Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-05-2024 11:43
Static task
static1
Behavioral task
behavioral1
Sample
423425f021bde9f7dd86041a6f439560_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
423425f021bde9f7dd86041a6f439560_NeikiAnalytics.exe
-
Size
2.2MB
-
MD5
423425f021bde9f7dd86041a6f439560
-
SHA1
b69ad12b9e2c1eb84a45e9e58918f85604c02597
-
SHA256
40619b000ddef1bdd39afb101778ca31607f5ab9661c5c7d1936c9736c961d45
-
SHA512
88f6473de7f76ad08323bc0a01f4255639816026cc174a17cd0c6a489d52c0ccd543f721f680c11c8b20033b2605136838fd21217b1b5014375928fcb041c88a
-
SSDEEP
24576:aOObVw4TaN1wdkukCba4oXtgLhU3wEdmh58RV49pFT0SLTQYWkK2u4dax8C:aOOh3aN4kuLbegmtGys7YSLTQYWkK2/
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 696 alg.exe 3864 DiagnosticsHub.StandardCollector.Service.exe 4860 elevation_service.exe 1988 elevation_service.exe 3056 maintenanceservice.exe 4840 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 423425f021bde9f7dd86041a6f439560_NeikiAnalytics.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 423425f021bde9f7dd86041a6f439560_NeikiAnalytics.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 423425f021bde9f7dd86041a6f439560_NeikiAnalytics.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\24253ed7b4b1389a.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 423425f021bde9f7dd86041a6f439560_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3864 DiagnosticsHub.StandardCollector.Service.exe 3864 DiagnosticsHub.StandardCollector.Service.exe 3864 DiagnosticsHub.StandardCollector.Service.exe 3864 DiagnosticsHub.StandardCollector.Service.exe 3864 DiagnosticsHub.StandardCollector.Service.exe 3864 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5112 423425f021bde9f7dd86041a6f439560_NeikiAnalytics.exe Token: SeDebugPrivilege 696 alg.exe Token: SeDebugPrivilege 696 alg.exe Token: SeDebugPrivilege 696 alg.exe Token: SeDebugPrivilege 3864 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\423425f021bde9f7dd86041a6f439560_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\423425f021bde9f7dd86041a6f439560_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:5112
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:696
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3864
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4860
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1988
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3056
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD592352f5c533c068a18436675d880eedd
SHA1769c6e49966a498e74422566b1db9513bb56e70c
SHA256fb623f6120108af6d9d3e83684b3c654fb89a9c002d3ca0ba2ade38423b24898
SHA512a8c431e218c77a1f95820c949042ca3c2ef19c0194547caba8a18a8555f07028061354fa8358168674f67e49c5f65a8a19350111c3b7ecf33b0d84b01416ccc6
-
Filesize
1.4MB
MD52985e5ef856596a84fb2603caf297246
SHA144661ebf0882345d5c86564579fd8ea4aa74ce69
SHA256e6eea19d96ffc711a7c2dc761daf4a1243a52b4d02595b308f26c3e17507fe18
SHA512dfd930ae0771316e852c5add22b4d8d4ddd5a4e7010bbb36fcc801cc3a23e2f0d7e8970d5d182f558b566b77828d0229f7b176d5f057d52d510f574b9c0fb948
-
Filesize
1.7MB
MD529574f12e2411fb57ff4227813f7c593
SHA16fe036b36e967ecaa02059662caacd28a071b5df
SHA256ef76dcf0a004b09865b84def46009d15bdc5d19996e78866235240e5fbdac37e
SHA512b50ce87bd71bcdb1125dcd0467bec8cdfc6ec5735828b117ddca5d66a9a48c06875f5f7472261d6f07a5270ce19acae6d290fcf856cc6c1f2d158012e08f31c1
-
Filesize
1.5MB
MD5ad61aaa30b8524ee21176fffa2186a2e
SHA1da5e9f977ebd980dfaaf391921f4cfd3189a0866
SHA2564cca14ca70622abda9dd9727da4165f45c444982c1c6d34d01aa172b40cc7a96
SHA5124b52af6a68e4515a6aabc24ee2e504cb0211725e84df6d5afb13da5f3f231178411bd3a5033eaa9fc2e0f4acf123884072aa303a61261204ad32ab688c8d3b2d
-
Filesize
1.2MB
MD58a08ddfc317467544d4c7693196bf682
SHA1151613497e6c17bb4b1df9475fd7639a7df5e33f
SHA256e05d1f113e1c66e489c90c8e7c3c3a00bd6741312bc5471053cdf63ea98ad2d3
SHA5128b3782dead47776ef7f415263416cd249965f0e622c0dcbe0bbb4c0365fc56858c0cd61c9b6471f172ec527abd26ed33ed4445079a130a6d66699065cc69f77c
-
Filesize
1.2MB
MD55dd3abbc1f64cbadc6f3301b2a33235b
SHA1c6cf019005dd075a2239f3f8b2afccc6e0a8a32f
SHA2560c9dbc9684555cd5ae433f7696b2dac85302fe8eaa8985bdea4dcfc01a6781c7
SHA51243becd3208f6a3258079415e284942e187db1080076e7d09a4083ba8f783d76c1bce513298decf47bc267b8b7eaaee06ed43a8672d266883274fef31292afeeb
-
Filesize
1.4MB
MD50aab5b3ab35171248efeb877b053df42
SHA1cd4b0df8e9e537a921bbeb81bba3f6e6a9d82f09
SHA25668d72d7fda1685c5fbba99a6d8c241c58acdd36ffaf002efb2126e7954bebd57
SHA51297cc46ae3f9a666f789ad98a6406d8a550793c9dabbe02201c858efdc99e2dec7af1e5153e367f03b5c335165f760d6622ac4e23e1d70d0ba54995ae41231de6
-
Filesize
4.6MB
MD5dc26a4b4ff75cf0fd2920b122c223fb5
SHA103de2b774558d4cfc1a66639ac9bec06d9123abf
SHA256133c6a216753ed5e8ab5ad8a4d6114a0fa1590f2a9dae75165b2ea1fe3c434c8
SHA5121d0239af662e686a9dab49735a70dcdf5a1c0508111fe81d8723552d0d3d62fa40160c459684bf1fe6052e2a8c645f52f8ce640d0d85ff29623a9e6d5f85e3bf
-
Filesize
1.5MB
MD573d82dda8344e18a6fcc3fd24f6720b4
SHA12b8bc23db44ab5cfc5421f4e41081c42652f9777
SHA2564625e6a045c2355954cbed2c7972286021de9d27260b0bc4e7bb1ef5e5288a00
SHA5122e2ba5bf0e12e67e3d910c62f8b48c075ac4bb71154baaf5c866eb30d0d1b1ee45d10d80e21801528fc6f935c9402bd111583e40317b12fcc1580fa06e4dd64d
-
Filesize
24.0MB
MD5ddd22b21cae888d8fa19249fab55f88b
SHA109cb8d03765f853cc9131be9ba0d13075079e955
SHA2564940747d1c451b3f729854d99c397e35408cd0fc6165a5365403134bce4fc740
SHA51247e68dc2c3c634de57906dd6134b63864e157c8fd62c14216e3a93954c4c3290474fcea90e2da96ba5c908817041698695cd82fa5cc324361bac67a415ebbbf2
-
Filesize
2.7MB
MD57e9d8ca844825f8a2e1745af88468e63
SHA1e87672ccce5fa7df6124b8beb583a448b15e8de5
SHA256a9f4b59fa89869a33b638dbc9e94410cff84e609dad977166911c3ee62a88116
SHA51297813836066a6335bbe5c9a199841a363fa19487c7527b9b7ce31a6055c0beb9794576127003bfb8dcfe9a6f13e78d3159f4c28fcda1cbeb86642f560aa43797
-
Filesize
1.1MB
MD57a0bd5872d93469cc9820de67d86f380
SHA1e2d8d2bc44418e9600010e05a7d68b9f6b63257f
SHA256eb213c950006b158433b00f614eebbf817f4acbeed06d678ef8194c8c49a0944
SHA5124bf41185fb70e0d2287b29c7fefed9629cc2b069e4ea0aa27467a6056ad2a943dd781eb9965fec82f14bff43134cd0fc1451f1e190fc0d0324fdcf54bd37f823
-
Filesize
1.4MB
MD5aeab12fcd5f63f06f902d4b628af4116
SHA1c32c646b83f1732dfdf486f64a55e92e6e4cb084
SHA2566bed17d070dedeb16ecf7ed80d10da019b8ed59e0b7c28519044f16fa4f30f92
SHA5123b7647eba9af3c201c02975fcbf709da971635b2b50fc2c360f77ee25c555ca23646897a15ce2749b404b0bd4975d2046ea63858e45b1214652ceb4eede1c144
-
Filesize
1.3MB
MD586c82224d0f81cb8f7d2242aa92e9ab5
SHA1d278d08f0deadeeb6d9905489e4d10e98a0108e7
SHA25676a63896d04eacfd655b92ef7ce0254b917c1e91ae0eebb37a9e83d144a95530
SHA5122b15a4aeb66772f2e5b8b174f15373723fff7d264976fb08a5ec51f8e5cd0b34e4b7da85ba0a11bc88803e944644e67e9b1d5a8303b6e632605af6a92954f7e4
-
Filesize
5.4MB
MD56a7802a68ea027f912f0e8159408df1d
SHA155811965caeca2b1012fa74d99e4dc68846028d2
SHA256bde6f824f480fadb4113de86fc5c8ece77e285ceea5b69614de1c3b23a819ddb
SHA51285780bd47e44e2d12926ce916ac40e28aed26ee0360c9b673e0f35596fad47307a485e7a2561a41b669606ef35bb0cf8ef45b451215280a1a004be99c618db6f
-
Filesize
5.4MB
MD55d453570c475b679abeae5e2b6658130
SHA15f678455de19a34a56d00288d97b4884a38adf1a
SHA256219ae68c5a024484669289a5f4d096021bc534ca7683885dbee59ece3565de88
SHA512118ff027445e1609f58dba4bf6f91017da5ddd8cd5079a6cd443ab846adfea0f2f4a71c636a2bf551a04eab8714009cf5c0434fdcb1e1f07e24d42587ba7bcbc
-
Filesize
2.0MB
MD5c0059efbe1ab27f3365b9d826d54e448
SHA147cf4569d4d4221c839add13a222f3b940d29d25
SHA2566bf019dd0dde36592467eef0cb6defa4879c10db19d4978429331df7ec4b7c6d
SHA512ca1a52b583228716629da55689771cf91606556f03b3a6796dec9a96587fbad6d53c87ddb02ff256528bfc022636330d2b14c635c3395b0debace29f938c7dd5
-
Filesize
2.2MB
MD54f3678b9dcb6a669885f4dadbe59c2d1
SHA12b13156c075b6c278627089ed6f0015612d83937
SHA2563ff9296cc191fa3503ef0d6530f1b0d9607982dac0bb32659a3e73291961434f
SHA512e79794e72ebb72577aae94c16134858aeff94a90202e22ccc38b8ba092bdde3a6ce3d9b1c935b2c871536fb34ec3de6b483124f5d9229967959ce78ca4cd5e7b
-
Filesize
1.8MB
MD58cafc3452b60c8bcc5653053240eed9d
SHA14447342b30a95124065fdd4fa0301545df57d932
SHA256ac83c4529b49da91b3008a18811a121346fc5f53fb12c67945bc4e98cc647a17
SHA512c33ce962f4390f42a66ed6f02d838249637b934aa17d4d6df97de3facad6ca735646b2718188c1d5eab29f73eaacd40a10dd81a4895920c3debd3f48b6b4680b
-
Filesize
1.7MB
MD5e0aac2068a22c7602418e6c626ec7dfa
SHA1864b0b6e5ade60ebf76f8f341bd41e7292988ac4
SHA256bba8174dd371723e9fd0b92b6d8ef3fe494a66ff3b5cd3ec1284c8287957665d
SHA5121a50c1f82f49a657adf34e2602fe434859be1a780f2417fae713468d9364035148db18062dc4773dbf9be4b78eca50cf4ef60b32e5838d13ba95025ff31c930f
-
Filesize
1.2MB
MD5455898ce590871d6bafd63925e58b88e
SHA160ce2e32ede5b33cc1950d6f9e348de9d1e221a0
SHA25650f51e83a5e28bc1e6b7f45471c29ef9e0ad183ba656ec16f17bd1d5163b6882
SHA5121d33fb43d5c785502cdd9c8114a78b7b5331ec2587853605dc93a3d8f1ddd0dd3c9c3364d2fe1b29aff460114be6bb29fdf47aacaf646a10f95db232d0bf13ac
-
Filesize
1.2MB
MD5ccbf982bfd0c873436896a7ce93de204
SHA1f55cdd5ffef12863fc603a621448598a5a6ce940
SHA256f08c062c10303d3e772fc17b6c5a4d53628efad83b1ec13d74ed4b48058b5347
SHA512cf65b2f13e4608b8c4fafe37acb45e454a267cc5dbb7b9bc35709a812f0f2bf4a3d0862c18b233b932d46e47e3f1898c57e945693cce3556c59f0db93f24dd9f
-
Filesize
1.2MB
MD554440aa8b647b576c55923f023c33446
SHA13fd8bbab99db3a0e716de71e0aaf9f2bd1377abf
SHA256c7d934378a749e366ea28ef63f613a40c6dbb24a53fd235a5eb85caa9d0534e6
SHA51290e2ff34b78859fcb4f43d1dbbc3301940dbca6235195c55e071e05900ba748715bcda3874c847e873eafc88d57b5271cde847c2dad0f0b3bf3b10c5e4f78d1c
-
Filesize
1.2MB
MD5f9dec0aa754cefca581546e894d48f5f
SHA1e4e07a2570c42ea0deef21a359d5a88ae581ad58
SHA2564c72f40d76ff1d78d6bdf56b9501b6380b6c986426fdc37d6cc15e3170be70e0
SHA512f2aa266414ee610b3fd717cca164c94c6fbbca67cb866c83afd927393c0829163e51365a65aff5e4f6c9ed1fd5e6bd757edf1125ffc88c8e48728555b5c356a7
-
Filesize
1.2MB
MD5a71ca0097f3bfcb479a032756e4fff21
SHA1e231c43c842a8c653e4cf57a58810097759189f8
SHA25652828b231252b1083917945672f3858ca2f666d9a1abb4a2fc5f2de84b8fbe02
SHA512591a87f3e4fb1cb4fbb04844ffed1f73fe16699289a6446ac5b1555f3ffe05a736c5b70d6b62c415165b2dee3dc07e6c14778c16096e038ad17cdb53c6590296
-
Filesize
1.2MB
MD548ea05e1ffd6782f43dce27ec8d83d3a
SHA105d9ff634ff3928b5ee25b4ada7300c5a9096dee
SHA2567d173f055709baab92714562310b845acce17bf61d7c427ffb0a868ff69f7c66
SHA5127ec3d3982acc788108fac0684b0f9887420790d29e44b988258fafc2d95b0bd0526d8bfd7354556e379b79b0706ea391d55cf8777dfee9b10046f547f3543bc1
-
Filesize
1.2MB
MD56d74be136e8eec03b058a527255c6555
SHA14379fb79ee4c5d20d6b29c8f3100a9a593e46fb4
SHA25647c8a91aa262f41ddc50e0bb0f893c9823eb1c8e8b72a472f8c1cf48716ea3c7
SHA5122ad35f308aaa6f60e2dad4ade351d5afe0370afcf419b48d87644cf12e2e7cea78554b8597c9ec27004a89a4342047afc679bfb972485fde7fc45ddf38b1f9c9
-
Filesize
1.5MB
MD5af131c2eaba06416a42829715551471e
SHA10c6ab232ddd901ba418b37318e53ab98c5cfa099
SHA25617dd3aceea5000310855a51ba3b815cd9f12c917ee0b1c531d6fd3682788a7bb
SHA512d950f208219715b070e5991da9862caacfe58e8d24181111feedc0ab410018e489c21dd64e471444fe521519b4d5f17cdd980761b1f933351c8c911b709c11ac
-
Filesize
1.2MB
MD56a6f13d498abfd85a6373351250d5088
SHA17ccb1ef5b5e8a3155396a3259a635ebe2d32b3ab
SHA2564b1787f5308a8ca7fbbad20041af412ab4ec2958cebfe74724a8658999eeeed1
SHA51261c044f3561bd556eeaa97d6a1c3fd89e5b65e15935afc161bed4c8d4059737fb4479800740e92dca41e61155463db0a4b080dd47167ff90d60611d73572e3e5
-
Filesize
1.2MB
MD559ed901ce1c1220fb3fcb3ebbf795722
SHA1f0da9b249af4bba1fb77dc97a72138b6a174540a
SHA256d06e46ee2f2d459229cb55f3228c8cbff9bec22c6a7345f537e18f0f37a27d4c
SHA512a60229e72a92412bff8e632aee28309fc343a6d6215aa19463a5c5c4281300d6843259fd25df7bbe8a33863e71a92d4a9247e38c49c7d2eac0ce3648935fe75b
-
Filesize
1.3MB
MD56a52dbe07fd00cab273fc2054ba8d88d
SHA1919574fea16e5b7466474a5b35e59bd510b7ca0d
SHA2563271dd9f9594cf7247b8f82067ada670a408ca946d6ebba43fb58ce191c4a693
SHA5128b11709beb7d8d1f929c0d5ec6be93a085bec1248af2ed6e6ce71432f8eccf4535873304b2e8f11816937d936bc174c53018dc60484091ece976e138084b6406
-
Filesize
1.2MB
MD516ca9fde9cb9d1c67523a0022d3b9aae
SHA17116ff74e1b2957c1b3b24edd162e22a48248415
SHA256bae9d74dd394709b3855dc0b92158658edb2a0f1d24943fa06baf5ac3371eec9
SHA5129590786f4b9fe2cd5fae28d0a127dc661eded924c06784b8874e20b208453918ac0db754d87dd2cece2e5778ae55df345da4a7b714ea294f269fd2a3e6af497a
-
Filesize
1.2MB
MD544f09622bd9286f6a438cbaa7f17f441
SHA14960f9119bc67296a8f75ee1657591ad4ba164f8
SHA25640012b327a69ebc5d6946661c609115a3ff54474bb47a4ba66e6c59952bf56aa
SHA51245d02e97057497454c21ba1582eaa76d6aacaf679aa569cb4d499b77f5005e58e32c84655f6f7ddce7cfae01f519b6bd612cfd6f8a105de5c10aa4346bc33b3b
-
Filesize
1.3MB
MD5214db30e01e6c914f530c666d0f9f2d1
SHA1aff37d83475330b22d44395792ce0775732b04f7
SHA2569fcc846b0f960bbffd87376b409b55bb635223620606353da9f2bc9feb23d064
SHA512a400775b3a80ccca269c2cc470586702f8dbeca4c12b2c693e100b0d53f269a22732539ea28983b746712fa1dde8bdce37a29620e632c4eae4a2ea71aa243d3e
-
Filesize
1.5MB
MD5c48852ae369a6d2e147a288e8db95dc9
SHA12558c6b6a33ce5edb614c19bc8c449db5f489402
SHA25682e4688f146826355e7a167c66fe719076d179050890f8268af0ebf8869b2edc
SHA512fb5e926cd1cba1f08455a6cd57f27ec310518f0a1552604bfda58d1d2074e88b328f26b7a528c075d01b8d889a98fd54ff0105e53337a3fe379d6bd8ba5e1e6b
-
Filesize
1.6MB
MD5c9c0dd88cb94e31c0d90d917b1c3cdd8
SHA1c852c360005ad6be0c6b6315a5f69873379ce235
SHA2567abf196c974110f99aaf2cfa2d5404fe281c8aef64bb1a08166d5f4f9c287830
SHA5123534392dbd2473de9a76d66b4d6c379754ecb6279e1bc66740ec5d170e093c142b4082d90e35c4787009c2397a3f5ea21af861e08ebfab8062521b68ee5e02f4
-
Filesize
1.2MB
MD5443db234c6d970f72f1903bbd939ddd3
SHA1dea73427f503eabf51cf5ba682295fc76bba5fea
SHA256b8aa50aee5954b8dc88717ec31c519890e26c4676d3aa13f0c38d8d4c9b4b94d
SHA5126330de604a7c3032c930c4a5b18d169c6c2e056962152b8154c6582a577a92d9cd2ff046181bb9e742a4e309f1bb04be609e4a311560ceb39c86bd38f5a6daec
-
Filesize
1.2MB
MD5d0e64c5ee438bdf5e73f1b1b7c8a8977
SHA1401599b42d0b7d034c4180070c08bd1410ed4822
SHA256ed64a92608dd75887941024fbf26bd39066792acfc56c08ea2dc0edfb464d49b
SHA5125333a800d081c735d1db93266701d066e8e5060807bd8a3b9f3e3663de638131e0c915eccfad0ac5014084a638209418e8dbd48b8358769e243b4fc6fb7cb3f7
-
Filesize
1.2MB
MD5cbda2e9cdc6488af6ae048902a7c8e14
SHA134a2441b63d7249c0d08696752dd695ba3d809fd
SHA256b7e844953e7f4659d04799ecf8d15694bd69873998ecb6aef12a3709163c4d55
SHA5125426c02e58778c5cb370b49183d53ba9d02e2e7ffffc88957029c7d40cbfa29d46b4dc9efffac1a91b0f501db57afd2d0a3ff76b3a48c38f668c85f374731e8f
-
Filesize
1.2MB
MD59e1a78e0119fbf205dc2218103c375b3
SHA1cbd2362a85847a04f49d299cdfdb0e632f8ea334
SHA2561488f597bc52c37f19bef3f3997d4c97dc2fdbb000e39827b6ec23fbff9385c8
SHA51202cb2765aa3ffae4cd0b3346a7df37408213d345ca5078f24999d4e98710a7401f0316956e56b8d3e240623278a49e784aaf1098a8a9922c9746929ad1c475f8
-
Filesize
1.2MB
MD55fb078a16d50fdc4c9d551aa3c7faa36
SHA1e89d1685bb1dd1ed2fe96777056639b34f403c4c
SHA256b00a4f1a15c1762186da961152dee94d75aaff8e3cb5adc669144a54336c6fc0
SHA512fb84e4f0c0530aace34ca756e5476ea79a2ebcc9f3243022195446b8f29b29091d48c88649fa820c09c332e9802abbee1de5d363ec3e72c8a8932f982d09f255
-
Filesize
1.2MB
MD55a9a639492875742f86b7b131d6d294b
SHA114a106a866f4459f6b8915265aac8b3d75e8097e
SHA25624eb090c2080f1c8853e41b0c9fd83e44b297b172a9783121e7b8bda5795b324
SHA512181d9f8046c493a89f1242b56634d71e367174378f5cb9badcf9442058f54ba3e6f75628ed0fe4e84551fc3a81b507cfa23ee2cfa20b67d3cb458e68ba9c5af4
-
Filesize
1.2MB
MD522b33194dbe16d3d5b1149d916bfb860
SHA1c57c2edc31219c1c882fd1b7802149f034a0a8f9
SHA256abe43261e5926d25a154261acfe638613d9ee84a70fbb3d73f0dd68d261e7118
SHA512e26965d0d6839194b6bddb588f3144db2933f2badcacd3144edf70d2a1da47a24f5cfe14de5999cc2e149c9b6c451e69ad4eba8635f30d95b8ab9f1ade715670
-
Filesize
1.2MB
MD5b44e4186aa68429e128b58be61855923
SHA1cfb25992fbf6c7ca6b74f6f72f9e2aef7926762b
SHA256c1cc3181ed147e47f0a59dcebf6845edaca425778ef13fa8fba420b72f4a6918
SHA512fb8f02b3dfcb3423ed69521fc43fe5fa7cde2262b2580167a9a2e454337e122d3591c0a2b166cf5c43fd09fe35267f37a90fcbd69fc37a8aae38c86b9a84f485
-
Filesize
1.2MB
MD5a5f407a6d7366e184f1b2bf5831f0e2b
SHA1732362b3ea7fa6df9f8549c9e318179d9eef2f7f
SHA256bc79efb66a3ac563e851fdd2ae8c5c93824e318969b0bd286d582bb53fa6dadf
SHA5128c03d5b07541a5ad40ee7fb8594cbc94cf9b119f153e84912537264525f185c4093137572e051d3df9340ce2642ad6950dc3684e7e07c8997823e02a61a23f1c
-
Filesize
1.2MB
MD530e09fde1560fc29a3a2837dfdb72811
SHA193e30c08bb71d4a255796c19ee3c52cf86fa5b98
SHA256aeb3d2962c0904474bc66978d8e1925c4d527436071fb077553736a88314aefe
SHA51274ffa33500af1f4954def8562c8ec6beea7205c5f3b17eebcae6ff990f99314ad71b2ab8e8ea450c151187f27b4ab8c1cca78a6b078179f6c6f98228eacc2088
-
Filesize
1.2MB
MD5a186c14ca091399af3ac20cb748d3eec
SHA14790191d7c809b6bea44d9704717c4907a22ca81
SHA256552d79ae3ed160393492b9aff8e37e646895484bdd2a8ce8b11e4e831ef012a9
SHA5127d74c4985e698afcf70a9f932c3b1de72352e78236d825f148077a0be47ff72a0918517afcbaaa8fb9c88a1caa75453b055272e35ed35e4a0e0564105c4ab576
-
Filesize
1.2MB
MD5336b0aae0887488a733f86e35909e706
SHA1521f05da8e976aad4c8d9aa9d9ae55bdabd892ae
SHA2565956b9255bb9f02e0b2f32cce85b4de210561d134274390916591bc6ecab524d
SHA5120859be5e2f5999238d6330e253d2a32ef59e3a539e583fb882d1e9ac8b8280d3ae7425a5020abd5e8ae03f8fef940ced0122498cc11448d81078729a0f2cb28d
-
Filesize
1.2MB
MD5c571c9397f7762ef366ed4363268693f
SHA1dff2cbdaae5e9dd9a09608e3a6a6f56f7a5be424
SHA256917ee35e599f565f4d247b302d3aa989916a2a76b71d35dd17da2d18ea0458a3
SHA51221d8d85e670744442c70726e1c9b5ea44a9c9b778eb6e80b3a12e89ee93d51c873f89d13d7805c54fb6392ce2b529732e6d5349caf79428ff3aec5d65afd75cf
-
Filesize
1.2MB
MD5240ad801b60d36509b000e4fb51fd322
SHA17438466c5ebcaa539bc52152958e7a9c2ce3228d
SHA256380e58fbd75fee85626a67cea739d75d36afaccbc361e46b10caca4169bb5cf5
SHA512b4e71c1569e436416f87f0e8c4887ea0d0983b401c7df537c4e63240e778c5b31e735a37ea60cbdddc105910683d00716351b470bfd4334308bed352565154be
-
Filesize
1.2MB
MD55d8931b4e1087be9cd9bc8e6dfa2dfc2
SHA18fc9247f497779e440906a53f81512ca65127fe5
SHA25686a50ccb2899dbe569f0c3a41b9f5ccea4b95e27c8617e8db61a1cf34aac336b
SHA51270dcc2f1c2cf801fb5b6cb1c8802475e763b0aa35b672ea56c30b4bf6dee04d62e261015f10350300599812db72da125265a5a1ea04a986b59b6294e7c19514a
-
Filesize
1.2MB
MD52f93d2c3942b0e1d1529ecd849fc0bde
SHA16da4341bb5f6183069143f58535160cae4764d2b
SHA25675abf8030dd2841a71a3c47df8df4ad4abd7ecb0534ecbf01e620d5a362c29c5
SHA5124ce65ebe5db0a0cd9ade97efbc5832d4b0cc63986e249106141032f54f666f866fe689002b967bded4b8c15327735564f496137b335e0fd1f3a191911cda7042
-
Filesize
1.2MB
MD5e2bc0b16395ddd9ea39206aeffcf5dd8
SHA149ba25f14145eb07f1c60a0262e097d3651d4547
SHA25660574e4ad75308dde066ed614ef3d7d3498f40ef2f304404871a1f9f32790e4f
SHA5123fc29f9038d93a1952b53e0bc9ed495a6439089d27a1c3379de5996c0691762a2dcb9f874f221d437f4bbc56c9426165d9059aad09a64895653a9f864476f56e
-
Filesize
1.2MB
MD5ffaaa69b1f20c3b4a25fdc52b0914493
SHA148cf9ede793898429abf35f673c4590de3777d82
SHA2563ac5fac68d06f8013bcea23903b10178b15b7858fce0a31f7017175b1cb8a327
SHA51271097260d509613f2be14276bab2ebe697118ea97084e28df76b5adace595b15a39507c5702c9a69ceffd64e565f90b0f99d5ce80b5cda87c7e4dd790b057645
-
Filesize
1.2MB
MD576338480fe3da0a61eb2d61c00a7d722
SHA17c4fe977dffcfd9fb08573e9acfa1956ffc5f96e
SHA2563b897c4778adc675b3321f830311dd9c972a5fd0a527ed5ff240068de0caa29e
SHA5127b4d26b62cabdac4095cbe11f7f473441ecbbc6a85b18c0f7de35e23432fbb59a7fb6e6c1ad745b4bb28c102744450cb344bb7a8287f5673be0815402880d627
-
Filesize
1.2MB
MD5b5cb4309d5f66c13bbf1f4eb9f4c9f6b
SHA171049537388314cf3e84b044c30dd2e56f9a39ba
SHA256576098211e94404051c4011625d1029abc9d136e2001c1a459376e6bcf8cf318
SHA5126c86b3fd44f7d2636a6a58f78d11ab6c10a8a38c17b9f905eb3671c5949ee109f626e1e780edd1d8f5d0d22882373257bc05d03ae1043443dee4015c953f32eb
-
Filesize
1.2MB
MD5aeb68aa2f2a6c9899eab23cc90941b1a
SHA14d010d92cb6a3cb2e3ee902b725148c515212580
SHA2567dfb2d79f833b25e5d0f56843e62422e1dfb87de1eb729d796ea454b7f435933
SHA5128e2158313bc06c1036b6c525d3fe8fa03844613e476591ac65396c2e11f0a32dc5de4d2a6e72e7d4f264b6bc43798545b9a573eddcb65c3621ca1911792467e8
-
Filesize
1.2MB
MD5735496fadb4f592ed9c105b1b41a1c9b
SHA104d790293e5c5b2372e5d890ccb68113b60d00ec
SHA256838a5dcc85dba76698f810ed1060493787d26c6de237ae0d24b6287b6d6ccc08
SHA512dbfd7259467cefc27eb566c95a9c0b71c68bc4f7b822fc0163765e1b24a59b03284ddd1d2b33fa0ccf2f0ce1cc5358efeb1360298cf41fa25e2d7faa920332b7
-
Filesize
1.2MB
MD5a1233f2812d5de7989cb7dca9e42b482
SHA1e8be211b2ed9f6b9c25b10cc7bf2d892604e3c73
SHA25686c2463bdee97dfccae10261aab4a66245de7e99bafeedfee6fbff8b69ddd3f0
SHA512da6ee52dfab917b8b33272db68137fb8934bc5f23de81318b39f10fe9e389d8f611689a4a89e2036ce3082f34a78d31f3c8f8f916d9e9de7367889e52e6b06a3
-
Filesize
1.3MB
MD538441e6c9ce0d47e192826ffce7c5aa2
SHA18c840fc5ec607a8b35305dfeea7e63e7c9773230
SHA2561ed2288727c54719106390fecbed3092e5edb98eb660a7dc042de9584d6c6fdc
SHA51253d3bb3dfe8bc810dd2c7d50d7e435482d5cfbc58dbc9987e969117fb169a9f12cb24f2a4e7872c516f37abdd4e51735eab10ad1005ebd66a15971fc542c301c
-
Filesize
1.3MB
MD58fcfc78f518f96c37803feba6041a163
SHA1e019e125639d32f6618774367bb38caaf33dd938
SHA2561d4d6e8c5e88383363500d3575947281b9928dfd799ad0cb175a81b7eb9d61fc
SHA5127a4cc00580d6351094c9a4665bca4f338c629a2ffc1922e70063fbc1d6668f70078c785d0cc1e92ea9042dd35ac7d1a91af0265d88dcef5b4f01a645c896b894
-
Filesize
1.3MB
MD511305dfaa1b6a176bd4a889f2c9d1309
SHA18374c50a8ad0c34e57139e85a16990aba76d05ee
SHA256d9ddf4b8fde6c880e017113e7536f301bdf9a0e4107f9c159585fc76937043a8
SHA512a86752a4fc08b8ad3466a04dbe7c7e18b6c3d992ac3da75e13d641fdd656ef32ebf3b1fa374a22f374fd8eec1a57f2d98eee5f977ec7e7045584f2ac7c21a255
-
Filesize
1.3MB
MD5508672642bf8375011ff69db754dd56b
SHA1b9b2130979327ee2b4abf0bf3f719c5833e8c6a8
SHA256a370c08d514ed19072ecef3f5051c8bad703668dcb0f31a06ae5e46c8e9c053c
SHA512a2282ce782233690573e7c1421333464341d260fbee8f580af1800be8a3a5d07b9e2a11f9f65bce429ef14251f0a0f7e8caf87253091bd4cc579cb75db261590