Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/06/2024, 07:33
Static task
static1
Behavioral task
behavioral1
Sample
1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe
Resource
win7-20240215-en
General
-
Target
1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe
-
Size
5.8MB
-
MD5
1624a901ebb47a2d06c2641bb683a550
-
SHA1
a3a62346be4b879b91c91976fd58d8c889b655cb
-
SHA256
6d3678cfc04ed67e3cbd0f8af28f0818099afcb4853dd8a32a8fd60b56b86e5b
-
SHA512
5fc4db394775bd46a07e72305412d2c40356160270e13f05016e4417b049b904e643c464b872926c46e6177f0843f20f8c1fdf71bf57fe501c927125e6b3107f
-
SSDEEP
98304:HNDwSlUk9KPsUxfAdNmqVi+qkPZKOBuyaoY7cjG3ehgL5:H1Uk9KmdNmqsOBuyaopjG3ehI
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 4660 alg.exe 3492 DiagnosticsHub.StandardCollector.Service.exe 4924 fxssvc.exe 4676 elevation_service.exe 1644 elevation_service.exe 2804 maintenanceservice.exe 4896 msdtc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\71315c69293b476c.bin alg.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe File opened for modification C:\Windows\system32\fxssvc.exe 1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\msiexec.exe 1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe 1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe File opened for modification C:\Windows\system32\dllhost.exe 1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe File opened for modification C:\Windows\System32\msdtc.exe 1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe 1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 5048 1444 WerFault.exe 82 -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3492 DiagnosticsHub.StandardCollector.Service.exe 3492 DiagnosticsHub.StandardCollector.Service.exe 3492 DiagnosticsHub.StandardCollector.Service.exe 3492 DiagnosticsHub.StandardCollector.Service.exe 3492 DiagnosticsHub.StandardCollector.Service.exe 3492 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1824 1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe Token: SeAuditPrivilege 4924 fxssvc.exe Token: SeDebugPrivilege 4660 alg.exe Token: SeDebugPrivilege 4660 alg.exe Token: SeDebugPrivilege 4660 alg.exe Token: SeDebugPrivilege 3492 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1824 1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1824 1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1824 wrote to memory of 1444 1824 1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe 82 PID 1824 wrote to memory of 1444 1824 1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe 82 PID 1824 wrote to memory of 1444 1824 1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1624a901ebb47a2d06c2641bb683a550_NeikiAnalytics.exe" --type=collab-renderer --proc=18242⤵PID:1444
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 10803⤵
- Program crash
PID:5048
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4660
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1444 -ip 14441⤵PID:3776
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4296
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4924
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4676
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1644
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2804
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD55b3f3de81140ce3646c97ad380c11e95
SHA18ab3d06eca0409f0262d65877543e6b944922713
SHA256386a2cf7ce83592de6728d1846bc96a8f64e2bb4f49919c5900c09d3f2122038
SHA5129b2bbf23e007c7557905c04316b102918b784a8594412e9b5d1cf46229a104d3e12ccb357a11ff308473cfa63b2706a4ac2e312a639e79a98f2e051290845d0d
-
Filesize
1.7MB
MD5223b11b7c8c7ea1493538982c16403a9
SHA18b5aa97c4eed0fac844576fa93e5a5449a7453e6
SHA25604f11623601bd5f07041cb069b370cc9799c97c76f0370c577e9bfca9b5c0573
SHA5120b949ad414a40429943babb0f040e3a0ffc13012556fb2fc4a6e069af5c965b37760220fc9009e772ac4e82a2cba9c90492037190220e4d61982b4af00931742
-
Filesize
2.0MB
MD53bdb5dc01e7306c84a86c083d91468ce
SHA1c6f29bf07a8ca138369ff71bbaaacf993421337e
SHA256ec8362ec8390dea6a305f6c427d6b40f82403dfd9bb6ca37debe59f9f9fcd09e
SHA512e5caa18eb5d6338624491a0afe95ae5429164cbe28250ee9e5badf7599342cbffe5fc72d7b4584b70bd955770d502a5f42fc9409254e8e0ef9062f9d84cb3676
-
Filesize
1.5MB
MD535268404aebb6824fb58e063b5a800dd
SHA1b0af6f7b9c66a0375fd844acd77a907ccdeb1bb7
SHA2564e7d9315e093edeb94bad8483bdbb2042ed200c0aeae8a5d1308ebf590602065
SHA512e928ff2d19fa4e630e0e7a881612cd59849f0d78d810c4b32233f3efc548fae281a93bc0fe39de3b288c921a9cb2554791a289308ba641fee24d11339dc0c6f7
-
Filesize
1.2MB
MD5630c0ecdd4e38c3f8abc33d1918c39c9
SHA137939e64f62a4e138626219d78b40b2727c185b8
SHA256356491d08e061d009e586dcb0396383ee8679b31f6de642047525a46a03c34ba
SHA512f29a00cc554e259028f8784799dac52d277902209d085eb9b400cd9eea1bb0959cd2bc30645904269ac50455e2b5b52ebca19f9cee21ae22a2ac1910b16e2f96
-
Filesize
1.4MB
MD54c88d85d79ec46f0ad9a39d1ae7bdce1
SHA16032e24db3e1169254de83462ac036048015d764
SHA256cdae72a1b438cdcd961b26db57d9437e94e885f862494a6e3ace1523abace5bb
SHA51205126ccf3dabb98b1a9012fc23d370a8d0b2e72496f43c9a344bd9d2cc1be995f4e504ca02100cde12566134c8a4cda880546c01d5e3deeec08bf7bae0ee7fa2
-
Filesize
1.7MB
MD513ded7547acf80f718a10a90056e67bf
SHA1e0e1d61b009a8580f9db4fdf50d6d204f8ea47d3
SHA25663c96c2a6537e53563ca297a216788e3b5cbdbbf427e4e172d99607c59f2edfd
SHA512ea70c96366fb589554fe44c02bb83cb0f23b292e57abfa02fb6accbc6a58534a58a3183616816e7be46573676f72a453c91b09adf5092ab8186219d0165fd1bf
-
Filesize
4.6MB
MD511ba39a9874832de1f138433be8dee62
SHA13082a218832f1903d676d287c7a5dec66c489628
SHA256380953f6b0d2c5cf06566f43ffa21f46951073400f254db841d1a057cca0ab66
SHA5128329e4a38bd782b3d0e5e1304e23e61c89563560c98cd36af4f4d7d5624af0f0232bd0ea4163a0f42a30338abc930c7f1c091e3c09e7475a8759c9082eb9c803
-
Filesize
1.8MB
MD5c155946be6ad1cf260d0736514f907da
SHA11344235b72f2d10d05975e0f493ce1045888b6cf
SHA256342bf3d83b3f69fcbe5ac3c51102dbfd32144447d7b0a6c616bbdb9d5022e143
SHA5128b97bd3ef0048ac8cd5fa8c2a1cf6ae4c9cd19ec03931619b1a96d32890310bd0011f83c969333111b907461d10b735ac2f88cba1771e00404b240eaf842fe05
-
Filesize
24.0MB
MD54d3fb0938b340575fe0be6f951de0511
SHA17dce533a9731965fef4d7f1d34773058e934a1e6
SHA25612d8e67b5ec0cdde48467bd4c5ee666e9855d2ceec450e48003db8fd2b50e28a
SHA512fd4a6d1b4d1c304df73495e6198096fdde03e061dfd19403e043fdda1acbfbf02ea6a6021ccb330c1da6189f5576e3e1fcddb7673e0710275603305fd2eacbdd
-
Filesize
2.7MB
MD5931aa8bcf357bf35690b9b0c4f629781
SHA1d6de8aeae68df538c7b17ba7dab7ece00ebe8ebf
SHA2562c7b64b6188ca5c1cc1995fa61dde193cdacabced49c3ac58aa1bb00ca248093
SHA512cfd17b6e805fa967af81c11fe60bdea2c719f97de5c8cbf17e833de7929c3233b95be490ccc6afa271b5bfb2d2a70bf8a92adc57da76232779ba5163b5a0edc1
-
Filesize
1.1MB
MD57d45199727e56de7bfb574a814ec5647
SHA14ce37718d77f5ec2a3162a402bcf36a339da1a56
SHA25678b5f529f62aa3a7e8c674216a8818e4fa201f419dd5b756a2bab1f04d2f02e1
SHA512794f951fabda97971b572b2de3517c21aeec41f86fd33342484f72bb3679dd5cff02d49cbfe6ec7a1a11e30f528c774463bd0476ba67b8b748939f1acbccf9b7
-
Filesize
1.5MB
MD59b7fd246d90ec1aba2aec189dcaef39a
SHA1959dc131d156b73f8148ac4a8e0af1184b6b9ca8
SHA25672296442f6b186bf409b13b3a3ceb803d4b3f8cdabd27f13f434239765e414c1
SHA5122762280fb915d056000ed2947389b588e832393784953cfe8d0697ca508ee741f6bc581147fa9191292d0bd246d1cdcd9967264b102e361a3dc7d9cf3e1931e6
-
Filesize
5.4MB
MD5932867eb0d018bb82d55bb08b20a5db9
SHA143f890f3e895d4ffd7f5e3269900ebf41f2373d0
SHA2563a665d6821170074b5f4593ff43d39e3123226bc181dd395ecfed98a3a32cce2
SHA51224e481d5dd74ad0c096e7b77bbe0916ee995cb992a6428e00f91f33f973d0b554a00a0ad07be53753fae6c70d6806319cfe3de0e571ef4510f3058cf14fece57
-
Filesize
5.4MB
MD5ecdd2ca76bcffd08a66eeeddab737c7d
SHA13d403b53e0a1ec2e4f55829429bdd8b8a3527d36
SHA256a2bce3765b4e76b163c95778a495c281c8ff985ea257c5c11a2c3c031b22644b
SHA51281bb12e9acf93c2decd8dfb8879a2d50fcd777b19c180236cb11b5e9b9e3b6c2dfcd726268704a8688d0841aa4675fc43981b2986229ae88a333d0f88feb7c3f
-
Filesize
2.0MB
MD57dba703eb9a6647bcb65982e3004ca17
SHA1238ff6ac2cada580c2009ef9e5f8fe0718d72588
SHA256e2efe78e6b9834d0d482c1433c1fb0f1c5f1efca7f9c749fba1752c69f289fb5
SHA512f510db147103917c54688509eb2844f2248c560ce91ed30a4d3a6e8636fb18db081f694b0ff94fc2e892a2a3231e591cf67d7f71f45ba356a0550ad0ec6e984b
-
Filesize
2.2MB
MD5f52eebf3ea6d4db29cabfa8409033afd
SHA1c57c073d82bbafcd4e5701aaa2815c39601c974e
SHA2561a5e1f71b874f6273222aad16b21fba4b791427f4d285d3aab83f3c051bfbf79
SHA512ebe7e11d08f5b97ae88e939ab8091a10d67fbeb4f58ed6e710a198975cf6e76da79505113d832da6fd55101b57362b0c5e3aa27ef1f4bcbe771312194456bb7d
-
Filesize
1.8MB
MD559e87afd3c93c495337e66eb7d415884
SHA1110c6fdef7826ee8f81ae0197ad7e5731e7c0daf
SHA256c1750a6b6ed3b10f42d3b18ea133cd9fd836bda92c00ce948d984ede2999346f
SHA51275d4207aed1768be8b5d858e9c4ad5e1ade4f1e507673dcc05fb64f51aadae8cd926801b3723119b275657a5c729cb8e823fc1844e5c259a63e1557923079d13
-
Filesize
1.7MB
MD5e95cd8eba22659305d4305c371cf54d4
SHA114fa679a799dbb3b6cb0868fd27432a3383eabca
SHA256c6deaf005c22597e449ef689e5c768b645f3d9d864097ecd4c984ed108e6e176
SHA512e6edc325804ebce1163a138b9b133e7e2b78511367388355aa0eeb181be9c298f62a0679086a14c2414ae1a2bcf90b653fd0501534ac0fedd9d3fcbd8c3d3fbd
-
Filesize
1.4MB
MD5471cb253537fc94461eda987e2951537
SHA1b919902ccdefafb96bdf696db462d67dbe042caa
SHA256d2456701249d3a78fbf74fdd8a7e4406735053b215aa87ca902239f83a2d3841
SHA51287e3862f4076addc71e1da8e31a7295a8d3ee3345d998c8457a23ebb5c1aad1759e9b025095da12f4b94aad4c62c34484786e6331ab4966cd228a71117b507a9
-
Filesize
1.4MB
MD58556f630b2bb722c557c7164b9aa559e
SHA1875abc3fd920e8e329a2b1aca7f60a88044e4fc4
SHA2562ad6be0473c1b377777a83a67c189fa5fed53d2b7b17ce4a50a0d007d5d92495
SHA51282351fd686b09aae08079eeb3ffb6fa523259e80b7b8165860538d499c58cba3773fbaa63a5e49e69561f32176dd000f989c549fc7fff5e9acb74cddcceefd21
-
Filesize
1.4MB
MD5646007bb41aa77462daaefb0ea447a8a
SHA1869dbb8158698e4f9600cb309d9c7faba761d9e5
SHA256be82c8d8f73081f00875d5038937b95ce1a29abc10de5377bcf7e9d5ee9d728e
SHA5122141c7b63a61223b0d7a3af23d41f59e6c9e378b34ac86fa36d87b6b34d46af79c5dad60a5cf310c7f4275f7a63034e8e1ea55345ae707d364fb0bdd8aa840b0
-
Filesize
1.5MB
MD5af061b0926845feac2f4fe1867aded20
SHA179be69e21e41efb857f7728e8c62a07e3f31c6d8
SHA256291c34ae8538419ba1feba2e1d60c0f4d43e1b6ea83cb117d174505e5ede1ebe
SHA5129fe3f59797bf8782bc7be274dd2a54f226c75a802ab1f1f51af31364bdb717c7fe787f69c6be2811f7f67f2258e1f8d2b7932a235822b099bbebb73c5a05e5ae
-
Filesize
1.4MB
MD55aab7dd50a652cf9b7529b12df9a55b8
SHA1167240676dceb744a30ca1e9b610ce03e2c2f99d
SHA2568161abd15a4c792a8b4568a979452101036294d5453475d857d8a9ea8326d1aa
SHA51251109f83fae9c11fd6a4f50212a587500e8c3694ece7ae4c7829798b0ffbc59cfb114de1e71a9e3bdd846192e1f4b4cb7ff18df4708b43751ad1f7531fa8a22c
-
Filesize
1.4MB
MD5cb55ea4ac3dee148d59bbf1b7011c97b
SHA140e3678f6268deadea2e6f01a65e2b2701cc88df
SHA2568182eb3595cbdf14cac16fab362d1f3cbcd600879e6076082e05be1176ebb24f
SHA5127ae534f79481580c65d2ee3a1895547621740007770ad9a4d47c82b7bb4ef17ee507eb3af7d6977274f29b0ae4a66ba341357f893d47c838ff185266d5536529
-
Filesize
1.4MB
MD50059aeb33b5b8563dfa9d976ab466efb
SHA1dc2976ea210bc606e480cb9651bac9e8cf72b638
SHA25609dea2a192bb9bfdfab5a6f991ee87f8198ac73ea1ffa7a534fe6c37c7343a62
SHA512212a148dda70b09432153192695feec2b43e4b5eae9b663f431b1a734a15bc017de599b314db98f18d96f251cf26ca75b15bc8cea4c29810185993a5bf4d1fcb
-
Filesize
1.7MB
MD5bddd050f5fc4cf0bb8e321572d3bb1aa
SHA13927cd863a8ea625230de11188c5dcfa7d5c7503
SHA25641c6d1a8e3d712d365cc9bf7f9a3f3f4c4a4e6125eda17e308f8e0ad03548563
SHA5121b20f0c09fc5b17f85e435b6185cf2469b04054481894815d560c3bee56b76ff6c2934134618726d850f972a355c169f934bb6f392186e4bd5702c818afd5f91
-
Filesize
1.4MB
MD50fdce34a9994979e0e5308e4f57184c8
SHA13a6148224539c03923b093c7b4dd3195790794a5
SHA256875a78d76e5e215488bf16ab4cf032c5172a82b193f7e5c7e3831cfcf388367a
SHA512cd144565862a33881e457fc9c5c41a1f897df9f41f677e6a3e8891ea1166979265bccba18a56fec121a4f20ab056c70bdaf802a2e8898ef95a6f967fd3846379
-
Filesize
1.4MB
MD5f324756de98e3e0a1f54d58d1142c403
SHA1f193b5162cc0a554f3365a4b3e01e48b4a88ebfb
SHA25632048d5e26999588a65a08b371dd899798c760afc9069adca14a9d236b8de611
SHA51220cef525f17e2e530c7a3ee162725f68d3721d579b48450776c40306ebab2ea6a9748f3fe6628d640faa4696afdd0c35ef8c7a64224ac64b2b047301719dd252
-
Filesize
1.6MB
MD5451e20b6ce55ab9b1b924ef4df8b7085
SHA16d2ba634e21a7ae50246d50779929770771ac7a4
SHA2561caba038b1fb3165a7552560b4bce2b6e11baf0d72aa414485dd6d000303c299
SHA51277f6182dedc625c65114d34e18d6cd2b804451f04c7df5234d3c6b351aaec06b3ffb96058f04f5a2266fa626e090f979920eab45db93170bed252bd32e225f29
-
Filesize
1.4MB
MD5bde02c98d32386aba94416e520fe4172
SHA145c98dc6570860aff1ea53fad174d8fd17b8f249
SHA2565156acda4b9a094147970ca628571f38bfe99f34aa3efa51e5e41188d01a6267
SHA51212dafb7365630121bd4a139317f16a584aa72a40e5fa2a876dcfd834cffb058095d4034d215095136673841bc3ab9b2af873c6269379d2447d716d7750da2acc
-
Filesize
1.4MB
MD570900711870f7704f74c28e69f4cd4a3
SHA1de105799b4bc24424d26392d544dd5e01a78d052
SHA2562c6e8eb2c5f26fc62250cdd15fda34da138726b301aceb5ad78bbbda0ab7d856
SHA5124416070f2da7f381efee3c7539ab3b42e60772e0129be7e866053ab423553c718fcf6cc5ea2ab75e53291b030a4e8466b0d95ae62954203914869b45805e3a4d
-
Filesize
1.6MB
MD57ced679f9c7343250b76dd68c93049d6
SHA10c07c8f0b3be5474c657d2d80a0881acaeebb6d1
SHA256487c736921497c71315243b75851e54c9b0e8b3650b48d9a59fe4d75c7a96537
SHA512390e9d1363ba82e929ede4a7c675a2c45a77a8db02f9ef287ecfb58a1754465ed744535f4da1feb247bae5409c0075ca0161cab105aa1c1a595904e7ac4dd119
-
Filesize
1.7MB
MD553d012a09ce507cc9dea0b8bf2e18958
SHA1e294ac6324553da26ebe1ee33459b7633aeaa7de
SHA256de93116e91aa82d0418c532cb309b4389202ad4b291796fed8bea8cf88f289e9
SHA5122a42bc94c8af887a1aa8221d542f11fa61f52b1b656e17ea6f3521fb5da2adf4935817daab83d033d3210bf938e2d5d7b5d9088f4248f0546b3b91f2c75b186f
-
Filesize
1.9MB
MD5bf0fc5bfcd7dae1ea23646e46e869b5c
SHA127babc018cfc31eeb576f4fa7d610563f1798a44
SHA256c6ca3aa490f31a08ed82bf95f3625d38246213fecdfbc4cafb9d305b1efff867
SHA51285d900bfa162e1db3e3614789aad9cdcf5691c2dbbc02eef5b8c8da72ea32ea646380b5e4a11c11ab5e8d74226c918113a89d63336a3db30c95e7a449fe9646b
-
Filesize
1.4MB
MD5cfd7822c0556f099a0c346bd8a1ba1eb
SHA16c4841ab6cd4c81ad68ef746143d3c1ac86e3a50
SHA256ef29924e7606a886ecea5dc9cf97d997cbb341c5bc1d37675ddc51159bf27e65
SHA512166ed787f415e7976a95b3ac45a6081d4bf2f53df9ceea899f014c16080a76a55a7581583e69c2954fcee392db7592d0e6d60912b997e3f15e28cb2faee3421c
-
Filesize
1.4MB
MD5cdd60d461f017a2f153ddbf0798abe55
SHA19c44761275073deee5a74f0d41613426edb47b3a
SHA25662ec8d1061740aab2204c2be54921953e40745638211f459a40107330151eca7
SHA512ac74e84cedac388d9dec26483085173e97fe53a84d67dbc7edcb0ebb61e454d4659d045f36074fbe4057401943f23464a93537c8fa0946956d4b6673a6cb0fa0
-
Filesize
1.4MB
MD51a6feda9e958ba4f569721ac572f6794
SHA11441426aedf771f1cd7d14dc2122e2ede0d5ea80
SHA2569386eb13d4e49f2e825315ab2084565165dd588af00dbf7e6d0432d1949b0835
SHA512d05aa00dfe00ae5692dbbf1fe2d3d6409db8fe7ca837abe98511fbf1a01e6d6740ea22c12bcb25e1726c5576cf111d34fe5e39bb181a53afc804c9b1d9015f59
-
Filesize
1.4MB
MD5b36ccea441358ccda1812e273e4b00f5
SHA1fcecd7b8aa7e9b80b3eeb5cb3796e6007deacb9f
SHA256bd1a1cb6322e06d72d827240184bef196b7048cf390a97ba6317a99ff2fc7cc1
SHA5129fff8a2d345b70247e681532ea6f33f0ec67de4fa0ae446c3fd149708f09af9da08db1d6587cce22c39d9923cd7839f902e74a62eb34ead2980eb1ac89dfd15e
-
Filesize
1.4MB
MD5a361c4a2b14365a59d5f81bc288e9ce0
SHA16374006e8956b796b988e4ddcdfe4bf4315a0fd5
SHA2563d240614dcb6fdf1988289892810d8267394aac0cb80d246ebdf4b5f54f6a2da
SHA5126c2a78e8c05c0900a6f1a0d4bb280833045d1bd5b6073c52b22c4118283b2dac71117c278ebf9bf0186ff9e6230e0981354d543592c81db1272b149c3e20980e
-
Filesize
1.4MB
MD5c325b9c18c752add2fac7cb22106aa0d
SHA1c9de2eb1f6b6274fec26acbc32c5a3054c8c4a8f
SHA2561c9916ed0787bc8bc5ca95ad9e5c8342dc1febddb663e95995bb3c13759541cf
SHA512eaf11357a0dc4303ad987c653160d8195120c1b3f9caefc0677a0cdabc0ceecf0b122528eaadd78b9b891f8e182daa21de36c9e8660d487a583b5fa61804b1b6
-
Filesize
1.4MB
MD5cebdbfd89df139993f76228fefcdf3d1
SHA196f1247f1f5c0845ddf03c232076aa6a379b09e0
SHA2568a8563fdfa561db7ee66ad8591aedc0defa9519c7cce710a8889af3a1e53748a
SHA512be9b8cc48b3a5d4ad1d0c6c92750112e32cc7ea08fb47b80b8af32d56221df86b656c1f4f281fe9aa6fd526aa59a3abe64860040d199831227093289cb33e6a1
-
Filesize
1.4MB
MD54498e340716da6b5c41b82824168549b
SHA1d36e81722c935dbf80d5338187534adcc3c803a6
SHA256594207a7aafe88c295aee54fca3adf3e393b82d128d1193dda5ad9643c329d8b
SHA51290fb8915091f835f24088b01e672a72184cc07d88cb0c8dfeafc6739156d5847c5c01567bac6461f3c86ffee5f0c5a614d7f68f9ba7d26f3599f248238fe93d8
-
Filesize
1.4MB
MD5e56172643abb9c1091a20631e846c0e3
SHA1c24bc442a607c17127388dbe568e54d3f28e542d
SHA256655865def6235b2269900de8e79d1c534a42fe67f46972d243c072d276a3185e
SHA51289a459fc4541593f8b8c7d5f1eedb13f852f6e0afb22f9344663f6ebbdc093e4e550aa16c57356daefb192f2119291f134efcc2f7e5da88dc68e265fe7509249
-
Filesize
1.4MB
MD5f43a49a63a9309d3aa419a5601ab7377
SHA16fc563f3cdcbfaa15290045054afbb49269acb4e
SHA2565ebffdaa9f5c2590ae3800854530909448e443c312ca026441c98d7188d4087b
SHA512e25e777910bcf91ce1015ee9928ea7c2a2ec51e6b559e862673573a807ec16cc52ea35a75053eba8e9e8af0c29607293fb4fcd0364496159a55941d77ac6fbed
-
Filesize
1.4MB
MD54378f0282d2f4323c6fad70c6cb5d5c1
SHA17b7eeb9551990f4ffe3df89964bea5aa9b11348c
SHA2562a97ece1ad0eaf336c492a0bc10b5487616cfd36a53fcb73194aac9c37bf596c
SHA5125c7f6ce815e7d074c3c49f19cb96404738b5bfe520d9cc908ce84a7423ddbf5b2e054c85158a8e1fa0adf1336d6d5fa94e106dd9e8df49eea329c30ca7552395
-
Filesize
1.4MB
MD5638c15fb924be8548adf08c773365db9
SHA1e7768362d8054ee8f8042b2a90ecbeed5ab98973
SHA2561b0642b97b377811e733ee73bf670ec9fa27b2f5e3049065a819e06f4f04acbf
SHA5120dcbbf05181c18c0a1fb8c8998b8cfe88141a018d3280313d1640757d8f547373091dd07b7c0c829937cb339e13388a4a17d0c1632d236388f7fb8db120feaf5
-
Filesize
1.4MB
MD5b74744061b08ab947ec49dac053ff23b
SHA170e882e6eaf2b0146f0446ba4a93384246aba82e
SHA256875b4fe3c771aa5d7883206271afb8ee121366f44715efc29a35b479c071d771
SHA512d28082f425788067e9db74e7c8e7bacebb5c2e3e0a8dfa6a8f9b1949e51e90e63864f2f332abf2d81ec4fc340b14f35c841570bcd830b97c103ba99034c19c74
-
Filesize
1.4MB
MD5e8113340a2826cf44383f0f818dbafa9
SHA13e7b36ecbbce0d8104ce393b98d99130c8fc8199
SHA2564f145c8ad05afd655824a15cec0b2b6205917c0e0f62766459e14a64e3cf9db9
SHA512d941d109e4d391864825dd7ff154019437bc33b8bc0210a496d3fd235b6b08d1b97eb20cb31158381f7b5cdd3854d0922e7e00ffc946e0678f6f3fc91ee2e25d
-
Filesize
1.4MB
MD5fde72298f93b0982f43ab9bce74444dd
SHA10bffa52509fbf11cfda07b368f53bfd87be20047
SHA256fd6391e46f7843a1d0ced85f3638ed3a90003802989db3a7983e623006c2b191
SHA5125c335182de9b0ecff630dbeb644aac5a7b8ceb2d153765e8451c2873bf2e82d72aa30caf8d699d4b0783a460070d5da5a14a55d038142d0fa85c9bd16b38b9cb
-
Filesize
1.4MB
MD5f913a654ed07944da73bb723b0b68121
SHA1fbb56ed56f8f691a0cb0c5d25f66d16786d93219
SHA256504ccca344ee263063477c8c7535ed1bf35986054d7cdd52697a01aa24249d0b
SHA51251b78767985dd97e9df33bfa50e6bc7cc1b482da4902f5d55a23ebbe0aa10df51e7529cdcffc9cfae104521ae5264305295f0e5939871d2fceeadbedb3a44676
-
Filesize
1.4MB
MD5959cff1189b8cd7a85e85e104ee3c7cb
SHA1ff6fb80ac81a13bcbbb1b0e43cc72b4e4127a70c
SHA256c3bc8ba35e7552bd4165c3d3a7439a6d98a13e9c49a22ab080d29aea500ef815
SHA51245e99be682f276c717610f3cdb70b8140d9a6dc1b0b4e31da75a0e8754d52026b41755482b3cbb0ff7eaf82382c74aa41450c8fb324a69aeb06eaa13273776df
-
Filesize
1.4MB
MD52c1600779f8bd0d5d256d50aba6d05cf
SHA1e3aeb075857725748edf34002fb57b454ae5e182
SHA256a2ad103fb979bbd3f10a9f3e4b7cbcc0e2a4da8c0eb3b160b2ff8d6264d59b84
SHA512722b7d23e30d96afb793dd874097a0b9ab08734ef9b1acedd07322d73a820d117cde81c0151cdc70a1ee326226967fc9a1b8e10e997a474d0ecdc9124b6d601a
-
Filesize
1.6MB
MD51b8f8a9f7b468b1220d982dabb409487
SHA12398a62ed53503d97f7c3e0f2f96f12b3c43ee97
SHA256055a0dfa6eb2c40ed8ff4a15d5a8ebd4fe0256ff7ac16fe61b6c8d8a5281525a
SHA51227ae694628a8a72ea011ca43a2dfae6ffe4c6953c8065f6a5d56dbeea97e48ddd244db6cf8043a78b474fef47e01bdcc6448cd0aa038141493b9dac57ddc2ded
-
Filesize
1.5MB
MD54e2c104695209ed87a97818053ef88aa
SHA1ce97c8c516619328209795ef7093640c0c0e5f16
SHA256f72b7d46f1780ead19fe1dcf3a15d71dcadb90818607b4d6bcc8bdbd0bc6531c
SHA512ec37569493dc3252099242f521f9f3932ea203faa39910fd927b440dc2060759e911cc452c81077ac98bcca219e2a3a1a08cf3d7d1dfb0e5a156eac956131bc0
-
Filesize
1.2MB
MD57db9051e795297f6a670fc8c4724cc6d
SHA11d219a82f8ad12bb4a9bd5c25df7116ba955c906
SHA25615751330a31a2749ea8c2c47f2868e5eb632d79b13ea34906c5e56a84f9e789a
SHA5129508dc995144fc9ada0073087da2c16361e638eff42becbf6f8acb03d687324af92d570f66e3e11cc6548c6543e932c146856b424c9f2afc3014ac2eb451d393
-
Filesize
1.5MB
MD57e97c2e37d38166a5a8cea0f1b56d098
SHA1925237530751a12f760175ddcbc42b9e6b6e3fda
SHA256aee581f0048aff690a5b9aa904c9a3ed59c9f111702e72ab22fbfba770dec515
SHA512bec25b1c8482df428808182fe41d840c10c43bbcde10f7b779aa8d84b3ffe9e9a0cdcbaa2fdd395f533517e059ce1e57b389def4d8e326e4543f3427badbb1ef
-
Filesize
1.6MB
MD5c40c94a61486c26d742c72bc26fe4e4d
SHA1a945de85ad1f4dbe6a4cf5e8fde8a9c6fced7625
SHA256d3532e703644dc675bcb2fd8daf1c2b0413ce6310960216e869ecfdd056e9c33
SHA5127eb1a3f5336f611ef2ffea01550c267f064294b9a65d539c7503104e13d8b16e8238b3ed89ee90d64014ea8dc41acf747fef3aa0ab4feadd5b756eba874fe96e
-
Filesize
1.3MB
MD581bde4d207207a713e461e4466a05f91
SHA1be8d23e552af7e5b574ae326381712b5b235bb58
SHA256a911c42f1bd715b0dc309b4c93160596ae93339a307c5a1d38dd6a8ff3b0bd80
SHA512ea8e9d3320f356a4b3bb0323a6bccc745ab8fb4da47ccbef713df40d62d9811e2f4fe2bf94aa06f5aafbf967f691fdacc0b84bc3727f64b0bd17f0d4da7784d0
-
Filesize
1.5MB
MD550c14936cb5506f094ace66a47654c37
SHA19a970939e5b5f86565b47773cbd8eadf9e922451
SHA25685a9060a55658c8917bca3871b9d69971b8c4b49764573ef2467371ee6b9b4ce
SHA51259685bb6ee65c9449cef4f14ae8eefe092b6b98b31dc70515c6e0de3173f94cdfde0f538fd7832d69929b8f9a8d3844fff07e7568a71ef7065d2f58f09269171
-
Filesize
801KB
MD512ada2599ab02493a8a666a93607184e
SHA1fa2f3d8e3505c244b55235842df7c7e4f3bc9d7a
SHA25671b5966d89a3045a2740314fb3f094ae6c7ea7dabe07c76fc5decb7b8bc3b655
SHA512316e65d952dc34e840a32f18930a33098de70c40654257906db75ef191290c5fdb12b852eeb12c40308dd6ee3ae4509f19cda26f01862f35206adccc20e58843
-
Filesize
1.3MB
MD507b52805a5889a2987aeaaf23f0acf12
SHA127b8915a913602ed34c80d2253194bc3957e1b84
SHA256cc19f1db82235fb671ac5c1c5edfa265926a5701e6c42570f06ce4ac3358c63d
SHA512eb1e0e2ba4d205a21eb1a57cdf597df265919232b9b0e7de7dc8ef6427fedb1a87fbfebecddcb46cfb2ead2838a4ce03ac3864a51296ce913865e756017b1fc3