Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 11:37
Static task
static1
Behavioral task
behavioral1
Sample
95ff66f0cfacba909a1d67dd52f4c6e883fdc381b1724fe9fcc7882c7ce12e86_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
95ff66f0cfacba909a1d67dd52f4c6e883fdc381b1724fe9fcc7882c7ce12e86_NeikiAnalytics.exe
-
Size
1.6MB
-
MD5
d5ad7e10128600261a921b0c8c004490
-
SHA1
909f6b7600010ad5d8efb5b51730c5710e8ffa11
-
SHA256
95ff66f0cfacba909a1d67dd52f4c6e883fdc381b1724fe9fcc7882c7ce12e86
-
SHA512
db44e41dc12c3fa3244ee168b17d583e768301a104f3cb4f4de4c4e597ad4326f8d6c0ca3f8e20cc39d4d680f4a0a0e6e1a90270a12d2ce3b3e5f8c232ebb8fa
-
SSDEEP
24576:VUozv/TaTKzr8EzERVY7zpCGSbvdfvDJO5:VUOnTTzr8+ER49CGSjJd
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 3268 alg.exe 1084 DiagnosticsHub.StandardCollector.Service.exe 3356 fxssvc.exe 3776 elevation_service.exe 3708 elevation_service.exe 1108 maintenanceservice.exe 2372 OSE.EXE -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 4220 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 95ff66f0cfacba909a1d67dd52f4c6e883fdc381b1724fe9fcc7882c7ce12e86_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe 95ff66f0cfacba909a1d67dd52f4c6e883fdc381b1724fe9fcc7882c7ce12e86_NeikiAnalytics.exe File opened for modification C:\Windows\system32\fxssvc.exe 95ff66f0cfacba909a1d67dd52f4c6e883fdc381b1724fe9fcc7882c7ce12e86_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\abc78533c3a5208d.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 95ff66f0cfacba909a1d67dd52f4c6e883fdc381b1724fe9fcc7882c7ce12e86_NeikiAnalytics.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 95ff66f0cfacba909a1d67dd52f4c6e883fdc381b1724fe9fcc7882c7ce12e86_NeikiAnalytics.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1084 DiagnosticsHub.StandardCollector.Service.exe 1084 DiagnosticsHub.StandardCollector.Service.exe 1084 DiagnosticsHub.StandardCollector.Service.exe 1084 DiagnosticsHub.StandardCollector.Service.exe 1084 DiagnosticsHub.StandardCollector.Service.exe 1084 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 644 Process not Found 644 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4708 95ff66f0cfacba909a1d67dd52f4c6e883fdc381b1724fe9fcc7882c7ce12e86_NeikiAnalytics.exe Token: SeAuditPrivilege 3356 fxssvc.exe Token: SeDebugPrivilege 3268 alg.exe Token: SeDebugPrivilege 3268 alg.exe Token: SeDebugPrivilege 3268 alg.exe Token: SeDebugPrivilege 1084 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4708 wrote to memory of 4220 4708 95ff66f0cfacba909a1d67dd52f4c6e883fdc381b1724fe9fcc7882c7ce12e86_NeikiAnalytics.exe 91 PID 4708 wrote to memory of 4220 4708 95ff66f0cfacba909a1d67dd52f4c6e883fdc381b1724fe9fcc7882c7ce12e86_NeikiAnalytics.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\95ff66f0cfacba909a1d67dd52f4c6e883fdc381b1724fe9fcc7882c7ce12e86_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\95ff66f0cfacba909a1d67dd52f4c6e883fdc381b1724fe9fcc7882c7ce12e86_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:4220
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3268
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4996
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3356
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3776
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3708
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1108
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2372
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3888,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:81⤵PID:856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5aff4cf8e21aacb91671c54a674ff3cb7
SHA14b3ad4b3875be49ce2e73a6cd82d88e04d3d2878
SHA25639ab0660c77d4b4892b7e75d72a2fd37ed31f7567ad3e1396e05531400b87bb2
SHA512b41ec8f5ceb792f08917ed5b79ca519a66d214285f80284e39ee547ffa6aa1540fdf4634ad854668cfe542c408279a0a00e968e36cbcd46df0062650646c03d2
-
Filesize
1.6MB
MD5b95975675a465499234b8138a74dc24f
SHA125923f39d6a28d202d75d70749f4f6392d61e4ff
SHA256ff52296ae4fdbcc3fa64a592d2cd14ddcd06c5c9369873b72469c812f49a33c1
SHA5126761413f2b1719615571d54a332aa57f1eccf2265aa9715dc68380906a9452a931050e39edef025304def627b4d581dda4c4de79763936d01229a8e990be123c
-
Filesize
1.9MB
MD546087a650e17b6d27a32f4989a1e14dd
SHA1de1f159ba82c8043fb7e8a923ebd42bb29781430
SHA2562b91a8769d04a60fdc3f187c2fcd1ce18ff40a2492e5eb62eabe84d03fb772d1
SHA512e0d86638a5b3aa1b88c3f0f71f166469fed40e56ad1bfed02858275a4e27b268f4a7b81eaf08e4e234f2bd6139609efd7554e48bea6752d9013c6b286159d1ea
-
Filesize
1.5MB
MD5ff4d6f6f170d74608bc9fcdb45a914ac
SHA12afa8feba988efe59c48f08fae20336a0efb39b9
SHA2562d95ec1eff4c19d7045749e923434e92fd71a8dcf664c695278b3c96c310454a
SHA51287c7bfbd27ae5d5c1948617d5cc1d650d704809f2acd7c186e11b28da6f6304afa41f344f1d2a867c5f396bdb21b256b939d11f6de20e344d289bed69188592c
-
Filesize
1.2MB
MD59544bd39119214418b3e70353247950a
SHA1e8d36017f3e0e91689407451ff57a63f5d4a78c3
SHA256d5e9bfeb5cb9feedc0f05d4614bfd49818b612b6499c1dc85a35ee89fc4e24cf
SHA51286f61609317960a83d6ee5013fe496787a7618634cfe9a1121ca1c2166dbcdbbf234e3398faa10ec5e22af862662a870eff20fe7dcc97c42b658a5f5dac47a62
-
Filesize
1.4MB
MD5e6c54d7d1750f9f92b0ee82867142583
SHA100be4651e765ca54b62b01936b656c3308ebabb5
SHA256aeefc1a449fe329c59bc6d474738286a72ca7bf98e1e0337f50134b49125496d
SHA5124b1b94f9b60f054b39e7c3ecd196cb690465a0b60b6c34b894075ce2844b57d52c97a0fb61f4232a685df671ae362d0b4c5d620b12828562c0417ca5d9d80659
-
Filesize
1.7MB
MD5e888f7b461bbe7d9bc755e6283d293c5
SHA12e426666e4efdc7e6f22d95b7882c507947b265a
SHA256f1fc2da7ce7c65007bd3b1b6ca215f6861aaa21d316847d8a9fe13eaf97f7cd6
SHA5120bc2f2ac95016e8888ae5545fc9dadd03c8e86294444f62e5bbd8831ae32fce16d4ebc0710065793e905871f4d82725dd791ff412beb490efcf5b7a4ff42dad9
-
Filesize
4.6MB
MD50296fee58b381b0994ff67ad7a967964
SHA183bfa9d520d2f3160824f68e1ce332a51b3fe88f
SHA256f233411c6980eec19282b1535c0221db1f626bc080da7daf7d04167dc0e7ce2b
SHA512415e4941af4ee8ae3882ce019521faa937cb970cf881c9e88154ea6cf03c0734a928826d96f2edfc725732537341731038a5cf85190d683273ec9453aff2c8ad
-
Filesize
1.7MB
MD559e68c76246bd9471fe21162737faf37
SHA15a142f3a92a699183b1e2d13e5366e7eff5c5975
SHA256edc3aab8232ebfe8f6e7483a267ef57a66466bcce437a994e7082673accfab2d
SHA512ff0274416de5ccf2d3d8c78fbc81bc4bf4d012c34f7342b293661bbe12c81ae9c818984df4985a759ce3186e4d4a58f2f7325c5d740e5dc0ca1f1073241ba0a8
-
Filesize
24.0MB
MD5e5345d3fb60157a64c0f56345eaa51eb
SHA1f731695d5ee6a96eba805db4a128788b0db1b683
SHA256ab9239c8f0c5835015487915531aebdb10971b3b6b3157bd61f4bd7ec319acf5
SHA5122ab23faf3ef6996ea440ab62e18f47ae2f3b14ce50e9f1af80893b0a71612d61daf22ed0c6cdb9cf98b0fe542883f235e6db4d5a2265ba0089bab22c60878e6b
-
Filesize
2.7MB
MD5f092f6be7833415ba70abceb7c9bd073
SHA1ea20c86bce403b61857fce96ae9635bdc7b942ac
SHA2565a63fb70c986296fa3f84591c35259f5d1554f42f9e2deffce37259ec2dd4e1b
SHA51207ed1d429094fd6fc42b66eded528d254e69346200e24338e96bc2b261a9d2ba78d285f5de3fff6cdc68c08f428b888075be292d23f29eb0acd4b3f9824a2c1d
-
Filesize
1.1MB
MD573073a836b2baf0feda6229f576a6505
SHA19f90df46cafc4e5905a0340f90cd4553391f424d
SHA256cbba05d9c86362a6edcfdad4fde5b156dd02e8df737c69be67344ace7a8be9de
SHA512f9d2744868fadca697f2b38a6f716c4869ab3f31c1dd78482cc2fbaa5498e2af96e37870b9cc3471aad11ceaf0ffef23725e33d399e10617a8f958f877ad7b7c
-
Filesize
1.6MB
MD52427b96d8a37bda3e00b7bc3e5821a28
SHA1daecf451f6409232979070a350a81890c757ce11
SHA2560aa3319c4556f6b09b61b4a65bf93c5c5ed62c25d3a377e9b6e4a59b213d767a
SHA51291a5b9233ab17e82d7048e9b99599c972555cd2a92a2461b448ac18bb4a2f51cf037b7f121d4106b1b92e5aae9ba971ecd77d5d80a609d143d2ddcfd02509ec7
-
Filesize
1.5MB
MD5915ecaf8b57f3fb8d7cfc954fc3bb221
SHA1ed9b48da76b18cdd60e97e6b5237c48ffc65e722
SHA256d6abec24399dafa4fca57df3e3a55ea1e71a772215525f6217e78071c70cfd40
SHA512739959041df7773fd1589d1d20396046fb9ce657ec7d5236321c8dbead18478f64de43a3ad6f0722aa1f24ca5845a66b57851b6200960b59fb5c78d766dfdb56
-
Filesize
5.4MB
MD51be23a76df8340d1f305574e7ce46580
SHA18b3178f68562ccf13172aa9ef775ed3a98ce6ebc
SHA256b4f683495f1af11f1acad5089d2363afb17704685d832de4f6864920a0f47ae6
SHA5127c5542b2d980549bca4f361e454718161e2a10ac9df1dbd2b00ed7229c7f94ca41ce7d7148f425e11e4c8280d8d65e0e8daeeadc0349bfcc32a683f22b80dd55
-
Filesize
5.4MB
MD514148993d29c8293506ae588fdb76ce0
SHA1b5b068bad5a3e25ee7869749c987fc16b60cc294
SHA25638e3ae436b5956cc775342e9c23ddcb0b17a4848464bdb767070772b3502b21a
SHA51259040f6eeca547bd647af671aa7fd0d96a7b3ccad7883599ca5a19947a9265993d93b4a87162a41f43ecf6c7e3f06df289b8b8e7ea784bb4331b84b27e2decd2
-
Filesize
2.0MB
MD51fed4d09fcc5cdbc7962d8f67c4d50a4
SHA12be6f14dfb0888b3bd629a8bf63b92ae8c27a520
SHA256160be7264a9ab3ae030e84f9f875fda5abd4ee8c60a3cfea82bb45fea6e4a640
SHA51201f966d1b4d40583c1da55904487303f1044cc9990c55475dd488ea1cddaff22b8433d03132de20160f795194e88988bf637aad5900b1c737e9ebc07cbd3a922
-
Filesize
2.2MB
MD5575e4f6f6c705529d476ffa2eb9e1ec5
SHA19fbff7e28fa13ae4c6477af9bd63e56d24912307
SHA2563e66539976affbcffecde48ac7b54610b79bc90b7e629e02463cae29e723b933
SHA5125ef2b3529a42a6a36b63b5ba18b08ddb9ce1a4a38ea4e9a16be0a7dd8531a4b42af3a67fb2629a0a2f6113de73b1ba8753e5ace64c870bbaaf5470bfedcbf3cc
-
Filesize
1.8MB
MD56ceb411d5a4f09c73b2f8944047ea154
SHA1ff3c19331d52fab16476e0ac79dab30b6631327e
SHA2569ce6fc068a54c3966a88089e88e029d3a77b7927366317c0b1461d0dfefc2068
SHA51286dd77a8490723807b27841731e7ed905268ef50e33ccb1471900ec83c24cd74ead14704f9f265491abf35c10c6c449904e4e335d7aec34a7e06a3e415ff5927
-
Filesize
1.7MB
MD5c727319ec1bdfb9fa31a3d3898115c92
SHA1d58e3edb319e46af4a1de8801d250c0118db29ba
SHA256c0a1d4a514ca51a9bd547f481685f1dff5ec9e73682bfdaa8deb2ebd695c58de
SHA5129c9bdf8f779ea63c32836ea7baaae42dc0ead19b034d607989aafabf5d1b71bbbe5518351d5b96c01206dea9822dbe82c9ce7ac80bcc9180e09d238a09451f57
-
Filesize
1.4MB
MD5915c79d3d9460b5202db4d72a8e80f7c
SHA19d85999eddaac1a44240b1ac6c857fdd499adf37
SHA256010637b2714d759f7fb6f1ce2292b497b7659f0ec56df2bcb62b0152e2f80abf
SHA5125b6805970d1da08ab8f2c6ccc620ad022da2e6e29f5f9bd9a75b80dad1d51e4a27588fabe9da7864cb599335db7a1b6b6a0f9d1c1beb18d1b159c5e4c93a0719
-
Filesize
1.4MB
MD55b9db0bda01446ea90f5d9a8e55f4c1c
SHA157265193a7c8a477063c6b32cd6a98087ecc5d09
SHA256dd6333bebdf815ae3910e5a8fe81740b485cca999f3475b4a64cf85b81a59f8b
SHA5123daf6bb51e350c031bb49518b6748ed4c0a7ce61689099f0315bbcd4240d99ac53dfcc1af5ceb129add0bc945963472a03e0479fbf3ea0f14409dd2dbf1ae260
-
Filesize
1.4MB
MD502f9b66a1b3dfbcb0441574c56c43a0e
SHA194248e6899dd5aff77e464c9eb5be550846bf0aa
SHA256738bd8d2cb573c7eb963584c1e5699067ff05fb67f1f61d45f22b5b4c30a9062
SHA512a5e3820fa9852026449e0c44879296fcc1a254d79d739f0d31c509378afbe3d0cacd2aad1aebbbd4aa1cf8ca3062ae5c7a66410298f79a822008c9947ed16be5
-
Filesize
1.4MB
MD59cbb49bc8d24a86e6ff7e3a921fc63ad
SHA1551e3817721ae9d152ca58118a027e22694e827c
SHA2566e74651a215d0ebdf5f48e2018bb51f804ec40a5fe5d93b59fa1f23391f5db53
SHA512d8c5bb39de65928eb929770bc8d1ac69e578afba9f029ea448d45bd35837776d62daf27a202aed577686f778e5799f21ce94afd42d308afe9b2e16a7b353704f
-
Filesize
1.4MB
MD537867c4b00d159c2ace2297cfb2e9ef5
SHA12db1b19ff4bc6879ee84e75847a860257e4f1398
SHA2560f4a2f2977dab1ef936e3289ed5d8921cdbae239114bcfbf0e2279090b088851
SHA5123d1cc780d637232aafac30405d9b9404af8e935fd742a55987cfb94bc23fb7094f35505c66c46306c56cf0f7e82ee9dad79e3ca5aa43d7c2815c13686a4094e3
-
Filesize
1.4MB
MD51ac0aad0b36f719596b99dc2dc844797
SHA183a33ef7cf625a9e836793bdac2217e8013a2205
SHA256238485ab2dd2860e28d81f586248030445f95df0c72a052f3c7e5a569bb477a5
SHA5129f5bca349579cba36a63e381fe2da523eeafbf42bb418b39a192b56e69d71785e76ff11c9a88dd58ad5b6162dfb7edaede99c36ee8324845f76b404e8fd406be
-
Filesize
1.4MB
MD5069aabb4ca1cb2bc456d8183f0d96568
SHA148d785b0ad789fd7eaaf1757d1f7ea43415cf659
SHA2566c73cd64318c66d0bd31262930fc32cb1b59b8d4223b6ac73e7e5af79bf2738f
SHA512c44ad1774162a2611cb1a35585533c7425bc290a463a4399ee4d3a6de5add88d2b0b06ede4709184fb9d4ad6a20adf7cefa8a0779cb505426ee8a1cbaf62a4a4
-
Filesize
1.7MB
MD56e39a878e65237bbdad2f705e2cb425d
SHA1665684f6d5406f6b82289abacb3ba011ab037497
SHA256fc7fcdd4193ff80f6a18e00c77423b1f73c025bc872e1f7992a79be4e4746153
SHA5127253b2f4d645596f417fc27fd636745f33d0d504031d49650591e731ee49fb16ae9083c59e8bcaa6d2c99e5a34a8038cdcb06f9d575f5ec5dff13419ebf9a002
-
Filesize
1.4MB
MD525fad683b094458badf09543631f592a
SHA19e9a7afb5fa63837d846d957b6ceef16082171e9
SHA2564bedcebf885838cad7f3bd5274deba9754260a42a5816ecbf61d7316a753fc37
SHA5126c5e76a8855f562c286ae9b254a61d42830c5306a0f6fb4add9482bc8811d95cf7c5f451605c03e3c3158535cb71702b92a1cf28fea56cb67477c47b165ffde6
-
Filesize
1.4MB
MD5650bd791444e091fe89a1126a5a15f82
SHA1b6956f016377b2fe233bd392b679bab61b27fa26
SHA256e3c80d1159fad9126e159d76df71848f866883d6633903d2572cbfbdc9919c31
SHA5122ff438f34840a36fa36d46c4ea933245eb1308ccf6089163616cb1820ce068e4fe303b87b2866499efb9a0d1365b67d47a4626ecbd54d9d5763e81bac4e75304
-
Filesize
1.5MB
MD5d13ac24938fc148b37eac1abd677da0a
SHA1cd96212dfc2b9a778aaabb1069787a064094e4f5
SHA25695f6e49a304d804eb8a08a1032d54f5911dcc32419212b3de7ee453a27ccb4fb
SHA512abb2218354c1b5d8651bc1739529895ec88e776305391d2d4fdd0e4827f01075b6c898ced8b872119ea1e01d96dbe1bf12aac7e4d58f136676a386240b09b071
-
Filesize
1.4MB
MD5eb93cb294a3311e226e01aa35b819e9b
SHA1837dd8d36352308c818298890a7a3fd507d564fa
SHA2564b7b183d9120a080b5c246cf56bdec21974e276349134255f294195a6538a071
SHA512c9dd57cff9dfe5a21d07ba16a218192bd5e7b7138912f3b79600d21dec68a317d99ccd1b160ea501c61e619c50ad3a71175501bb4ab0d51d7d94250fc955e7d6
-
Filesize
1.4MB
MD516a96e79c8d3249e84462211081aae56
SHA17c509bd8186ae68a0ae38906b0eab7901dd9b005
SHA256af0d2eb39196e4ce412cf96376824b83ae7fda9376dccac11cbbe1ab72a831de
SHA5129087c8caf57f29c314ba203a3198d8be6ca6611b9518bea470a1d23a7ff6ba387e2fb7c6291b803ce0d05dc321233256574745b09fbbc5a325a1aaaee243d2e0
-
Filesize
1.5MB
MD59a371335cc570eccf96e88bb6e6a490c
SHA10f3212fc204de5b3cc1246640b4e04a1991d33cc
SHA256fca7ea04eef31693fab8edf6d1a7087ca1e90586ff56b9114c2712769fed0aa1
SHA512a56f581cfcb15824b28dd31cad6c965dd304c969d7187397f8a2e83b1147939743f9ddc1669bb1b8f4592b0d75f10a5010c20a4c26c381384a15c9cddf75f849
-
Filesize
1.7MB
MD5b9a76a78b254fae566e95cb3376f7771
SHA18217637547eaf8db093f2c4a2a017ff73ab1e1c4
SHA256295615a2dfda31480214751524b7dd0c2ce35d81fbef5e68f3c7e4e53db482c0
SHA512ac8bf78237ec528100a4f59d5a13cc2f20251850cf9652e63761e407f95db65b41195faa0c2e69ee14ade390ae42993e32200af5261510a100066f15ca56017f
-
Filesize
1.8MB
MD503189d243347c9644f80dedd57527dfa
SHA1e1326c6d277dd0d1309a12cf4c6368a1102a894b
SHA25686fed14e9dd9b801a6d9165caee69483d6b7e9535b8ced25a68be17da0016497
SHA51250ee1758b25cddaa9fdaf76d21084360c2ba6479854526bde1513c33d8da8b41fdf563beb40cba47c691ab7acc8d4880f141e1b1e0349d398a71b80dafbdb3c3
-
Filesize
1.4MB
MD5df969a128bd1befeceb92ed956efd050
SHA11f5b3588b72596fc1b92af255970a829fbd50e8e
SHA25676f54b19c57632bcc483489fd916331d34ad4301fb7354e2d451d3615f7f1e8d
SHA512abd961c290ec38d41c927a16a4392eb94a8b75f0e7fff1f83be6f45b41772de9ab9b5fe35e90afb30eabe478ad1289673365ce2efb6fa37e590a43d84906d041
-
Filesize
1.4MB
MD5bb936b98b0ec6ad46d3ff0fbad337eb1
SHA1f41e0c5e26c6ddab698af043ef54b610024aa2bb
SHA2561dd5115697f223fba91081571f27a89dae365471f873a9bec58fa0f7ddf68834
SHA51279e22714812b238215b96e60336c4c3bdab44ebba71123fc37096135a6be3d97835ed9446e86f95435b8077acac45734d77a094c4b18ffcace062374fe2ed030
-
Filesize
1.4MB
MD5dfd3e50294b13b91047108e4c3f6d74d
SHA1ee75f85e657560631ee39ba7e51fbb86dd062e7e
SHA2564ba096ce34ae8086db0c7d4e6e1d1d735f87c8b9c67a72e861d7e3970239de4b
SHA512f628369ef5f2d674bbd87ceb9fd6a31164b4112fcd0ef9bfb967fef2ffa66ad07dadf13aebf71c35bcc79e624e0156229a50e1587cfbec50063f23ef614c7728
-
Filesize
1.4MB
MD54c68d5bbf993549ad066bf1cffeda2f3
SHA13ec9d072ed66da629d6d7ddca5823aac79c053ac
SHA256fde9a5cba83b9c7d720e0887340f14e9cd6102ea0ffb6f829c9abd5e8ea4db7a
SHA5129da6602f00ae4b3c0b72cef299b6fc7a387c6c3960d29510d964678779306dde4b47169d5ed8926943be551b447e146975b12eafae066c282aafb2ef4ac287ed
-
Filesize
1.4MB
MD5a05bc4f6ece4cde5057fd35ed2b6a0e2
SHA1b1a0bb46605921f7cc065cfc882145bc69a530b8
SHA2567d6c756bc634c9a4c9caeb7cb2ed798fcd5ef6d57d23602ea88b35e4b75f6e2b
SHA512a03ec35470d37dffda7b2b7da8e2b85ee7bbb0bb7718746bb12f1ce0f3895fd657192664c5487c059ee737e18c95c0bd6e9fc8749d34c6c5227334915282ec41
-
Filesize
1.4MB
MD511b7b0f662f7d5ee3f467fcb0b5064be
SHA15f8e17b35b7fe6a2787b57e7233503667d03d6a3
SHA25636253f891386a3af2af5dc406519f09b2d7e9b0e85e089878f6c97f41762f088
SHA512cb4e13104f7af0b235c12ad1a9be91fcd0936ebee8a0faed924cdf0b1214fdcbf1cac2bd5bb4bea4b5373955a3812193b3785992cbc389ff5d812fb8e17ba30b
-
Filesize
1.4MB
MD5eefacd83b8e4390c61e7e7dbb2b82cc0
SHA1563c2e040fee95499fd7143380b7c8fbf31dd71a
SHA25670c6d85d367ccc2af0691b1cef9f98e1f8f853f4a11cc0bf8b8236a095002c3d
SHA512cbee94c7d8dd2b479b7cf7e0a6ecb1f854e5caf109537081e6793e1a8dbc181741be6e4d60566976fe1cf8c2d286a8434df0e2db3fbfe8abaee66060e6ea1ce9
-
Filesize
1.4MB
MD59bf1de51484532f30c86352531506bd0
SHA100c89982d6e771edccc8084f8dce442df2ef10be
SHA256af3df6bd835157458b4ab865f588be35b26ed77165510c763d32b043dc57210a
SHA512ccdeefac730dc55f1f0d3e932ee4addac7ad2b5c83e46d39b7fbe2ea58ebcb7a1ba48196c703c179c5a32ba86ae9ec0cfa3d869bbdc23115e28723188f97fe8f
-
Filesize
1.4MB
MD572eb6d82391de1a67e8f64d72129a513
SHA116107958b3e0c4d02013b020f68587e5c25948f6
SHA256e26ec89a059c9b30b996b3e31e140800c66dd11e7a717b3575a1a85af8278073
SHA512a9eee17c1dfefbf173b7c83bcdfab8fa1ac4267f07819cd539951bac792ae7c05fcc4de91ad7c92813b8eca6d182a0d149475e0f194df1ddf2a7a60e059c1403
-
Filesize
1.4MB
MD55aac68f5fd44ceccbef95956602cbb8f
SHA13c554f7e35d190bc47705226e291e6b71e1cc737
SHA25649f99998d43bed9aabb26f3cb2c9abc55254435e8bbb7d1c31a6eaac7a1a47dc
SHA51229b4d5ae22e6d1418ed89743a5ae00f84bb0e371f2a7d2cab419b698b9969fc426db22807f017fbfa6d900bf3a3667e331380cff388e3082c2cfbfbd6d330d04
-
Filesize
1.4MB
MD5754aae4ec29188f9e8253ee94294614a
SHA1c2ef2b4f14d2bc12955939741c29aac645586ade
SHA25657b4d73861bc9d454197b4b2aea251e987c2a260bf099f8fde95f4a3f1354506
SHA5124165dacb448871c448e7813c2d23003a8f7859cd7a0c6df33de688144973ee2ab9e5cf99bbc3508840781eb1af5c69cc14d987042af1a03428164ed3d77e8c5c
-
Filesize
1.4MB
MD55ee28109fbb9e3e3cf99709e215748e2
SHA1b3340c77b24cde1d5222a34bed9b6c6310943674
SHA2561aac8854d58b59447659b9fd8f9d8c0222cc82f3593aab4b0a352ddcca9f6717
SHA512f52198064812efb28fe48d8fec68f5d7ced41cea1a6ccab2f875fd86bd6780c01033bb43250c2cb74e51c246bb90d9840c2bc26dc45d98dab9019ea386703ce7
-
Filesize
1.4MB
MD5ace5f5a2d3a75c14f18381525ed788f6
SHA1e18f083612a02c3667b479d400a0287008fa95be
SHA25611b7d000e9b346e74a69cc0cdeb41becaa90646fc26b8ba68175139ff601d412
SHA51239a7e0309104e6d7485b35b55b9a4de1ed0331a8e40a38c0a6af3be62b0e0918a8f222b9b8becf107fa99918cc374ceb41ff9e8f694d612f30fe340cc7ee4706
-
Filesize
1.4MB
MD55be7d0234f4e330973dc2f70b8e08da0
SHA192cb6676f0963ab673c6fc85dc7f7bedda91e074
SHA256bf2fef3ddc0b034f86106af208a9f923551a29b7a0c2b67a3280fa3ae62bf968
SHA512c799c6bac2c762eba41d903f2e69d75f824ea09b1d45ab770dae02587bedcc50a34adcaf8bf5fa00d14bb53402b890cb429f1dff73b0d423ab33e7ec0ea17246
-
Filesize
1.4MB
MD5888bd88c36079f92a6b71a293e4ae09a
SHA1f217f130e13780f97af4d1683cb9105e79173174
SHA2569c9f3101168f2eb23a8fec660ecb1f9dde2a0526c5e931d2234055a20d7e85ed
SHA512b60a1ae3b1d973b402d09579ca350a4e5d010ba4a97e8f2d79295b224b349559ec2e116ba63e8f2f3f6abb6bbf7c4fdef726711769487a560ca4c849c0b3277c
-
Filesize
1.4MB
MD5b9edd50d6caed4956b7089deee0a7267
SHA121c437e96699dca618d2b770f241612676dcc80d
SHA256e8110b458392ca0ee6e8662e84bb219f9a368c3ec98785756f5f6a34e57692b5
SHA512216086253baee88c4b38c6d39f3db597b000661c30fc363a84d811d0c3530873dd5b97f3fc80171374a3ba716e0d1685a9c35ec916bbb54984408daad23a6a03
-
Filesize
1.4MB
MD5a9ef031687d90af2dc5ea63ffda9c1a5
SHA1bc25d74c31564d87c36f7d68d443205a4e7d9385
SHA2561299c8e2712f842f7fa96bb12df0de25ac8212ea7adce11596add630be61813c
SHA512b6e3fec33d3b7834b372896fc4d4cceb648ab6e527f14c66a6a6c33066e82fa5c521e0ab2278bfd6aa01cce11b2918054b7bf7a5e0dc35d3d38b63b136088b72
-
Filesize
1.4MB
MD5f453b6f48099043bd2cef543953dfc2f
SHA133dc04510dcbe429c5bd326a98dbb3cb1f51dc23
SHA256b36b2004f34c7579f4ea51cad91641d7c334eed07cb432d238c8a8ee4fa8d842
SHA5129cf5be3b3284c9baeda8e04baf42834c00a975589b5a403935714eb416d5719b7414539a9725da2e2c76a4f8db6be0a1bca14d01d8ba52fb07c9e3b14a6a9ec1
-
Filesize
1.4MB
MD5702d9163455206cd930c5d779e31dc20
SHA189a7f0c1df01891e57b6552289b4e3741a3fef73
SHA256348e7101eb48737da3369bc69c372785d2c4b587642eb5d6bdf317bd7adba867
SHA51284036602ad31adfe2eceb36b980a414afe44d3530c2ba5ca04e75a291b10f012d38c260255cd033fea6f0861f2a356c0ca15c43bea967390c97984c08963d890
-
Filesize
1.4MB
MD50e295b03a8433017e42d2a081c9f4d62
SHA1247e165f2475438e395cbfd8945c9abc673e7558
SHA2566125f4b0ec047307531aaa38b09e53c35144f90c84ec775869250c6ddd3f5eda
SHA5123b92cac83b75c6f6a5dc0f5aa235e9047563c5983f29c0885214f9dedbc1aa7e65fa4e87d383a34103994e94c236f98a604d7bca986b06a4d2d80ab7122597e6
-
Filesize
1.5MB
MD5c92475720af89070d728466b73d1192e
SHA19448316fb5a7db2a16bf79644751b16f30f19dc8
SHA2568b053d79ee7700e62e326378d2c0b71b9884665a45a318e518072422e1081e14
SHA51274d4d8c5ca001f52262b3d7e7bcca02427c1f449552674a0c44c7b1824fe667e0b5d5ed428c9f095bba17f91712bf749717428aad73ece6512265471c1aaf0ac
-
Filesize
46B
MD596742c2e08226d498c1bcadbdc7b07ea
SHA11fdcd2c179401f6b54ab61947bd450a7ca272cac
SHA25644b7092e24de4aafaf88c517046fcfff33a108aaada795a2f6492c410d0430c8
SHA5126897ec19f82ca37a9f601b723f18012c5336c5eec15d2abdc9fa2cc8599118836ef45b96f69a3f542edbaf9f7db75e7698311f07d50db638d08185b8691e735c
-
Filesize
1.5MB
MD52474cfab853b896466d73911ee4a9378
SHA166d9fbe1fc60c4c93e7b5cdf4377d461fc4ea6b2
SHA2561f68cbeca341ac7661242b4b579f536e59a057785d372961a8b4c32fbac68f80
SHA51231f7c6feb3df23871bec542ee0682ac57d71edcee040026f8ae590abbed1fd87d42aaa118dd9b6fd669918b9812f419c86c3b2ec5ad4d932b8b4a0da5a887ba2
-
Filesize
1.5MB
MD5c41ed568127e736f6df3459cca3fe0e2
SHA11a1ea5b587abc4a3528b65aa95db57bf62d0c502
SHA2561a3aca59ac71aa6d1c20fc2a72f81bf4f419023b2b70428350d73a08c333bcb5
SHA512ba6c095825952b4ee343a6ce0f97468a2d17f45978a297ed1714af0f2d8d4de12ce2b444669eabf2e0886116b0db09805d2381232d271fc15b8aa05df444735a
-
Filesize
1.3MB
MD56c1c6bde8b0a586cceb19244e0e5cebf
SHA147ba67979837cf23fd1ba9c47afab5de7a883ace
SHA2560eaa4ab90fee6f1c5fefd99b614ae4566f99fcf68213354b3bbafb4563e8b787
SHA512caada49528d949bac282b1b6f16f529cbb3015509de854a12f2a2e8eead6e507b10d230e9ec0785dca9f8452e3ce5a397f615277c5dfebd29aa7a0e200babdc6
-
Filesize
1.2MB
MD599a6709d3e3811bf2e1f161994309097
SHA19cf3bff37ad2e31d60c8ffbc9698437cf63d3cde
SHA256b0ca0321449c5c2e68d38e059d474d030f50fdbf72d4e1c30188ff0a60135b6e
SHA512f72696ca8739f376e84efea09361bf0fb2e9edd25a46154004bca6cf098ba4175501a1168b307fe28793074cef25e512a4ceb33c51ea1eb52547463f0df4d192