA5126c00fc1e1f4b0f3052486e496e28d00009b76f81643bc479a9d5fd624d364045924ba30ed829c8809a1c1e0702c20f42ed9551beca7c42c705b0e69495c223de
-
Filesize
601KB
MD5a31e1a8224b8421e748b2118ff0d8002
SHA1d3ce6d8d35280cc1202c84f6e323d3ac8f201105
SHA256b4e6e6667164e02733277bbd9f70f1ff799127b485b4e71d7e5a2a36142df18a
SHA5122639698fff676c0a4fb0341aadeeed973cca18a7e38943a5c039eb21891b5fa7a34236d75335d10e299ca5478df06a11b74edd8f4763492c0b2dd98f4bc629cb
-
Filesize
581KB
MD5e5b28d488be3645e3dc9c10b2e7eec3e
SHA144b697dd20bfeeca0ef2ba87235e5cff63977473
SHA256c8c2669e1c57d95231d7d78f1e907d8f8b2218a325a43deec59a42faea465164
SHA512df3f7e5b3e1c03c2998f775e2f5347f2d17d8d94b8a964e3248b4bf6ccde54b0b34290e04a92585a857ee77abd345a63a1c98243320827fdb44452fd7973b143
-
Filesize
581KB
MD5a3ae733afbc56f4dbd57afa4ab2586ab
SHA1f44b114b6bca85c6871dc2a52d8a567373428986
SHA25639f387eaaa5ff6b987ff1e62725722de8b7f6c6565012421836619ae0f95d3d4
SHA512eb2ee44fc5d082feb1a5c388cdb8c4ee7b7296846a1f48ae2240d325f169a0759a17c6197035535f27852a2191339a184cbed0e37e9d49c593cabf80a4de445b
-
Filesize
581KB
MD55064bcddf420db838ab1da12aaced02b
SHA13f112f38dffb04715725597da85856ebefca8681
SHA256db4c3bd25583a966b9f62a1580c0742d1df66b990733b1c2a9b6b82828726fc4
SHA51265f72a237fb0c8c132e090d76eda16872e1f837d0b15d9bbd8c82e0ce4e73171157e11052640bdd225143fb5d7a57d9b070f1da73edf7b91335c0bd81812d971
-
Filesize
841KB
MD5856bc899f55a9022a522b3dea27bd7a3
SHA1570854d062f25c36b971041cf9268b8b26a3500c
SHA2569424047ce1c0d5a84decee5aeec16c721cdb840fa7654780c88f2f1e78bfe1d9
SHA512f4c9aed04d746e2fc9d91c83dd5c335077b138da4c241b8ddc42388f9c4a3e2036b2ebee758a4e4bd40da98ec902555e5f01dc054f206514c6295b2f2ece3bb1
-
Filesize
581KB
MD558e5ae50d40280b1aec6c17f54e70b9c
SHA1cd04e36fa25fbd1bbd69bb521278a33809123aa0
SHA256b6db53bf2d327147577d5d5aa3c37d918f0f64939eca766d6f9a94aaacd12c63
SHA5127c5f44e9a58146bf4992a387a4b30c701e036be55340ea22e095e290bbc133f37a0a6ff48fb5c50963f5679362dc7a794b7d839bf07b945466d9249d87c4592c
-
Filesize
581KB
MD50cc3463e76b2d70113938c424cb7d1ff
SHA15aa7904d029ecdbd3faf2006f9cd864855766f36
SHA256a5b3fbd35c6bebb521ac468ec31e96e5a4fa9ad2cebaa1025d5a32f7347bc07c
SHA5125a994e163ffd70b8f70455ba1ccfb5956824c9e00ee88d69176d7898d79174de1db6df376fb70483d05353b1b64824cc00d85934b642fee254afc223f66e5d67
-
Filesize
717KB
MD5015361741436b03c3b407e5b89c94c62
SHA15cee4001e970b14554241cfdd7fbf37b9b2f4ee8
SHA25681796fbcffa72dffce4a7a5683d28e2055c1b5a9bc37493ceec88a745939cceb
SHA512a87d1b01097592848fd023dc9f70c6ef71d0ddb309889159e7b20307436348e42c016f0b3f543cb57f51e39414e0d23518db25c9d480e36089ca4346c6421dda
-
Filesize
581KB
MD550ba74be152457f11d8f8c795ed95cb8
SHA1160352f8e557cf13b82390483b7627e8e92dc928
SHA2562cb5f87ba6dc57c1d762a7a65628e40e281e0773a8677c72c47e0a37241eb103
SHA5126b01cc400ceeb9960c024992a88c33ec7e5a30b2861302bc2836f6b1d1e9b7bd7bd5727c6eaee8379ef98da22594e3ddfffe9d800c63cadae7a11c3f800932df
-
Filesize
581KB
MD5478702971e5d1c12e4302a7a1361ea46
SHA1230cf2db27ed87075f7458bffcd54ec2befedd27
SHA256eb1512da26a1792e61ad215243e1b19ddc2e5d26b3cfe6f81cd49779872be82d
SHA5127b941236104aa0aefff361ce96bb94309f1b436b37f9679e8bb80f0bf2671db39045701dedbf53d986534ff57ff9af2023ed13a25271b32fd14e7cd5b732bb07
-
Filesize
717KB
MD51efd28e7defe678c42826bc9f46faf4b
SHA18a13c77778d7a69aed67029909c71e674ff1c47e
SHA25670aabb986eb7f7803478c8ad87abfb449ffbcbacd08adddc692bb7b3b77bfcf8
SHA512a881630c9ab5a11259bf648c68b4a07aaf84105ef7f4c69f6ad9eef55818e2e23a99c9d92b5f389ce5ca29cc3f79df79217de4ea969f19d467ff11048419030d
-
Filesize
841KB
MD595e67150da48f72f08de7c56a761847d
SHA194400e4a4456faa16af59732b125fcc4d6e0b3f3
SHA25624311ccc5bd30e5325f2c60cbb048a0e5ac9168c9bbe6c6fd62bfc118c8dfd4c
SHA512934238b5f836c659dcb154f22475f43db6876eec3fbeac0e2fdad9e92d41a05a2eef750febf0d9b4942674bb46a3870d70d5a64429262b749eca52ee258a6b12
-
Filesize
1020KB
MD5b69743994fb9e326e6c76c4d1fbf210b
SHA1ae17e40c50bc0b5a58956ae5b9e2f8e01a98e0be
SHA25674ae34a89793a06cf063927bf9b3d76636acecc36a52d8f0fae01c3f5d737cf1
SHA512e7f8d481c10e9d6949fa1293f2f30088c1a283757725b863f83cf1253539219e05c675c7fb3022b1ec6270930d4a743c4be11de9ea08f049a991c38532b0a671
-
Filesize
581KB
MD5da3af3e55f3a2af54cadf5800419282d
SHA10c7d063580cceab3f960fd2065ea8786ba6d2bee
SHA256438a5138552368b4942d9a9af983916d78c9fc6a28b1374cb10537b1c26ee586
SHA51214f3f19c5389872be8c60391f301ea599f1009146ef92cad923aaf40a84ed63ac7f615ae3739cbf942bba54672baa5ff505779d1220b72dc9675f003e1d62ac8
-
Filesize
581KB
MD5c453b9841fed13e35a1f3142bb21a646
SHA1536473b2e972f4742394b095ab3a04f2dded6528
SHA25698c693ef7595c39293ff222e5d504ac44b686f647fa016b414a2e65afe30164d
SHA51295b33690322f51faba7a4445e37696d492da18da82c3cd074f53a19e31a4ce6e666a098acd51ad86bca8c454b187729c68999e783105e64169b91cf6cd85a8ec
-
Filesize
581KB
MD5636b90358768bd246d3f32dfee3df46d
SHA12c60efa9855757a9ca311758d25253a77f313ace
SHA256c8224a989370cb6a82fe2bf70a4daf91a2ef051abb010c407335506bbcf76be2
SHA5123e5093657a5301d3b617e6f59c46c423ebc1d2e47e2291a494c451f1e3270e5522f9e19a5db24e9974d3adfdb3b65d5ff51f19a828c49e5cfcb41a3d5f541e89
-
Filesize
581KB
MD542c5644632ca653ed01cdc73b65782f1
SHA1dffe90035b5f0aad34f461c1d4e3b1b8bab36667
SHA2561d215549e3ef104d93005601a4bc7d10ab7e62a26aabd8cc0125075bfd0ec745
SHA512f70d8683b5e1e0a402727de8081e35bef8d2a4dc8e982a5b8f8f26a6dca38ed1d8f97d5e8e536ffd4e72f0f3e7037fc8f40c394dcf5360cdf52e7a94d7aca728
-
Filesize
581KB
MD570efc9655b7c81a0615a9566dde35be1
SHA14ff836ad534d8f31e0f5bcd5df7dd1e9d7860e42
SHA2565f46a83b638fcbad7bfb61cc13e3ee31da00099aee83984b8176f6dc180e1e4f
SHA512f0a40758f7d17f1ad65118563460e7fa0ed9139f6d2d693d4622a376b22d2b51d623d5e81f3a4b41c49b12d1b93777f0b094d84de3f004c5189be1e32319f0b7
-
Filesize
581KB
MD5e3b7a766649968ab7c2920334f442a75
SHA1a9b585b6b58aa736bdd018132d381926fc1f882c
SHA2564794c463aa246a08926c81c482fbd5aa36d52e7d8810a235bf8dcbfd2c6c2d48
SHA5123a721b3ea3c088b3c6062468b4347405eb00a8851c24e8c449aa1c1308f0d28fe1380f9c47840ff456ad9d80f00e00a0d202fcc89e7cd5ede114ecc761adcb53
-
Filesize
581KB
MD51c2bc32be8f1b8cb09eb9c4c4b20b013
SHA12d0d4f376b1473500d5f25ea406955642fb23767
SHA2568c61d21fb849615437fb4494fd74bb2eca0044de7155b298244d2c74233f844f
SHA51264a73bb82e295d160fe4f56870ec7c48ea3bdd442585094b1671f51104ef9e1eb1a16b2828b1e6d82f2b0529acbd72c350c504401e48d75b1b5622c4880dc703
-
Filesize
581KB
MD575c52b0cff3ac2bd749d53501db048f1
SHA1d9e29e5cd6e6f9b63a013c6f512692198909742d
SHA256ebdfe0f42dc729e310f2022ba78cefb23d1412dc5e827d964ea9917fbea3011d
SHA512103f2de02e77dc148456228e5695e9304bcd3bf5dde335d4de052e0c47324aef20dc1ebc9522d2e5d3de98d62a936cc34892b64414cd3d46bcaa6d361d4db6aa
-
Filesize
581KB
MD5715b2ef3607dead418815acd52b1c487
SHA1fc1db139644dc000120fe7b8a90182da7cf7b966
SHA25606bae453679b8d24347db5722292267c32696dc028dc54dfa72f01c7c4954390
SHA5122daca4a022170e5581223464cbe76f7a105fa4b756aaadb48390353bc0a8c2dbeb38743b80274c0439748eec049e6ba6bc92317cc1e3b2a1bdf96bfb231bcde8
-
Filesize
581KB
MD55b8039c56f4a5dffa685a83c6a49e462
SHA1d33ae2fc71269106ebaa297c8e425ebf3f454a2f
SHA25608bc0ef038e439cca461812555fb306d2fd36e18dffead0f40d0c96874360825
SHA5122d4b69e3840f906340241cdb00da6b4a732a37a7787d26a0dd992b8ce2eb4d5545a25eb0df71c98159fcb3dae3931c449cccc5d734f7029498690eeef184f8c8
-
Filesize
581KB
MD55e5958c7c74c4438f97eed25a87186c9
SHA1b7d8cead96fccbbb92fcecc4c060a8d2773f47f8
SHA256e014f7597b5ce2c9379010a8765ef1107f1df0d5da22f0f2bd79dbc5a9e0d9e6
SHA512acfbd19960b04f55c8fe3fe908012242e7144eb89762471d31b3dbf47258042058e8df08709e4abae6c571561c1d27b48024eaa515cc5b002ef9a57a8a828a51
-
Filesize
581KB
MD522c8a268fa1eaa54250bcca73024eac1
SHA19802f79c31d2a05135464bf0bb34d5fa6c783b55
SHA25604aea3e7df78d104f8f44c22b86b53166305deda61b05c16d428eb2c430eb113
SHA512eda339577ad2f4109860c1f2db83f2f4bfc6d475f769d7bbffe5b87116ab03862f2ae359628b76030e6a9afc7f2a34df5b039adb90fc32998812f12aea408453
-
Filesize
581KB
MD564f8d7184f0249ecfa6dcfd15dc28b14
SHA1e701c267d7b90230a9658c5c53401c6e57a0c791
SHA256176749e55eff21fcf6b0228e1b1e01b9f5defb93a80c0c7f1dfe35e55e775f67
SHA5126249ce1519321f791013a7ae8c7c54d12c1b7a649efa883fbdcb19171ddaab4a0b419285b766220b43b0b4344414f2a37c47bc73b54febc970ddfe277a4cdbd3
-
Filesize
581KB
MD5d9712f92614c4e95529d692822208ebb
SHA159aba30557bc685b075876b94addd612a5937c53
SHA2568874c81e4dc7f1609b14bc809090d21bebc6b3a8889d4a38914306fe5ec00e56
SHA512032a007377d86405eacd070a97558635c2cb31f1333a1b00fb72705515d7a992ae399b15bdf6419218e4864b46052a97569b02c8d62103c6297a6054156820c9
-
Filesize
581KB
MD5885bb58db42552c2960749d8da52862d
SHA1c8b86f0773d10237e9ddcbdc8e085e2c5f3f3bf4
SHA25691dd7bc845108b3b0074d9068f9b77cc4c3a63d7650a7856aed8ea49399aa3a0
SHA512b94e157c62f66f7ecda5d931a1a59d725bce295504a111eeb2627071bf4c623feb7786f962144ab890b4400adae052b213cd582fb5ef70b3a13191c075beb711
-
Filesize
581KB
MD54875251d7966695dd61e30d952975a3e
SHA1cb29e17e7ad444b27e8316f19c107d6735c522ab
SHA256f8be44307520f65244d0b7951e0c341db6888405909617f5840b4401c4b726a6
SHA51288f322f8b997e9c6f5883ee8834b14ba429178b5c7c64ab3604bf1c33c9727bd7882a71bd1934607bf321bc458d47a0c698061969b7d65d43b1ee20c0e4d55fc
-
Filesize
581KB
MD54ab7f2e2dba49b8c6a8f7f9efa06c882
SHA1776ef09ca3054e24c34fbec24842d8907d73831e
SHA2566e2185b2b81056b46936820ca9116941fd46d1358b78358b6123431bbcb09f50
SHA512c7ee5e191a4249c755b740c05256ad4b26e4546c10d754c459f07498c7cffe97d4582832ba932895cc2e631cb2b2712ae294646e166089fd4e8e6ad9c6f76d56
-
Filesize
581KB
MD51e2a8f4a1b17579f561d6aee21f2efdd
SHA1ee7b3c29a5fa359d34292aaa6e290271f95cc66b
SHA2561e6437af5cdf19d5c6b8fdbf56cbef22ff404f1762272fc9a97de408afe13453
SHA51222d4a0b040408eb5a1ee3e1d2ea033b9ae23150b8fcbf27922c4c87afe073975f05283fa501dfd342986f70e0b23bd93722866bf1ebbde4c129d02d49b48d71c
-
Filesize
581KB
MD585694f2c17b05a110194833f5c2e807c
SHA1bad0ef9fcc74a51f54cd34766e28af8ad12ada37
SHA2564590068133856371a352780696da1d3e129b72b44b0a4670fc1cc86a3e976dcd
SHA512dcf561061277395c3b3051cff3e08060b6f177ebbf68dbca7d0d1f68cc1e27c4d813b84322fc43ed368433c0d8528946c17d6df70156ce6548c3eabde1dc52d2
-
Filesize
581KB
MD56e8fd45681653eba5dbc2fcec881b308
SHA13e8ca7ff69c1efadd7ebeeeb8e1e2d1d1532dc78
SHA256fa68bd885ea5adf432450bbbf8ec5c06b4ba41ac37028aee87169cffb0645c33
SHA5125222821bd753261a21d38632f0202d35c54029f4647a4a3cbd533396253d2697c8db819a775e8da8ff354db19de705c51451f0e0300930311f3026503c31b61d
-
Filesize
581KB
MD59cd41902b2a81bc22b500c9c19cd80d2
SHA17430f5b1d9abf55288a5c25cc8dd2b96debd7303
SHA256a73afb77edbe744df3f3f5bb1c05a646c27076c0fc8208f0ddb9fef41bb5a3f8
SHA512c5f0f819809296f03bb74881fc0689c21c73744b75905eab0044e9024da0abe258f825500825b49da74947cdb7297b9cc83a12d456743f5d9eb82dcbea193de1
-
Filesize
701KB
MD597a7d70e6801ccfeabdd485c9a5cb8c4
SHA193ba1760d0f5c2a47aea34255457e76a8af6a682
SHA256030a435f786d83130ba925f82ee45e2899bd902b68551e3a9c62dc8c7ff1d2af
SHA5128f454c69b2e37f3ae64de8190291fc9db3bf5bd09408b60c06dd71fde4f3c346d0605dfa4a975d15c0d76dbbf403e2e0603cb09cc3663f47b5150cca5fdd9077
-
Filesize
659KB
MD5cfd15b245e7dd12e98c1eb03b348c350
SHA1a7b84255064fe2aa7713b56e026df780e529032d
SHA256dcdb8e1634e83c04d85d098703663f212b026081adedd6f173102e349d89738b
SHA5126d938ff6e4630bb8bbf745417557500d8e358b3860ca7787e302ff65560c707d4791862feba344434e05aa37eaa1dd7b36b5725818d009dfa9ef9fc7745a0f6d
-
Filesize
1.2MB
MD527547a051ec4041260c11e79596e4d16
SHA12180e5686b44a1d5a8417ab4d7efbc7cb9e73f06
SHA256d89a204afae6176af25ecb1ba5cbe4d45d2cec3b5f15bfb67459a1c360fc3bb6
SHA5127bd79cbb91619911bc9a87266e7a2388303d26af716987149e1c217fb687db2c3a369f01c048a68d835f82d1f73d2dd530970d3af8784bcb72d5498926e734d6
-
Filesize
661KB
MD5ca0c00b99ec718cc35b35dedde00aaf2
SHA1e9762e5a38bab80a253f4561749d5931f2dd6ecf
SHA256b300b8dc705378342164013c750500b450f5bafcf9f0e8db11257c1a0c40c31c
SHA51247ba826b36c884c44493aaced0f4cd5d03a9ae8e509cce432b509eebcdf94b85df7589f8a0751bae66c0e3426b949e0a963bc7e3891108d93245b47361e209ad
-
Filesize
1.3MB
MD5d651dad8908f373389f860eca4f43da3
SHA1869654e070f66f0896076629c8711f5042849e3a
SHA2566a3c82d69d64aca302615a62162fdec4ebae9ae5dd1dd0ac3f3d0a27c2789b76
SHA5125d5cf25bb662e8c7fb528f7dde559fe06805eeff3ab286d121244ae86ef528ba60e3d334996bccc59c1469bede8b493aff46c0ae882ff7893ec2996b932a79c2