Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
07-06-2024 16:25
Static task
static1
Behavioral task
behavioral1
Sample
6c11b679c0bf69cbc3b30ac097816f50_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
6c11b679c0bf69cbc3b30ac097816f50_NeikiAnalytics.exe
-
Size
665KB
-
MD5
6c11b679c0bf69cbc3b30ac097816f50
-
SHA1
708ec864f2f252ff9890f8c1a0800554c5e00906
-
SHA256
8daf5ece43161efd1a70e412dae34543c3202bd3dfea32e8832c3e76fbb5832d
-
SHA512
1d6ec3e32b62639ae1038197e5db891763ab699ab3f433fdc20307dad79cc05514e3ecce27c0923b3397c9894d45f2d55f74b2aa4890f015157c213f000f4a7f
-
SSDEEP
12288:U/nUHbC/V7N3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:Us7CT1N3RUDHNmdPCAaq8Nozgi/rE0TY
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 2832 alg.exe 2088 DiagnosticsHub.StandardCollector.Service.exe 4724 fxssvc.exe 516 elevation_service.exe 4904 maintenanceservice.exe 2384 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 6c11b679c0bf69cbc3b30ac097816f50_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 6c11b679c0bf69cbc3b30ac097816f50_NeikiAnalytics.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\9714871ec3136770.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 6c11b679c0bf69cbc3b30ac097816f50_NeikiAnalytics.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 6c11b679c0bf69cbc3b30ac097816f50_NeikiAnalytics.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 6c11b679c0bf69cbc3b30ac097816f50_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104468\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 6c11b679c0bf69cbc3b30ac097816f50_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2308 4808 WerFault.exe 82 -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2088 DiagnosticsHub.StandardCollector.Service.exe 2088 DiagnosticsHub.StandardCollector.Service.exe 2088 DiagnosticsHub.StandardCollector.Service.exe 2088 DiagnosticsHub.StandardCollector.Service.exe 2088 DiagnosticsHub.StandardCollector.Service.exe 2088 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4808 6c11b679c0bf69cbc3b30ac097816f50_NeikiAnalytics.exe Token: SeAuditPrivilege 4724 fxssvc.exe Token: SeDebugPrivilege 2832 alg.exe Token: SeDebugPrivilege 2832 alg.exe Token: SeDebugPrivilege 2832 alg.exe Token: SeDebugPrivilege 2088 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c11b679c0bf69cbc3b30ac097816f50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6c11b679c0bf69cbc3b30ac097816f50_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 7442⤵
- Program crash
PID:2308
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4808 -ip 48081⤵PID:3792
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3912
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:516
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4904
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5075619bb0034cb257444a91440190096
SHA14b56ba96b576516ddb1f13e8c124171f04d41453
SHA25694e51f90e6312813cecd0d6b1763c3796e37339701a1b57730cfd123be73cc04
SHA512f58a2343ae967595fa9ec706094d6cafb26dddc085dd9d6f2f5eb052713aad90291fad5ba0cc14bd077fcc1839da1996fdff7f9fb5e50dc0eb6904198e2039f9
-
Filesize
797KB
MD5a49a3cd58468733aecdd4019753660e1
SHA1621ea7def07c37a94fed0d7986c54a883300f428
SHA256e7cbc68b78e484fb60e98b3d952e10821ac4977a6c0ae32cd6d3ed7d0af603e5
SHA512a979cc16faaa51005115dcc5eaefedfc268c28ddbc2903cfb87458bca3f48117d44a8a9ea8e4ddd1dc3e57ef6b79da314d00a969e05ff096f27daf371bcb049a
-
Filesize
1.1MB
MD513a9d768d66f753fd66c5b54c32b6b52
SHA16efb627b62c6788d35d7c5a438e8db3a477cc158
SHA2565d01f9c0f2a743d2f3441335b579114cfa3d367fec11d1cc006826313a301acc
SHA5126f6d3c0b58f75fc15ff6e79b69258a24afa82d27c7cfa305da9f489adef5782177ccb66ac5eb282e228a082d67b82157d2767af491daf5db1c63bb830158ea78
-
Filesize
1.5MB
MD5bf9d3c929e6aee8abfb02ae427c0d8ee
SHA1600b5a288f7cdc7007f4ea8bb1d19092ae6ad7d0
SHA2564e91962ce3598b9c5ee6ff14deff2e284096b39813e05675a5c45af224533c3d
SHA512070c0587b87f2e41b065e3ee29254e78306846ee0820ff1fb177e8fbaa463bbdc87e333fa573e8ad5e3d57c5cbc902892b8cb30ee06574c842294fb5ed99236a
-
Filesize
1.2MB
MD5d7b16dab792ff5f2e845b0782cd8f978
SHA1451a797b26761dad866445ac44b3ed162b1f3b5b
SHA2563aa318c85a748766143f08afc9431156a82817af6a7589b82f69ff7e133b3b0d
SHA5128ee63d47022c782b39673485b63f45221b371e47c750df5ac2918d58ff3cdf736017ff3ce5030ddec01be9c9ead655860640524bb8fffdc7bc50456d6a18a248
-
Filesize
582KB
MD52a130b09c1f977ad51a431b95c79a929
SHA110a852d4689c4da0fa8c9b9dbddbf87d1a0cbefb
SHA256b3f5a931ebf9a3a6aeca45aa3eda64610e3d3011634fea0c4a053ef331aa5b1d
SHA5122d261d9400d16d2d2e384a7fc919ffaf065b73e5b896b9667e67e3ad670a3ff28fbf2bb5aced5049c8ef9aaf651351cad799556da175bd261ab2a27a54f440b5
-
Filesize
840KB
MD575f249835337000164ced75cedd320f5
SHA1d170d4f2ce15f9f43b914d0a667beb544b697440
SHA25618b87f4fb2d7550075d13da5da6126f21f1e7a75dc9fc906892939281e4583ad
SHA512f1991a8780527aaf7907f44777f73bc4b8c8f57855b5459b017c2d5c2652302c3821cbcf2587ff92378a84d1586685c552a7ce2a61df881ca0e8d6d3267ec0f1
-
Filesize
4.6MB
MD5261d9470aa0a5b83b24f65cb26b1f45e
SHA1bdca596d31fd063139cf244c8305dbdd3b4d3f5a
SHA256647b6d7b0a3d3109d69b82c52825b73cfc78baf15da9234afd8eef0a63ff57da
SHA5120d7a74c751dc4eabfd89f842e457935af98954a065f793f3fc05e5d8e98e610cbe1203e8c5866d59aceff1a73afe3ff8dd74315fefebdc478dcde8f72a2f91a9
-
Filesize
910KB
MD5104da66073c8e26b528fd547a821ed78
SHA15163d5d46f8246b61a81140d2e34efc0feaf89cf
SHA256ce71dfdecb7abf23b5b6fdaa7910f89d4c0be33c40dde8939d2bfebf08cd772e
SHA512effc6554d4e48500f1cc602bc624d6d9038d8a3af9e31c8541f73e318149646dec634e2f5bd8e5eeb3f3ba85bb64e776cca0680d8422c49efa76714d6d39bb6f
-
Filesize
24.0MB
MD5be7f8d3eaba40c89eaebd95ef23604c6
SHA14244639bbc3f48e13ccbe7ef44cace36cc2714c7
SHA25653e96b6e5e447dd982d93d5fc6eab57dcf0274f666ab71ab0a538d9b7e5a9576
SHA512e208723d9a82db4aade607e7c79dc6a65994068218c7dae314a603d8521d6b7bc8808d03e6f8ffd4cd3b2ae2e3f8876c3712c940257227d3f7233f3959dd911e
-
Filesize
2.7MB
MD5c504d7be7a7b9fd7e18d0b26cf8c5509
SHA1e30f709aeddddc545805a3b648f3e302fa3b68b7
SHA256384f9a94af464cea3f9a00f475f4f8220e3018abb9af2671bfe667fa136e27ef
SHA5123fb2f08abeb1a149c684a88e0464888fa881b48be321b1ea64c745b7c60317961a2fc9806ce75e376d72fbeced9b3959b1f342a293fd5dc60baa63f619b89d4a
-
Filesize
1.1MB
MD5fb993bfc642496b8d1bb1bcc6ea50684
SHA1d7aca2a6a13e8d36fa5fe63ebbfcabd829234651
SHA25688194ee1f4dd6060d053466269133fc76d4422262319d22e6e41d067636c536a
SHA5126a8754b6a512fea6bba5fdb68164c8d6d333b14443778a692f41cef5f673f0356b7add3ccc15557d822f5a3e3d9ed0147bb5043530292561eda615af0c80eba3
-
Filesize
805KB
MD5df61754b0677edaba958df7d75646e73
SHA1045be5ba9de19ec29c96ae61a21df1719cce20e5
SHA256a94e99ab06089e382d0f8b39fc94ac22c25e78d84fff7798fcb0b2161dd2fbb8
SHA512269494196973b926c40b1c3d50ef06bc9b4ac84db22545abaed19cd4c447901530f1faaac57c4d0361413ad6a019a13b7f012c7ded18e7320a041b924e56af14
-
Filesize
656KB
MD575bcf89d959c6e237281672860ffcae9
SHA199bfac1257a86f99235338b6a5108cb9e59f3718
SHA256e7bf5034d693494065ecf778e664be8f86517d6a49cddb25ae29b6cfb58b2593
SHA51232df2f65e755f38d6abbe892341c6f2cb371f455a2c84efc3c26493bd1d97224731c150af7454f8ceb188df89ca2a95192794b24fbe923358f81c8ed310edc9a
-
Filesize
5.4MB
MD5fd6fa12156766e47a014144f479ea55e
SHA1555f7557e88188814b974eb3345ee218d6c449ec
SHA256ca5fc8005f7ba0c1f3493785b7bf871c0e6cb30c95d05b7bb7c98ed15f08d395
SHA512c2caa6d43c978ba3a2e219963d781a4a2a99a44cba4679bd3dcc2d70095e01f0c9c466efc920df2545a374a657cb5f2109bd473327e2754598dc38a67a94c20b
-
Filesize
5.4MB
MD51ef04b965f6158de6710dc63c0027cee
SHA10d4128e6583cfa3bf8346ee6d36fc7bf77bab119
SHA2563d4de28daa280caa8985b59d993410680da292000b082e225e60f9d3ac1a407b
SHA512fafe39feb5991e61b8fbc9a238f8ae94fe6f60f470dec083a966b4dcc61e3eec7a9b233828bc567f053e6274057148d5ba5ec5c3e42766a996d1fc80639b7220
-
Filesize
2.0MB
MD5ec1e15117ca5fa8124a90098de64d61e
SHA11ff0cbb08c1c42fa948dae25f21edce264f1edbe
SHA256ac5118513e34dac653e7a92735117590632ae27e12c79d42c0f12015c6590358
SHA51299a65f2d64ebec71d2158f55683aa3a6fcbc320e73e491078736963f7c4b511908b23f85e566b2a70518e7acc1c0cf0d63808ce029e5a2b11df190189673a4f3
-
Filesize
2.2MB
MD5dddf9dc99fb62d37d4f62e81c1c22b63
SHA130f58990d8a12c4ee85e365a72c333b06433d665
SHA256c9560acb14c36294a8b59830f12a1cecaee9672a89c32272bef2e13808f784c9
SHA512fd513c0b603e68c6de2a3c94897800a464685783584ea77e5095a181e45ea4fae9f97fbc696f1d93d7c7af68628169baf2b6d676fc2834c9328fe9c16980b48e
-
Filesize
1.8MB
MD50baaa7a2bec0bf933d49f2e05bc7969b
SHA1fd26a553c39b3f3f1335880e796c926efd1a6d50
SHA2560b91623bb19ff0b32719692f7abec557bf64a07006ac2eb2376a309cfc6a8823
SHA5120e0c998c541b6fb88315aed8cd69bb0bf247fd8757933cea7346926fe6a9e1af7bbf74ab6c4c9550d662c9298a55bfaf50358383b9892d75252e24e5143b1d59
-
Filesize
1.7MB
MD5ad25da6daa9fb9f4eb4a8134b0166849
SHA1454d229374a1316806881a6e947027c8c893fc99
SHA256e8b0171ff46d2233fec25008d3cbb7af14863907cc7e8e6f965c20ff8df91795
SHA512dcfcf4fb79954d228b64c9cfec23668ac67e3711cc21e88ddba213c6ef3b17761206a682d18c1eb9088b91ad631d0fd09ac629da910b9a092ed3f5677033e165
-
Filesize
581KB
MD5e7cca7a7370d630ab105bbcba4c18453
SHA1830ccfc8bc5c201e628b3bd442ec325959b6e03b
SHA256e6781d76466f4fdc8f3b049724f241a25c20ed9115c59f4a21bf99bee184614f
SHA512597bc81816229c802fb6bd5c622f88c5a06282f1f42f0ea6d0bdf94b80a3c866c6ecae06542acc6ee956c6b036313d02c104019fd62a75da706f5f99d0b1de38
-
Filesize
581KB
MD52e3f913e7402b82b454fd9a93ee75dfc
SHA16e801c18b6bd04a63258409466d6a7e9af91a8e9
SHA2567e2e0e0e3afff571ab54fa4ab66f88a81a6df0353a96b858ff8e4d0b220c6a88
SHA5120222a0818b7409fc6aff2da16bb48d56f886fdac514e02758f7f39dfdba3217411d9397b0b308d39cf3581a86b75455f10f4556c0302ac476059a60cef1ff2b7
-
Filesize
581KB
MD5f30be2c7754df6fb0e9706712dd9a123
SHA168cce8211741ce5ef5b1b598b0562de31abe4e5b
SHA2565ef1b5dd38ff45c6158be59c2a3d3a8575225e3598952f5c5b6e1b1339537606
SHA512d38eec80ed0c3c1e948a0e5a3800056fded3d958ec23dafed0ead195bea9efa9a22b96b97d96249b4d72bce40bbf20310c7118d61db2a52fe78da08beb5ad507
-
Filesize
601KB
MD5afef14591dc8b56bfc8c550bd16d66f7
SHA118ce34514eb0a9558512bba1904c51032a16a15f
SHA2568d800ceae1adac71627842e765ce93bd9810f9d998f0f240be1853fe89afb9e3
SHA512f90dfc453a5bf3d3fe16f3bc2e551a192d44cd4a90468f89883f5c585b7ba7d1624f2a8b81750374eeb77d72f9be21b8574d88c351a0f22d6433c7b487142f57
-
Filesize
581KB
MD54525a3469399a6823d9bb33888f2b704
SHA1993cb4d059612a8bfd80e8448120029fd86f7c4a
SHA256cf4909caebe64e10327bf2365d1d19162c31225967eeb4ebe99465ae58c5e1ff
SHA5122e54cc9aa37534f4035c98c3b17ad917a7fe7291fc9654cb42e6efc3787c839cfd0e062fee0aaa2bfe18ab209e7ee22aa60cc3133c0f16c0af4c7b8f7fb4177d
-
Filesize
581KB
MD5ddc753e8d8792c80ce246cde32c51609
SHA17be172b5575c7d030c5aae03b00cddf11f00172e
SHA2563a64a4f487e0cfa13b060b5aa4daa00183d910375c4de439c599c12f30d46faa
SHA5120b989bc1952ecf50f675ff63b8d8a24685a36100e399b0d196fe7f38120a23db5528d4bb50efcd102e493c99580c277f5c861aa8e17d3fff0264d6bcaed8c5a1
-
Filesize
581KB
MD53f06a96fd4882648315fbd0f67c6f80e
SHA14684f4bde249bc98cca5e495e727fc7847fa9e33
SHA256d9cfa7f83c6e580bb1faeb9bd234315e7cc7f2fa87b137d119df6ce82a873c21
SHA512084cc96896103a77f714aebe322629e98b2c8e9b66f9925d61bc66c940f1d9b14f7a7e73a6276c072219ce09cc64618b88f91c98be30040758c973945159702d
-
Filesize
841KB
MD5b43329049d6d2b12342fbdf13a35a26a
SHA129f6d5e5e786544148dcdf2b8e65f20038f600a6
SHA2566cc8253c07fcf538f9547ca18548d9d29b112f8faab5919693ce231604f3841b
SHA5129e2d7967d23bdabf8dc53ea3cb8ea512187653ec194a5addc58910041e679464ba521603d5f3ad63843a9d9ea8444f812ced75bdac4b49d64269902be0546177
-
Filesize
581KB
MD50bdcc7ae8823723e997b44f9e7567912
SHA17fc41660887c4e757d817ba8579deb55866a447d
SHA256e69e42c083bf61c688c4fe42f65e2077a487ded5de4094157cf8094cd636eaf2
SHA51200d279c769384da4aec29898842fafc91d35a5faa56e190a0e3b6ecc562ebee61d4f3436429bef714c69cb1b68e1085482bf6ce5e0451b2e83715d57d31c7be3
-
Filesize
581KB
MD55ba5eb7d0d24f8548326908be966b935
SHA1d880c87716518bcfa6e85e280978b8082fd2ab30
SHA25675e27c5a11e5f31a436c3d559ad7ecd60e1de8050f7886501ceff7daf3cc1bd2
SHA51276e5b9562b755020776ef15169117449f6eba2bcf2a630e792705cb1c1e8f6a0c6d199bafc5a948562a682cd3931d13fe1f2d7b46c5f015e66e03f2dc9781dc1
-
Filesize
717KB
MD5289ce99b02773d475f5542a49e543147
SHA10b62bc057145a1b45d70befef81f414e7be8f226
SHA256f9e60c8ddc0e3578067d3e48516cf2dbebf06b2a713beaa3feb6baa8431224ed
SHA512ca3371c6e6a45699baea4ea7c2895004e426b8cc65905c9ee85bc20eb984908a5249f57e67dc9f823e5ce84c74f29ffadea2cf59bd363476a15f16968bd894ac
-
Filesize
581KB
MD5fdea649843aab7e4de201275bd22fc5e
SHA148b46b0f6a83d93b03836394a10862e0b95c9c6f
SHA25674fc12bcf6d2ad238deb93a92b0de5362b4c8e60aca9b9c85f8b974851f38285
SHA512628f2c0b81f9b4bef8a65b2990b32e7ee9c42424cc899808a686032d9edb4aa90bc3deb3b00fc24c91c98b27cab481ae2cc02eada94f080d594179276c6ab43b
-
Filesize
581KB
MD5888fb58635cd774080f6e9b497b70625
SHA1ea73686d082f731f04e9d8318a6bfa2220271065
SHA25698827064605d1838a00fbc572a42beffe9518200aa51f717b65f2b8e3baa6c01
SHA512c53be82af7ff0e86d7848d1dcc63f7acaa2f2409d22cc47b223e3b8a58390f8f93d5ec537b541af67a771d6089280208033d728403f7d6f6fb144bdef2848a96
-
Filesize
717KB
MD596c5bd111b68ecdab3a5d35b2df6d106
SHA1fca35dc2bf1983b6fc116f18444415b074518ab1
SHA256520839def780db2799531ff6cd20fea1330ee38aa204c49168bd1cd15be2c7e9
SHA51225162d7f8acd70d8cb237195c884c351bc9707a5cf293ff63a852d4bd051ab662c2c8d9630856a4aa4a9aa31bb283c929182436c2dac3f3462cc6dfaf6891669
-
Filesize
841KB
MD502b5c4ddfe0852882e5f4a7961eced3e
SHA12fb114d047bb1f873fde48c19288b4bf2072877d
SHA25601ff3b7732c5488155bc443c00212b12151f420e90528edda95536892218a72f
SHA5126d1f1bf802a5dc8c90393253d7eadc6c3251b79d662d41d493d3d140f9635716b9d684e90dc67c817355cf9d774e57735782fcf0356f59caf80ea381de906c6a
-
Filesize
1020KB
MD5bb669c875f9c434769fe4ef652e749e7
SHA14c9f3e7a53201cc0226f1d39251ab02097630bd1
SHA25612302d9de3fa606572b75af4efab51cb1be6f4bc912da2eb82828c64b112247f
SHA51236c6aba55d630a521eefbbc52ca6f963c0f63e8e4515ee74267e00d4cda39c273a4b583583306e059e83152970dd622500a734e416c2a101d91b7a147a444b55
-
Filesize
581KB
MD52272e7166a0b03576dae28a0360c84cd
SHA15bff5686c8a38d032a8acbb74e904dc4452c0b54
SHA25697802e9721de78b7702f9f0351417836f31190ff5187f958cf86cd5b3f7e6508
SHA512f7b59ae80a5254480db120b71ff403ff68aee718f08fb9df3fc89019b2d139347a72a65378f5893da56a467afcb25b8656560fccd257c7b6c817a514b1f7e39d
-
Filesize
581KB
MD52172347ab7d5d9fd443d96f3d6b2ce2c
SHA130ab9b4deb161d5ce1602473756e42e294cc83cd
SHA2562ccb3a50ac44b5be8c4153c2045dfcb01a6fe095f90b6b3db52002effba70479
SHA512f9838d69158d418288afd3036af6c78f2dda6a7ae36ebe8d50fdd3e3f0c0b3bbf77aa40cc99a1b92e999151b031f2158311c7678294491c2c84f256b3ab42d68
-
Filesize
581KB
MD5820c74832d0f0fead302da572fca6748
SHA1db057f568249f4e83509f9638fbd2e0e96e628f0
SHA256c11cbd8391f11229cecafc66e182820e03db127c9d62e85ba9581df206a2ff19
SHA5123d4bcc83c76bcdfe2542a3bd93f295b0bf8228749213db6233c8b586a179bf2f94b6974512fc678efcccc829f3977cd9eb5ab063160458342cbeb82a23189c25
-
Filesize
581KB
MD5d92294f3aae1984beb9eebe793a7558d
SHA152ace6a471ada28e18d026899dbe5050d0818b41
SHA2562ec0a95fbc67325813dddef41a1d43089a7637923467265aea5186fcad1a5d6d
SHA512463d05296ccf5bf4de29b184628f37fdd314a25f055806e7d27968d2ece332e93b45c0b34b87f2d923a1ea2f3acdc06f630a5d9b5a62fe079ae713afb5610c0a
-
Filesize
581KB
MD5b2be00aab7f307cb0373653bb20f1a88
SHA11753cf0019a939b34dac50d63b2a504835bf38d3
SHA256a1561a54658773e16f5784090c356f43f0506ab9e52124e946a1b2fd901d1947
SHA51264a4d7ce2d5d316c0cb045fc57968283829a7960da20e1c901d35357cb6f47dc29c287bfc6f79c4cf5fdbd2dc32624459b497ae5f98c0f03f5f61742807fcb03
-
Filesize
581KB
MD5ea19e12ac8ef86f2bfadeda24c3b04c9
SHA13f749d888e7c6d56b80879168eeee0933d94d723
SHA256f407084a70d13f58d8133b19ab6d28743291823184090fdd1d5e5258777ceae0
SHA512ee57b2ffd60b30cdf5ae826ede6116647362550065e4a7ce3933c416e380717427774b5d83e7933146d02d2f97a6183bbfae66db7782dd9777dab5c36d5019bc
-
Filesize
581KB
MD5c765584933646a30d1354c2b09a325ae
SHA198157d65b4c32078fafc36d2bc095776220747ed
SHA256dd5e43f755f0add96798729826e1f6e869076cc6df22e4d088d32daa3e64ee0e
SHA51217f62a55c6e4d8a308c34775583e80cf8095d6493d0590440cfb8150d52ffdab4034d8e152ed10e0dbd78c8470b927516e9fae1205754b10e5632403ca8cc744
-
Filesize
581KB
MD5b9121984498d48f14e036a1cdefee0f1
SHA166d1e0682f52c411b234687d7638194084d13bc5
SHA256cbd03c58168e308da46e3b46f9f41ef6307bab9685c4cc88dfe1e22b9b789c4b
SHA512f958ae636ca9cb50ce7b8c834a09f971fc9d25ef145d7d95fca0f1c10c6ea1d1592c66affbebe1c7b8f71fa9ec2982f60ce52845defe953dbb1e20d757370c93
-
Filesize
581KB
MD5a62353695712f99b87dc9b83936bd21a
SHA1999bfc0a3e10aa656954c264e5fa55b8b2d33f48
SHA256a73d2e9e758f1535e05a3a3bef5d474af038d7caf3d98f3fa67127087013b3ee
SHA512feb599ed3771029194ab1de53196e8e3d72cfc4686593a97cb15704d6992ec07d66d4fb0680967b56b54631de035e227b13e88fde7b0ac52394400280fa1a9a2
-
Filesize
581KB
MD5f6e28fef36314a3e6919ade7243b0389
SHA1105e26b20625788f83ff04385a8dfe4e79d5bdea
SHA2566f81d11f2238475a0c61726c40e2511a0821dd6b85b01c7016eafb236d2d75d3
SHA51247198b39f4e18703cd529c7af9ee30fb283b600013bae12118e4422ae32c6024564b2a13a645fb8cdefffa2b80da84df0a7d79b01f7cbfe376bb81c08ee8af6e
-
Filesize
581KB
MD52517b3a38189230c7624bc51d8032cca
SHA17577cffd241159f4189f2cb9c9f6ee88c6ce0b1a
SHA256cd7615926157f67b04954ee002451360734a6fb8c11f570ecdc67f897fe61d23
SHA512b7f4ba2ea673b616791a9547ba72fc6d1913926f189926afa457c4b3ca175f8a9bfdf540d667677d4022bf4b9c5d1f46e5efc1778cc1408b30297da968a3df74
-
Filesize
581KB
MD53686eba038e2bd00f109578edd9632bc
SHA1716b07bd6e6be6921eec5e89f1899147475cccb4
SHA2560631c003e4baeec0bd644bf6951924f399cf473e25e709262f968c46e48cdec6
SHA51261f9eead4821b8cd373e94328e691ad510761d19c799aaf831b4f981638368d6f14401c97f4cbf85fdd5b789ae9b7f2d27dafeb452fff82b476dce41c6db0f4a
-
Filesize
581KB
MD5f5a25f00d2cc6df2bfc34f95771e1f56
SHA1ccd35de2959fbf44ea99d31e8694821e3d5a2200
SHA256ffaf34d3f0928b4ebb092632c069182d6bc377251b248444fbb2ef9bb5a0bc1d
SHA512780a4815fc59b3b664d60fdf9102c669405bc375ca64b0c6e9c4d7fa8f97a190056e6c8ae13ca160a321460543f0cea22c61a8f0e5ff71ea3fac9a8c11065c2a
-
Filesize
581KB
MD547a3124422282cc8d6b386af1a1241c1
SHA16681babb36b17cfc039e07b895f0d14d954ec1c0
SHA25640dbeb31a83a9889c6bda78e0577a951cbf278fa1f1cdeec6d1070ba45e59f00
SHA512aea82ea1832fd0371ddd0b12585f22fb40b37745f7e850c7453042b1d6207801964c549c1eaf24fcca2c6854d877711aa47879c203a7d4d4d45baf8bbdfa3904
-
Filesize
581KB
MD5cabf8ca80155139ab1b80957bdb4da90
SHA1076fe3412fbe3b319ae6bbe9165d827fa5e8ab3c
SHA2568485f1c402654ef0b206bce25cca4772f032a8a715112ed29b8971489a132026
SHA512fed034f49823e16d53033d170c1fde92bac8ef166a7f4e5fd63dca1b8dd3c581b6da21231d25925ef819e345588160e7ccd1ea7f5a8e9b333ee5b91556f804cd
-
Filesize
581KB
MD55eab8065ee0a9f2d03e2e217313e64ab
SHA1c25a5558b781a13ceca8577d8e3d6c3604357a61
SHA2561d92792d77c4d8def62357fea6d8732829be8c43165b645ce8545dccd49361bc
SHA512efec678f59c0680e9f85ee76ecd0c44f186042dcb43fbef801fd3d82de2c953ce6463fc462e7b1d37919285ec4005fc3409e927b8c3789052d2c80f6b9acf864
-
Filesize
581KB
MD59310299ac8979f32a4d2d1b08bebe878
SHA1ec619c3b427fcea7cedb3e15212da8e29af78cbb
SHA256dbf799b1d06948ea702ab2e5c6c5fd83ab8d19fdcb68da2831c1aec3de89f10b
SHA5128f51f3672186ef51b2cd8369ccf06a9252830c9de205bc0cd68218c3338f20a6e306347c6c815a8ea30f45c59b7f2853d02d026d85e804c464c7746c71c4b02d
-
Filesize
581KB
MD5a27deb9d4bff9be4611b16b416f35ddb
SHA1d5df4f601a36d7eaa48b43e9c1213384ac32fb07
SHA256be8171c83f0f4a46064d0af4529eb08d4a0d73d1017dea88dd75df1bf3484866
SHA512def6423da36970c6412856765b494735d5a978231e0920e9f63fe11f2f316115fe4f5cca305a692a2d8926d0d0f0080494724c0d5514dba2a7f5d390cf15726e
-
Filesize
581KB
MD507b35a43eb65106afc11303b7c0762a8
SHA1f2a087dee10cebe0d8c8a4bb83018d91a028e659
SHA2563bbed0a16c0d5bc461bd51958a728691f88f660a3227c9997b108575c882a971
SHA512e6b5a745ed03b78297bb0fe943f2e429aced6e1ee02394d467879c11104e722bd5e68f90c9f9730b016cfcf4ab6a80c5b42681672bcf2698f4de1b0fc0f6cfe5
-
Filesize
581KB
MD59135fa8dd1982fe63d5ed3fe2577711c
SHA1f30a81b2d90b21c5e2153836d762a865b618cd0a
SHA25620d8272db179a8926dd5cfaee8916154f00e90fcba5822a1718177c811f9e5de
SHA512ac1a41560c5a92c7a4e6ca395dbcb0f1338478e15c9aa4f4a7a6c37952a9185d8c48ce8f76ce375ef6f449e2d5f3b491cb8420903811abf495a578ac905dc2d1
-
Filesize
581KB
MD569891ee2e71ff273b16aacddb709af11
SHA12daf475b401ee34c0b7252659da586b43160808f
SHA256566ba4c50d5a362a985eb8dde1ecb62620b68ae3f7ec584720142c6251317a3a
SHA512e92c22b21ca5ad8fdc1e938add8036c9f1d518f1ba659982a764876055489747fbb9c1392fdca629c6f1aa2469f161c263ea9289572673e77abe402008eaf294
-
Filesize
701KB
MD5c762733ca0e2ee017c25d04552652a67
SHA10af73f2640a1be52afaf9049b352709062f0763c
SHA2560ba5dc5acba2661ff347411fb052f8f931cab9b609d82bf97dde116fd5d81b0e
SHA512530f4a4ea40f0d326f6bc4f2086ad0be6345b4138ce6978af48508576cddb0b7db7bd46b220386e84b16d57e40b6ea3db3387de18c3117abd93a5d87d9a59417
-
Filesize
659KB
MD517784a1931bedaeb6392f8d62679eea9
SHA1dac6a73ab01d9076eb3e58604c60d21a994e578a
SHA256c3c647ecbb91e2cad955c980e7b52a295374de48374c1aa5690c0fed221420ee
SHA512e1e0293deab736c8d85ec2c2465869aeefe8e677469dd0d47a4f70d8415beb96d0d465d3fd343edd8743c1f7c1a5ee8a7d9be9f860913e1d1837fadfba3016c7
-
Filesize
1.2MB
MD5e51e1ec13994622b004629d72b953da4
SHA17a396b745ec0a2d8a4a31abf42b6694f69b79423
SHA25686645f4ed3e0ef380a17d1077c3486344cf2db25c1091e8af00109a1973d7a5e
SHA512d352c608b2f9427aa1f29149297f3ce5785775ced2f2c0a058fbd7db48c466f3fb2463a09e51dc763d425d343b5e644bfb00e43a4809e5f780706c3644e2771e
-
Filesize
661KB
MD5dfc69d482c19adfa2e0c734888000a58
SHA189def575eb5151de2f49d51feb33186007e1e7ca
SHA2561173a6b97cd935d332312317db1f9807f7e8013e98aeff60498daa4ac64e95ba
SHA51219f85c7ffffcd13aef5ce274d40d7c61c37673ff2bdd7c855eb72b24c3b20152b16129b2d3aab2f37cf22d96f08faec5604ae321ed904b4ac4988582a6429461
-
Filesize
1.3MB
MD5b4582d94eccae8bae5f90d8c4c5d0899
SHA11c5f83de04aa6dbcc5c648c70a41d4c9ea8c6935
SHA256c57fac7acc30266152feb7d1b14021fe83b6d1b788faa1428917941f85488e4f
SHA512d889482964d1f55942049374c82e89c10992479138fff01523d3ea6b5aa966a8f94bb7688621a0f8e60564e98ac1c90e80ed5348166e7a1d43f301ceae52f001