Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 03:41
Static task
static1
General
-
Target
9a3f50d68f7b8a74fe50746d7fd24580_NeikiAnalytics.exe
-
Size
972KB
-
MD5
9a3f50d68f7b8a74fe50746d7fd24580
-
SHA1
6ee3cf1d9238209ea3877fa70070423bfc57f381
-
SHA256
20b26c696008dd67629bccb186188b1789c05bfa9cc2d2f601ad6b87a49063bb
-
SHA512
ac59fce52c393f2b89cfe04ebc980174d564268356a1492a2764aad73877e0adc59933e346579842bda70d1a057e2e04a332165363fd0bcc53d981c96d00660a
-
SSDEEP
12288:Hvu4VrUx5YyB8uthOGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Ge18ntzt/sBlDqgZQd6XKtiMJYiPU
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 2604 alg.exe 3128 DiagnosticsHub.StandardCollector.Service.exe 1000 fxssvc.exe 5556 elevation_service.exe 2968 elevation_service.exe 820 maintenanceservice.exe 5716 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\cafdb107d590e271.bin alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 9a3f50d68f7b8a74fe50746d7fd24580_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 9a3f50d68f7b8a74fe50746d7fd24580_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe 9a3f50d68f7b8a74fe50746d7fd24580_NeikiAnalytics.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 9a3f50d68f7b8a74fe50746d7fd24580_NeikiAnalytics.exe File opened for modification C:\Windows\system32\fxssvc.exe 9a3f50d68f7b8a74fe50746d7fd24580_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95296\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95296\java.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 9a3f50d68f7b8a74fe50746d7fd24580_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3128 DiagnosticsHub.StandardCollector.Service.exe 3128 DiagnosticsHub.StandardCollector.Service.exe 3128 DiagnosticsHub.StandardCollector.Service.exe 3128 DiagnosticsHub.StandardCollector.Service.exe 3128 DiagnosticsHub.StandardCollector.Service.exe 3128 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3560 9a3f50d68f7b8a74fe50746d7fd24580_NeikiAnalytics.exe Token: SeAuditPrivilege 1000 fxssvc.exe Token: SeDebugPrivilege 2604 alg.exe Token: SeDebugPrivilege 2604 alg.exe Token: SeDebugPrivilege 2604 alg.exe Token: SeDebugPrivilege 3128 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a3f50d68f7b8a74fe50746d7fd24580_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9a3f50d68f7b8a74fe50746d7fd24580_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3560
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3128
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2444
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5556
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2968
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:820
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5cf7d6faca232db61cdc1d68e8eabd88e
SHA1fc7dfcb888ecf99e547de57a1c6f18e311939f52
SHA25616e2d7090dd89bc554a87e0fb1435dd34f11811f32bf8ed7a817be941d11fe65
SHA5122191ec70aa8df03f133c563ef36de7f12aa25e008713e6a819091d551169e22a2e78695439245a7a9aadaa441d7abc44ddb8f0a88125bcc10134f2d66551567c
-
Filesize
797KB
MD510db218d0050c7c78ac3cd99549cf454
SHA1412afbbe14add2ad158c3202f5ed498bcf54a503
SHA256a3259ca2743a1e6daa8b9fc541b5c2dd3081d175f1f675edc0741f030f21c23e
SHA5122016f9c26a4696027dd50a506342b0dfc486e7c7ddf50a4c480e3924ccd5e80c041618254b3128324f637ef438ab671cb38482d6f5cfe8988b60c59b96c25e36
-
Filesize
1.1MB
MD54552d23dee6cf537a7a185cbee868759
SHA1fb05e8720d72116cf1480dd6da9e0758acf13e34
SHA256926d3c60c68b5ee4b61092854d4218ad3867592bd01e1b0b7ecffcadb8daeac4
SHA512550a25f07222d154165c6c71e34fb787dd736b073a9c3b6de45b1ad817b0de2d41ce2973b45460b5b3fb5b19e87870d8b3c4ebdddf26b0e7e9fedcd69d951f63
-
Filesize
1.5MB
MD5ed2a0a63575d521a0d45419823fa39b3
SHA19ef01f0cb4bc7cbd070110c1a35713eac6a41c92
SHA256a1cc0062d7fa3ecaa0b272c765029ace4d865e0c93fc4e394dd934d607fe3993
SHA51222f3eac160365361b75767813f465b2db4a220fb768676c51fc330766e6a824608a6859ca5f11fdca84c677e2cef1ac6cf1dd4f6d775f107342e96aa8a9ce315
-
Filesize
1.2MB
MD5fc5fa6cd12bb82dab682f11c5981cf60
SHA19662eb340da4599f3fb1fbb98957cae7942e17a2
SHA2566ee6e8c75f87a6cd9219fa977b821fbb2b044d1e94dafc2812b47627cc84b683
SHA5128f41ed61ae088deb586c531948740e3d14745c9832f4a55b69a64ead4d2df5f3d0d035dc81729698a9d94203c3b74ab01e7922235f1622c05eca65854e8ab14c
-
Filesize
582KB
MD53efc5bdc1ccd222f57c04cbb975ed06f
SHA11d41dee6f692748c8960b23b9b50bc82b33b1932
SHA25697bb0b96d4322ce8eb70196dda7f4815701fefc6cb9b79af02027ce97db4cc0e
SHA512f19b294ce7a471ef1a7ba9718a784105a30a754058b3a555c5814c464e4964f6d6330c777e7d200d0781e1e049c749bdd6a3993e3c0c156fc91c4157c9540c9e
-
Filesize
840KB
MD51c07ea1a6a75a2bfeb107a57fbd08637
SHA1f5b8ba520bb04d818bf3cb2f76c6c78e36062367
SHA256d297db0476501efff88ded435058cf16b9ded2772684f51d30a1f25b3faeef10
SHA51254a5c0882d4811327a040c8f1435ec276163fac1bc9134568ae29b359b8a746f8fe0941bb80d2417ac248b6e88b215f456aa7964ba1c6e5d4ce6d3dad3d0bc46
-
Filesize
4.6MB
MD5cfe7f4ae7f92a56badb49a0f178317c4
SHA1623e825c1a83280e6b60269cd7786d22f939b5d5
SHA256ad96ab7432232efb0e1ec5c4622bc31681aca310493db4a5a56db5de656663cf
SHA5120d95d677958404352de801a27bacec5ebdda50a43b294c086cdbc1b5f6b7dfde3382a477fb128993c22d72743e11bc8cd418fd8bf6f06c0088a8aa0c2a7e4f29
-
Filesize
910KB
MD5bd75c9613833a896eb7d1f45d7d069e0
SHA10bc974b27f5c1833027880d99cb2adc9a439c29d
SHA256f2710fc3343a6eb345c4b58312573c7e3ba8b05fb3c594a7b261da187979d21f
SHA512ed6ce8b8526d6da2de8941f2a2a55c5635dd7f8bb6694bd04b537755d285c2a02bf972b2f9d9dbb8f2ef21c3da81329cf01ecfd37d379defcf7ccef9d5ad345a
-
Filesize
24.0MB
MD51ff3a09a413fc45b7e0d54d627e507f9
SHA1410af384d50f81a9ff02dc2d8d1d973ee7b15bf8
SHA256ad5c6624aad0a5a28912ae227c5cfa5035f85349691fd7c3e44062a8a5f055da
SHA51228dea26cdd7c4af2a0595a229dc77c304e4a4181d271acdec55bf5617f47818de18507159376a516dedcd88ef215d8fe6544344b1ea656707f0057a39fa7327f
-
Filesize
2.7MB
MD5d66e9c9a90adcd9b3e81943f88460acf
SHA170e235d2a35bfecd86116899023d1e2af9517fd2
SHA256b22f6d5789b78b9927b74e90b0f9f5ef5fbaf0cdf5febafa7d77617b0eee4324
SHA512158eb9906f738cecc81878cf1bbde27ec2e5b802b364a2325682ff3db9daeb55b665c4162f66dd9d4d3c085e99e06dca7d89db5a1fa5db2c182cd2e027fc50d3
-
Filesize
1.1MB
MD52d02992bc6889229a2425343a3df18a0
SHA193884003828b393d04c4220b2cc7d430ee74f1a1
SHA25617064cab3f104defd769d50e219dc964b044bb7d9756e7f3d96f6c18d79d1bb6
SHA5126a3af8351248436298d50de61da511fbba436d3b61ef581bf34b2ff483b2aa18b8990942ad2ad3f00db9256c21600ee3dc2948fda54911d22df8434da3c39241
-
Filesize
805KB
MD5f8d48de746f4c83a6dcd1f7bc079c767
SHA15fea4d3dec973537df790f12aaf3a55f41175f68
SHA25678757336c109a00721755d4a32c8080f6d108f662f9471776d658cfbba525b92
SHA512ac4496d4d2a12b39fb074eb63a02cbcb0bc406883d7252ff325c728e47531fef5420445726f179efd046bc2174ba2e6ca7b2bfdddd834b4a6913bc5b91d1a861
-
Filesize
656KB
MD546c116dd90b7400b84080181f4c9138f
SHA18ae7d84f3b676c5d2604a88e88d4d58b8727bb20
SHA256777e38fbcda5371996ecd17ec29734ba3c757b328c5ffa4f0af3777848006805
SHA5125164552515c8c77ba897958c3ea0ccf6f2f1174748b5808c5c3e8742d73dfccc3421f0df90e622f7179792c0100785b4cb8566c28d5b62ec2a6055afb5054f7f
-
Filesize
5.4MB
MD570b1cc7c4bafb5f546d46622420ab64b
SHA17a38e7a9f23409e3f431e9766948268d49f93c26
SHA256c92064ce569353ea9bc21d5f37bbed6f8a729b5fe42c11e451e9e951a1a1d4c1
SHA51225402d14530ba14ad57d29c91a35676b078a67f69306c35b04b9723deed73a4b1aafb198a828e7b2fc5b7318acd6814cfc4d801f877c84e4d2bf15aabc03ad13
-
Filesize
5.4MB
MD51fc733cee95f9df3896a2ecdab9562ef
SHA16912b143783e0cc68d45abef31854831dfdc0921
SHA256b06175ec9a8d4830342d240368be9ecf9166a08365b7fc5c99ecfc48654672ac
SHA512347edc732184899c70e8232b2cddd6ef25b2cbf1038d7fe2e9e4fd05d4b44e6bd5409cc04d3e8936a4a0e2221ac155bb75619df1e5b6f3fb7fbd431dfc3e28c0
-
Filesize
2.0MB
MD5d866f70e4a333c3832e36a5a7063dc73
SHA182eda149b63e180cb6a1ffa0072feddce1712e8d
SHA256dd4d247f89d415097586c88db87c968ded220610e7a07dd96d7778e9310df64f
SHA512c0f3de857a8bdb25fe48c202873daba9ce145525036ed794ed84bf4f7d1d27b6c1364f2af4f30133f9bcdc35952e2f94505614947bb072b0633d667f7de2a405
-
Filesize
2.2MB
MD5f013bd330e58d831630c35f826c17944
SHA10dc4612475a6e7dd74b0c62f24ef00377af7be24
SHA2560b20af8f6f160993c9b35da0f2a07c8dc20eadc2f87934f89dbe7ffe203076d5
SHA51290a237d08d33e65de1d41f62a579d9583ba00532882da3f51cd897659a79de05e9ef44249b470bac2a44b688e4059774ffeef070806784c5fae8826755868c06
-
Filesize
1.8MB
MD5cdc1ecb6b141af1b6ba668b4b8d14b2d
SHA16572af13237ad5a6e3071cdb6e8f81e34c66f8e8
SHA256c7948e3a991ce965784fb9f185c42f417ee1a329ca1eee6f6aa8e30a08eb981f
SHA512367874c58301fefcf2f848f5d282b1f5886244edd4313f7ab859c5757037a25d8762e916aca80aa78740af83c4fd3532f858f366c09ebdfbf852cdba4ec41960
-
Filesize
1.7MB
MD51bf555cf29a1796b3db293ffdb569bbd
SHA1c035bd30aa025b1664c6a1ded53da94d9312b52c
SHA25699793d36212bf00bb02702332ab18177ce65f99910b77b30bb1189bf8be73227
SHA51235cfc773681f20b0393be7298ed08435b2e208cf12165d20bea2dd61cd9127761618c5eba8c3fc1a2a04ae690783e9d36a1b5fa1790afa326b811f56e7a0d508
-
Filesize
581KB
MD5e1006ecac1ccca0f3c7ee95ea0d8e551
SHA133cca9daf78e455ae2adc1ed807c46fd14d1f394
SHA256760b277ec6f52048127071cb15a1199041207573ceae0c348736cea19d3149a9
SHA512bbfc1307eb9926bf965cd2e4fbc1e9764e66dd42a9d048a82825d7f91b3c409e4e9152b884c9a3db945032f045179783faf50fc6bdf09dc0abbdc1200fb00d70
-
Filesize
581KB
MD53c301c30731bdc7a40489e33351c45f8
SHA120ea2893e2783b491940cb1d8e87bedd3ef41ba7
SHA256f2f133264c89067afa0ea85f0a98d6135ac75d99fd2fa38cd25c7fa7c04af072
SHA51215d2eab324e2f1525f803ee45dc16b1f289b919c48e9a55fae80774b031cb845335b5e7485361c04646244ea787fb70421dc837a8d0e38e3db5b2bf52c6ffcd0
-
Filesize
581KB
MD51aa0d01d549cce6e0849f392fd906a0c
SHA132309240b260e7b97bc9035699aa11e657489dcb
SHA2566a8ba9393fb8613f5a1f319a3ce5f8bba168897fed404828d372f61f7717600c
SHA51210050bdb4627a0afa830c7646f8266d632841889865b238807dbaa493642b5267b368924d4bc4f79340f8fb571fb1c03a57502c310e084d821a0d4f638ff015b
-
Filesize
601KB
MD521d0648425347c039d82f570591c5439
SHA1875b5f60fb3cb4b031f717c241bfa09b6c4da631
SHA25622130e4f343877b1a8e40cf410a040001c3b1fc19f127d1f74326558ca4d0171
SHA51252a1073bfcd819fe9785c903ad59609920add6f76f9efe2780a26e172c756ff93db49a183b1ab0213084c7f5d7d08bdbb6a7794ff6f8265eddbaadb73c781b3f
-
Filesize
581KB
MD55b4ed9d3a3a9607c26240f4da0c34f67
SHA131e584603670f5c55ba3e2584fb9e45a7448fd21
SHA256bc3c68f51ee0f47bdffec920f9ce0c9a4c45e574d041d76fd8da0cfe137105d6
SHA512ae722173ce739d823076484c68f1d457beae5d39598661fe6359c25cc909d94dbb5b1c3c8cb38d82a9c1772847738d9895e52e81d4b4d7e9b2ab3335a9e0bd78
-
Filesize
581KB
MD5e16b52b74ef218766e0109f31759a6f9
SHA15577d3a06744ef1a41f68ba2f38c1ec38f1af514
SHA2561941f46f0c891360913c2d5e1344503c46eaf06fb935f942b1070414345283c0
SHA5126fd64df1926f7a0c54d0cdddc9e22a91af6d35433d32cbfc30e0b49f0dc0eb3f809900115faf3452ceebe4cb8c35aa0e925c0ed453b592ed2b0ed598cbf83f72
-
Filesize
581KB
MD534d9d8f06adc63b6f0fcc87dc172c465
SHA186e6c8f3acd9965aaead07f637a6f2a0b95dfe83
SHA256a041343395dad91a9c421a8f4f4ec8932a9943044eb4f41f7ef2e4eda974f447
SHA5128301754b9291d39a8ab3b24b71c75717f8ae1210d8809d8611e44db504b873b08becd23678ea13230e350da2f51d10dbac475aeaa9c90708ea720bb278e33608
-
Filesize
841KB
MD5d67aa52398f901b69f37bcd2717f3088
SHA13573f28b3fb0fe9f8bf96fc3336ffeec55b65142
SHA25664bd6d1c752201bce3a65bdcc7b01b62c82e69695eeb8767e899c0124775a2fc
SHA5123977b73f7fad335c9e875a970a13d91be1d8b191d6d86249e98bf9925cd9e9a7bd6b3bfeeb6ae66b2ca2607f1c32826a49aedcbd68c33ac418d5141f14599a08
-
Filesize
581KB
MD58465562fbe7b306ff6731a3eb05ed412
SHA1f6489a7d6a72f6aa32c9d81d398c97f5ed2d6302
SHA256bb26a83814f18ca501f7a70f0f9a16869845d26a5647f1c7aa0553f2bd12fbfa
SHA51204ff3336f40d0fc1bfd9affdb114a4ab1e95c14002a1bfa73973e527cb24945093c28f8babd88f67be5aede0310b64463ab6ecd8d65af2cdc189669a702b5e0d
-
Filesize
581KB
MD59a76c3d1fe67d159e668b40d0c4c6745
SHA123be425d6baf71fbe7546616f21d704aa7958115
SHA256e762f334ebf915f718db8c8a0b999495a83eb48d0504f9de5174d6553d3f410b
SHA5121baed727808ed223f2193d671323863def5ad30c5da958f8d6018125350a84562b545c11221a4c7383fb5d8b1c7afedc13e1502d777dc0a634e079623f0fbcc1
-
Filesize
717KB
MD5fb61c1da93e7e245bae621e58129e470
SHA10e46a39ad94bdfd75ba9007fbba62efe8b2249d0
SHA25662027ca9bd97d1faa8766ac7c9f77167bc2814b7d9c3d249d4547cd1f234f8e1
SHA5123e954858f0716c24d98e2c2388fd1c9e6bd59f343beaa01428e5f8466c01df3e6c878451a87a7f7ecab33716e41af4a5684332c97daa8a684dff4dedcda45e25
-
Filesize
581KB
MD57e1b566013d321cd8da82bc196c7dd0c
SHA1875e3df5427b634ca75546989cd4cef79387ce6b
SHA256a65c3db93f7cb0645e37de5238a53f390702f49f5af8280cc08642526d2dd650
SHA512366233dbdc298319ebbe79da103a8da3eaa8fa40737550d99be4b27c9087aaacb26aa68c3b9d6c408ddad096f2e278c80967b2d47727150bcaac8a6a6b58c540
-
Filesize
581KB
MD5b860c7658fc7e2d60f2e2597df55fcce
SHA14ad37bf10808ba49d8e8fd8628c689d78de41754
SHA25683598409776c3d6d4c733dc4d0f409912a5d755317ac6fbb70d44682384109a7
SHA51262ef09927bcc65bb516886d525df986b12b0495d8703496d1e91b2f49be8ab06479452fe7c988e707a38fb3f35fb4964f0fd162ef04c33aa66d45d329409a145
-
Filesize
717KB
MD5b063fea668b46a9a77494077d8fce231
SHA1e07967f98b2a5c297b100a471aefe5dcc4c66cb8
SHA256c47b124d42979844c8e6b5a651812c13499df3fc81bb27f753df6692bd5eb243
SHA51282ab06acfbe16020c482f813e653bf743ea8cac90335a002210536d4d6818abbb7ba7890248123bcf32d9b66a4228e3a8872369ed6a442cb0592c495ba915e35
-
Filesize
841KB
MD5511793b7929fec6f45bfcf0da09ab15a
SHA1eec1c2d960731199c45626430c61159c7412bd39
SHA256d8502ddf1c6b9e90add021833514b540e70ba3702f035fa0489ada90f2f50682
SHA512cbeb5451af4b9ee42877572c80ccb6369097f48094f37e1fec60a6f080656e0d7485774e0e4c8bc03d0accf0a8da733b8be4c3dcd276207cb23ecc0dc912990b
-
Filesize
1020KB
MD5d235b984ef2b776d55d83e6f2a5e2a48
SHA11434368dc36d640cc903f957cac2991a0166a3c1
SHA2564b8f7a6734a52948114a8af23468773e83da7eefcd5dc7d55e09ad67ed8758a7
SHA512f47c128fa4e91bd12fbabf8403f506ade5fef4ffc9845589686fde69b26d80b5a125f3569e2a24a8b6025b8421eaef6e9627942baf85a357fd3c57ad504cab5c
-
Filesize
581KB
MD52eaed9a6c3f8905a81aa4ebb8a47a061
SHA188463b1781bf81c49cf6904682832791159822ab
SHA256f8489b27290b1a44130f0cc0498d691a4b81cd5c9ab79a3c95f6e55a4452748b
SHA512821a19e61047ab72c058bf66686fcd080f86b453634e6cf0f4549c32a390c0898523185a0b350aee60c8c4c8c8ea9f94de59626433caaa1514ec89bf7955f1f8
-
Filesize
581KB
MD51c5fd6ba3c24bca46d1af708fe8bd8f7
SHA1da36c76616ce30d56d92b56135abd3c3dd3633d5
SHA2568d0e8a84d4b49e33e0613a62d9bf165a1a0fb8079e1dfb31aa4dcafbd8b01606
SHA51276f6dd6ca7f093c9104842968189958c00490912a149f727926060152c6069ca8496bfb5ca4293b913a879ac0029b6cbf2efe46aed4761299920da541eafc7ce
-
Filesize
581KB
MD552768f9f87fa9f899df5e975ece7bf55
SHA1b52a65c9461d18516c78cd5e2a96d3236cb4e89a
SHA256355f99701c13a8bb062125874aaf00d07e84b372b0f2f088179763ed4c465079
SHA51234904a1a7507d44f633e61ebed20430897f172c79ffb3a70dc4626b794b1c39cadabf4f5c1549aa6abcdc98bb1aa2257ca58aa8843d427186b031c5dbe173cb5
-
Filesize
581KB
MD5363b59461c3d8c11d12bd93a2a8fc5b4
SHA16177264a3a0ef4d30601e29ffb7a899a1e868b62
SHA256fb3777a6c8c323afe986385beb147dcac92d327f7d04087f2fd24dbcc6382904
SHA5127a345c2c8f575578e0d1a4415947c3214073d3b5b1b9d4621fde077f5d32bc3f5c4d9dc94372f77ffc700281ddd3e55ae3347a4f1d41613828b7cc9ddde04af5
-
Filesize
581KB
MD568c5d8819c2ba195f0bc5c777110b643
SHA12aed6abfbf4d9ba1254cbc8b69f42f1b2e35aa1a
SHA256aa3a27e74c4ba5a4a21c50c319c76f1fcca988470ee680141857d1ce01303f3f
SHA5128fa8e6bd52b9466e0e57dc3418fe9b93da748dae5fc5fe5c0e94fadfba488af4c15b9fe2b5af5f84e40f7bedfe55ffc0f9164da6bd8fc08c93fbba59fb7061db
-
Filesize
581KB
MD5ebbddbb9453541a6d700203ada2d4ec7
SHA1d8cb8f56d1fffdbc5eeccca933321bfa2fd67e61
SHA2568fb8f47a3fc309fd401c14aa28cceacae0293b838071cf3d50af400585ddd44c
SHA512bc0827d7981bb293ce2dca9ccbfacc217217afd414a2512063b1d28dc6ca7bcc4386ce93e31f9cf0e8b617ea19d1ff65137626323c9bc15fc1cdcd545928cd75
-
Filesize
581KB
MD5f5b5eec66cc30a54d79f625b82e10b01
SHA1a854b44d005d0c3eb27ac328fdf4da86eecfd9c6
SHA256b39b86fd370ac2f366ef357e5b3b30395955233ad4efd8c693db71821e7e9cba
SHA512bf56d95276f86393e18db7006341a6c1ac49c034f6a4e6c0d8d828d56144509e1152948142252c17802e5b6c468446b34a9de867754a3e5664e7fd05e2a7561f
-
Filesize
581KB
MD520d3a6c5ffd62b85fac42a6b92bb9190
SHA18ad237614fa80a81fd8977fc193b6ec5b467ae46
SHA25694ac4944033dcf8072906e13cc911bb17ba3f73a7abd7b5e6dead6535f8dd03b
SHA51263ea1272f7aadccb350b9baad4ac6de71d28bdf9e0bc9358f37aa16c6ebefca7b4fac1b363a619fd639d2d6ff7b22919aca9b3fe71bb9801c6021f9bc87441d7
-
Filesize
581KB
MD5eb000abec10a208e396baf4ccf4ba391
SHA14391b472b82b7df329fc53c5dcb5d14b19d17ab4
SHA256547743bf6bab5242dacfbb3474137b4b20260cdce7d80918eb77e5499de6d55c
SHA51295a6387269fb3284d0c4840ab7f8f54bd2c3e11e0e8c259674eb76becd3833db080479b5a689f61394627755881783509345c4c999d67fcac733e44f22ec8edb
-
Filesize
581KB
MD51386acf6dc138ddfce0b19476652d6bd
SHA1e826e1fd490e092fd5b13b80b5ebd113802c4c42
SHA25677b91c213a0e25bb3cba8174eb201915d76821b65b8310170b33d4182be69f21
SHA51264cb1b5f5534e3b02be329988c75062df2747cd1c265f60969f41c36d8952f42f515632bf1c79efbf2cad67c1ff177136ad71893fe27f843f7d35dd4a1564a8a
-
Filesize
581KB
MD54d630be4c168b1129df843c3227e8e79
SHA17d54e1774b2b4a5a90348664b756c3e1efafc4c1
SHA25664747c2bfcfdb2018487de0926c8d45cd9b9534959701bb0ede448b0f407f9e4
SHA512d61b0bdd34995632677aa94bf8dbe1fc2d8f7ffb25a26511988228741ccf2cde24138f8113427c9381432596714b748469b40271bdb31124a4affceb38b5e97f
-
Filesize
581KB
MD58348fd00432d1b65430a324044491ccf
SHA19d665f6663c83b286000039edc8cf4415385a9b1
SHA256f9c1156d0580e78bd2ced0aabce28279be56c23bc9534a56983ba30bf37fb9f5
SHA51233508d57863c69ab791dd2f849e10411ad20b030392a550fe45e8740bf236bb1470047ffada5548ff120db70e933902f0ab42d85adebddfc3f60c9989975c837
-
Filesize
581KB
MD55ae867938c721f4ffe9de4c3adbb7b74
SHA15a0cd1870482e6d669cf9a417a9c154ed3ffe77d
SHA25628aa96e31cbc4c0efb33a0f32c67a9631969132911bfb3ccf86cec9dd546545f
SHA5122b2d9e32255a9b57014e8de815f3a81caa2bf5f76c4478b9f44c17da5a66b96d7f9e39ce4288d717be268f67aad42b2543e8c63eb02fffb4520a82dfc16c2365
-
Filesize
581KB
MD5b382482f6d442d4f1611a73509d6f5d7
SHA1f1e37d9c5fa24a69af2590b6a12ea895c42b7188
SHA25672bb2d5e94924459fa4c7f372d084e0d75dfd057bc458c96e6ae15ad1d3ee16d
SHA512a379ed5bdafd2f897aae6352d9073972b1cd26407b11da25da2dc9e5e0453783af6da340d3cc08cb8144a35ce9bc5f8e272e719fd546a427237f699582a259e3
-
Filesize
581KB
MD524ba0da96b782fd880e41706495e9a79
SHA180032f24f48d7e45618068033e58149daa70bf11
SHA25644268ba8845a619f32866bc1a858aef46e1a3de17c98426eccab6bbeb58ec951
SHA512f58c47bf8e0aedd6a6f85eaa0d6a2e1033bd3ee6304c7e950b1d1415a86d576ee94b9ab1974b7956385e780b614c643b84231536234ff8b85992fbe4185e8d89
-
Filesize
581KB
MD58c5cc2855b2c7d1bea3bc3a1dedfe9f7
SHA145f5f556447a27ae58da78d3f11e5b54b50e4e5b
SHA2562ea2bbeff78dbe6e51be5fa9a5d6517e8e76fab0e20a5216ab8403db151a5b48
SHA51221e062020352ba0ecb89bbbf5b972b883f2fbae7b0a2218290a5b98ed591b9b5a8d9c6f38591e725232f72e9fa85a2c3007fd0f518340c6b31930309b30b05ef
-
Filesize
581KB
MD56e18578517dffd4a6a6467ef1794fee3
SHA152c78ffb93ada7314ab6bd4452f60fd457d5b8aa
SHA256ab26bf91a6c37ebbf8e4ae52880eb26f936d768be8cb4e20e1b128b128ff5644
SHA512c32777eae710cd2fc09afb0ee62a0798ae9501669d984eb191a1948c73e774f0543e1bc89bbadbc2ba0fa4aaea2e4696e2910c27e9e6045069d3e65f4ebae9ae
-
Filesize
581KB
MD550c4661b8e49babef3518975d50c6654
SHA1ec29fcb94bcbbeaceb61dbe0fe46fdd37dd05fe3
SHA25604b3031e8099908f2e622eed4db23e2bd94184335c0ea5f88d4eaf8cd4027684
SHA512eaecdd3d4bb0f47d5db6e597688dbc5902198341b7d0bc6caf4c472f4001451328dc92c2bcc4530f47c9baf0a2a318bc93d959cb2d626fbd6dbed3c37c80592e
-
Filesize
581KB
MD5725aa6bd883b7b3fb25e7e1ad9012c37
SHA146badfb8d1a98a36a18b9dd5295e2db5c4372054
SHA256065a971c11e8ee81b418c808731e6212a4dc2cf5b46d3e0d5b2ccbc6a1f87b37
SHA5127712fcb541c402df3ff2de081135aa80d4cd39f825c74fc5f8a9eab1a9395c5cc52fdbeaefd46286ae3dec28e466d452c57cbc063fb126f8095355ae47cfe28a
-
Filesize
581KB
MD538eb00a2b40bc13d44fcc8ebac714c92
SHA1a46c605901cc1481db3bee30f4d757f1b415e7db
SHA256ad8ab8a38acde7f2ece824ba81513c0466ea0991b7b9b35120bbd279a932d85e
SHA512cc78bfc9c2f907777700e8f2209665dd6f8f3faccbf1b1c20035d5384ba9c8ff3b639ef90fcefde8da92bcd8dc1171ba7fb80d85ffca9b6ffe8a8f1980042893
-
Filesize
581KB
MD55cecda01047c8494da7ea38a5d05d5ab
SHA132ed26bfb1fe5d249a9635113d6da193523172bf
SHA2566f0cdcaf57ab8589cfb0290c68198baca372a312d780016ef199f3998ed9bbaf
SHA5121e482eb7ccd72237352d2c85b7a5b6cd54b691a87af928fe9338ffe14d7342cbf17207e4f0410b73717b0a1d467fb435581ef757cd3f41ee12efc4ce38364f6d
-
Filesize
701KB
MD5dc7557e064df10107697831ee6e27af2
SHA1489d885622b9a919f9d3a6128e2d716cc18fc650
SHA256f98961d5db38b6af383823dfb051551e111a9299ee9a5a1e68cbf80a4e0a1dca
SHA512563540a5bcaaa62a61bcb6b2a62c565884b0466429b713f4e455c0c189a9bc93279c1ce43afb29297594228cfd92537074fa8626c082c9cf17dcdcf5ec32100b
-
Filesize
659KB
MD5aa049d07160bd9d622e20b16f0cbd6a6
SHA16eac7e2c125680c8a83bf0439964fb472b3a0449
SHA256e0b951ddbda4638d991d829dff6f3f437661bbc44908b646062cfa2bfed0465d
SHA51274090aecb40b2cda2490302e6626f667d06657cf2021776b5dd33126f4836242ce07b89aa71277abda7c06a9c2eb0ecce4f40201cd274e6d3e63305003f50bce
-
Filesize
1.2MB
MD5782677cb224e9dfced23cd0f05e5954b
SHA17517e13ef1154cc156e21e8a5ad6f690d86b2137
SHA2569457ee6e7bf770555cae2ecbee7a8c92060d1c05d2e0d611c12f27cf8f6ec698
SHA512b4976c60bda4ede03f8695b02baed697b3b54e5e1f4f0e0e254a9fefa26ed1a20f7dfa77d487587654f1dcbd14f2951b493b755c76a76809324a0eeb9abe9214
-
Filesize
661KB
MD5d4cd652ec4c22ae647ecd6f0807a8925
SHA190cd6004a6e8d100878c33ed964ce145071b5c1b
SHA256a8f2916ba291a95006f8f03d3a6fb8e8d733370f6b5b9d2cfc57ab33b7fe2f14
SHA51242e7a2595ddcaca978739206e3a0f91d2272c8883bad74e6c162cf5a6d6ea072c1f69f76a77404b708b3a3a851d999277b80d7188009ca9ddc74536091447507
-
Filesize
1.3MB
MD5677eb43e9a97a11c704a531a826088d9
SHA1bbcc259e4a3d21d43a06cf20f184bcb6250fe4d0
SHA256590c6934b21b22e073ce926d93e9c6853985ee3b0f8955dbcfcd780bec0eaadc
SHA512171d2faf08e54826aeeab39a9463207c9defd43a6226268689f6d3d0864142a15acd3b35ad51d358335790a8ff6d0343988ffbdbdd901a0d8110f2f6a5f594da