Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2024, 02:40
Static task
static1
Behavioral task
behavioral1
Sample
519fba1c9ee8cab89c76c951856dbddb024b1f8be25e3067b39e7fe004c60c38_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
519fba1c9ee8cab89c76c951856dbddb024b1f8be25e3067b39e7fe004c60c38_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
480f3d77069790e2b647e435f7361870
-
SHA1
6debddcd9959b0777fc7102f9d6d7634d13a9266
-
SHA256
519fba1c9ee8cab89c76c951856dbddb024b1f8be25e3067b39e7fe004c60c38
-
SHA512
8f0733c03b7d07f152029f4a551935128a650f3a97834d49db0bfe0ef66706146c5015124a3ed3bbc73440e472518e82cddebae978adb6539d44490486f5c03d
-
SSDEEP
12288:z+IgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:aI7ozX0j52pMkuLoiSJVlIL29mhNq6
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
pid Process 1428 alg.exe 1992 DiagnosticsHub.StandardCollector.Service.exe 772 fxssvc.exe 2852 elevation_service.exe 4676 elevation_service.exe 4544 maintenanceservice.exe 5472 OSE.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\aa32cebab3e2edcd.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 519fba1c9ee8cab89c76c951856dbddb024b1f8be25e3067b39e7fe004c60c38_NeikiAnalytics.exe File opened for modification C:\Windows\System32\msdtc.exe 519fba1c9ee8cab89c76c951856dbddb024b1f8be25e3067b39e7fe004c60c38_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\System32\msdtc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 519fba1c9ee8cab89c76c951856dbddb024b1f8be25e3067b39e7fe004c60c38_NeikiAnalytics.exe File opened for modification C:\Windows\system32\AppVClient.exe 519fba1c9ee8cab89c76c951856dbddb024b1f8be25e3067b39e7fe004c60c38_NeikiAnalytics.exe File opened for modification C:\Windows\system32\dllhost.exe 519fba1c9ee8cab89c76c951856dbddb024b1f8be25e3067b39e7fe004c60c38_NeikiAnalytics.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 519fba1c9ee8cab89c76c951856dbddb024b1f8be25e3067b39e7fe004c60c38_NeikiAnalytics.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\msdtc.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{1342F81A-D5C5-42B4-A5E8-933F7759DA30}\chrome_installer.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 519fba1c9ee8cab89c76c951856dbddb024b1f8be25e3067b39e7fe004c60c38_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1992 DiagnosticsHub.StandardCollector.Service.exe 1992 DiagnosticsHub.StandardCollector.Service.exe 1992 DiagnosticsHub.StandardCollector.Service.exe 1992 DiagnosticsHub.StandardCollector.Service.exe 1992 DiagnosticsHub.StandardCollector.Service.exe 1992 DiagnosticsHub.StandardCollector.Service.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 676 Process not Found 676 Process not Found -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2260 519fba1c9ee8cab89c76c951856dbddb024b1f8be25e3067b39e7fe004c60c38_NeikiAnalytics.exe Token: SeAuditPrivilege 772 fxssvc.exe Token: SeDebugPrivilege 1428 alg.exe Token: SeDebugPrivilege 1428 alg.exe Token: SeDebugPrivilege 1428 alg.exe Token: SeDebugPrivilege 1992 DiagnosticsHub.StandardCollector.Service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\519fba1c9ee8cab89c76c951856dbddb024b1f8be25e3067b39e7fe004c60c38_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\519fba1c9ee8cab89c76c951856dbddb024b1f8be25e3067b39e7fe004c60c38_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2260
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1428
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1936
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:772
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2852
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4676
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4544
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5472
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:81⤵PID:4092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5829659824b3958d3d0f1aa6299778a76
SHA109787dea5d1d4823bb2e4155a9d85d055afadbfe
SHA256a55fd0a6cf1235653332321f4af5570613b4d77bc73738e8b532b7ebc9d20a0d
SHA5127205c8ad78ef53fe5fed7be3309319696ef9e8beacef09c1558856cac5bb412c8d03e1e5a10c863680b80f1e9c8ec438e56a4f7edcd789350a43da60b0f0f1f6
-
Filesize
1.3MB
MD540549d5b355a8ba6cf31337c288c8cee
SHA1659cf88489f634c5755191e0f786787de72d2917
SHA2565c5b28bb83c20d3707390a8c67cc192c21b572b0a685f5c689a2e8a185b68482
SHA51294188f253fcfda8220dbaf2e3abdb9a78e5b4d055c12473653cb4b3cc6e7334d0106435faee3363c85a6d367df12c85873fd6b10f28fc50a6afe8cd5c2f5af58
-
Filesize
1.6MB
MD5814d8aba9a3c775491c89cd16382489e
SHA1def9add31f71abdb3bbc18146ffa8c5e33dddcec
SHA256807930a2358fb9dc5a5ed392a8173ac1e368d20b81847a7271585a391615f659
SHA5120f321e343303a66b0240d575d7f9e598fe69059469217208837087a729039a14ede35b96c3fe289eb1b95bce420147486de385d84f578f61325c3ce174ddc1b5
-
Filesize
1.5MB
MD5c6203a6203a3d4c6bebdf0207417a434
SHA1d5ef2f0023d33d44255fd68342d9dc4bad8fa72a
SHA2565d5bf279df069ff575f1a0ba8f24b385048de7c227f9585a082ad2c11eaaee1e
SHA51203778d6f589d6b0434818df3cc0b9107bb0c19c586c72484e7a32a9356f0d93b3eacb3b4961d92659263e137a8ec978e0beba00705fd11fd1dae61498908bdae
-
Filesize
1.2MB
MD584c5ec850ac0aac0a269af79da832fd3
SHA1bcc81f1641ca1e76567ff330a82d17730711c5a5
SHA25689527075bf2ee16a2a3a3320c1032c6eb9f5c691136f40940c804943e41b0a26
SHA5122ecb184486c70ad9e71ceb3d945b6a2bdfe1dac09f938db2a8a3250614d8d5f344bd9217b9c0d8d761f0f2e18cc2959583ef43321264a9a4afe2bf845ac3a5a4
-
Filesize
1.1MB
MD5dd7380e56d0803f93f1a8ddf287ef1f9
SHA170f5783308f4a838ebca30f040563e5896295d4c
SHA25689a0a4917b7865f01e4c81b7a0b1f225829ee1197e18ddf7e057f2ae1f384798
SHA51225b9471d2f1a30a152d20296c1ea3d406cdf28d0497a6a596901b8dfac3893342bbc07e8b86c79e36daca0daaefc086d77c38eb59c81ccfca67d05d4cfc85621
-
Filesize
1.4MB
MD59258abcb5ea28bf125d839b51d8aec49
SHA1994ed737d8ce0a9a850b11f9ce4b34258a7ccc05
SHA2566547ee415c2b39225af84f3c6b2b2d81c63f4a2f47bf9309f521b9f3524ac69a
SHA512ff1dbe87774a55e835f260048a3b5d02beb575dfb884853cf9f890b08fea4c013d147af128a86ea5fdf3f393d000ecb18b309267c4e9aa85b7a5f72771b995c3
-
Filesize
4.6MB
MD5fde37ea988db7eee78ebca6d8d1f6fa5
SHA1e0518da21d776db886663c0ec5aa27dd7c5953c5
SHA256b68f639976751dc7b9b0a88d3d5ec2000bec29acd2d97436d4831b08cef6a484
SHA512f5115b2a1b920f10fd7ba4f53b4f13b9b28f7694fd0b1c0f0250b4e09ffa314847d9865f0bd2614ee4e865ad9b4d5b0fa70d1a9193f9f7424756d234a138be84
-
Filesize
1.4MB
MD58c555526a65fd8218a1f43a45fc346ef
SHA14dfd7fd71f3db2919a6b57a3f7015b71e1072690
SHA2564c15d1d61ff45f2fd01fbf24352db4e787b55f8a5b7fc5081ca43daea4591492
SHA512d1183a88be61a97ae2494723dace0999bfe1d86df59c5be20e8f62d5a727d9aaec43cc731922e34524fd62ea28b08fb72a7f3341f3f1a06c04d0f1a4e50e54cb
-
Filesize
24.0MB
MD5c2b50b03ca6033fce6d5a0c5b579e31a
SHA1c0b8201234cbb5e3f1e2cf92766faaaac1ea16c7
SHA256140f5fe628fb9c085a1133226d503c3ac98d1b4f90f197a1ff6d9daa794e54a8
SHA512fab5c22f4376ad9a00e4c9c80af77f9976672b50b08faf6b127da94133c90dff0d9f0913d0aea1fc233057059f3a4b5c7e9288c926756257feb689a557870585
-
Filesize
2.7MB
MD5b4e779ac66cb416b4472069027d040e3
SHA1ce9e5eae2b6d92910c0b4fc77eb8a62070c51628
SHA25656bab9b1b90415d3d0ea068bb07f73d4ac08789d21061e532bcc2bb3a534af8f
SHA5127507a8abad925e30297b5c5b8f0c38ca4487d3e6a48925bf591bcc86e0750802c672a218f53100426ce5816ea18b25bc0e56cf76299c85d74ff9bd42d799633b
-
Filesize
1.1MB
MD5b11740bc9c72b5da33b2c76772e1dc1a
SHA16b605031927343240bfebc93991ca2ed01114c04
SHA25675b35481fd7624b452caab40391306b70564966679677e53c2d5411ee7c8d084
SHA5128dfa57b9693adfde1cd9dffc20362585d7624c96e48921bd79dfa24132b5cc450fc657d7eae8a7f60319490d4470b8b838851231eda7a1a3604108651ce94c24
-
Filesize
1.3MB
MD5ee3fe5b6406c37c9aa497af78f39168e
SHA1e8cfe9a37a3f1e1966a750539b68c2decdace377
SHA2566695d4386bdea142f6aa748fc0e6ac5123c2791ee6647658493c0257d9cb2437
SHA51231e66ad897d784353956795a73366c4cc1c362ccc2e7176cf091a82a06859ead9d0f1dd5c185daac7d0b3dd189fca996311020cfb5bf2af744a7633d145794ba
-
Filesize
1.2MB
MD5ee10fa08b91c636e54b05c2ea82036a0
SHA1db1d4205b26bd96fba38ec51f8aa162da545b1f6
SHA256ca18a2d01864e9cd6c23a53c6285784b3c448b6d23a1e58933508321b8049da9
SHA51239968c3a1c457d0424da9e4fb634fafbd4250e7ab81a1f95284bfe55dede9fb33554f03d7c8c47510fd2336db0f817996207f4d32551e166c4d3cdcf7265c280
-
Filesize
4.8MB
MD5d719f1010127f7c5cff8b669bdcba1de
SHA160aab4e6d23a37a4b89ce97325515c74d86d68d5
SHA25632cb9454dfb98c30a7e9a715d19d7f0fdbc3c4e1abd02270b74a543dc1ea547d
SHA512e11d8e535e7a5e3412099d051df5c7e275a779f328b12cefec06e81b11634eb357b6c9e718c1bc1bee3ae8402100068f8c843c517c3ad3459eb353bd3325360e
-
Filesize
4.8MB
MD5f7bc19817d8f78a50fd7bffff208121f
SHA1acf09b1a12989f816c0881c5de08493329ced85a
SHA256a371397816dedb8e3502e94b6afa9f5ba3a64cc34d6ea3dc836a020fe984a94b
SHA51266c35fa0b36e9f25b8ed15d053111b1841945be4c31683721d39d32fd972adeca0b77f20f80dd13a476e4babdbc3bae14a402c1b2ae09625e053381241d48f8b
-
Filesize
2.2MB
MD5ad66adea81836f3e75425ba39552ad9c
SHA1c3418671d6e705fe41692671bf2c8d9b35bbb101
SHA25605bfc12492df365f0eabbad1522fc754f7a7b6edf4b1e298794d856d8c3df3fe
SHA51230b0fcaf447ad26b2a20200f638a868e4f5c48a8b8ae1cda104821317052d0ecc5b258002e3663de8d51def873beec606f0769517dd0aaaceb0c27d0e193e6a4
-
Filesize
2.1MB
MD5fed37d79852a25bd6835b02ec6308ad5
SHA168ad4cc3bac12d4a60968ddf3951d8307c7e9f74
SHA2561f212a02140b44ed8714572f635c1b7db4dbf0c642dffc35c42d5b2171a28e46
SHA512a71e9a572503270f5cd5a962ecddfa3d0d944816a224a15ca0bf13dd16cb50f2246e872f8b08b0f5f553234a496fdc140d893258868adee6675301bcfe125a9f
-
Filesize
1.8MB
MD5ca07d1ad021e6e49ed42945df79390ae
SHA1c70dbc07eb10d7752f6ac59ba18e0fe136b261eb
SHA256f1a3aafdb2506c404896d5a8e7cfe9fac544e84467cab9fb6f39224a078c4765
SHA512f5b74f8a667ec369caea131fb680eb372d118ae3f33c3f200541b0f7ef530f3447665f2b3ef10cf6cbd87d0225d07b4219e9c6fd4a2e44c3c085f0a361b420be
-
Filesize
1.5MB
MD59bbfdd5c1883192ee1534428f2b92548
SHA15c2af9fe8efffb4c84b6f4cd7b360df7a515f891
SHA2566c96821cab9bb6fbd96fdfd728bba5272dcaba4100dfeb74af52aa83146cc589
SHA512af79b0d62cd760eebd20bcd43104e0fdeaffcc4e14c0bc6fdd9158ca59c839cccccb4c05b32e2e56ea3e4ab0baf3d9ee1c884081099d4efcd94cce685840642f
-
Filesize
1.1MB
MD589cb9e22c0238dca0d5cbd38fa7baf8a
SHA1e71dc6b926214e8c71970d6890162cec5d65b29d
SHA2562e338278a1e597cd0e665ae380d78715866f277c6ace15273e641556d62d39fd
SHA5120c2fc1400e2a898164ecdc66bb7d6d0fe027f6107e3e0acfc051d50694d53d03571f464d7b86a7626c4095c57a2f5bae3e920388861a3f9ae39f4374ae5cd1eb
-
Filesize
1.1MB
MD55931ab3368810aad90e99a049a239b87
SHA1f225d340aa0324b25839b17501bbcf63932c39d7
SHA25624cc89f9e9f5406fcb46aad86467a1238ea602576492938e7a715e084ebfbb28
SHA5121f385a5ca9782ba25a6981bf0f429adbf8a7202c0161f91306c8a614b6e65405deac32b91f9081920a0f53fcb021f2e65e678ff129c6f4ba0bf79ab211e18825
-
Filesize
1.1MB
MD542d4c2424eb3144942dd94eb2105384f
SHA17440b0dd54fac52aaec6b59a5aef28210d2c9d7d
SHA25604b1409e6ebe92686deaaf022c5c6a100c037794f63a2ba45346c3678d3e6cf0
SHA512e1653a29ec02f07b9a7bb1a49fa449aa2f2b3d8350ce257aaadff1f0930cbcbb2089779e10ce8285fd5d34581730cee46844ef327e784989947a97f878b1dd0d
-
Filesize
1.1MB
MD54d62e6401213b307345094c53a5fd0bc
SHA11788d527faaacda445981a5316c7bd7dea309f77
SHA256025d1eacabd9056bec32e2c662a1292f702fd9b068e908a5cbe719ec9670ecf0
SHA51269a4a98768818661d1d0e1a7688b23985f436d219b185155f7fbd1a8f5ef1962b43cc47aeb7554e194c0bef797e441a51f07b6a5a32914434b42d2d032f50487
-
Filesize
1.1MB
MD57afb2cd33831fdf9c3a7d48f5bad15b4
SHA1ae54e2df3a5115323681e93c25344c12576b7322
SHA25631a9deab28e0981395654261a668b2beacaa13947fea8bd35f1c607c86d997fb
SHA5123eaa46bd1791243246f98014a89d6a41b0be166f162d66c60f32d9dd110c6015c40891372ecb2ed02d5d7f497744c7e047b00e199ab3d937eff3dac87b99cc1d
-
Filesize
1.1MB
MD5406b6dc2a8afa4f2db5b60f633d8ba86
SHA1a7e7ce52c6ab28881cbbc068625cfd5087d7eb29
SHA25643c591e35f2c08efef2f38430ef347e83b22aaf39ad75af7db07428ff575e088
SHA5122003adf92daf5a36758966a4d36f593e2b01f808e65a5d59271e1b9d00580c6406eea618e479b86056190633a628782b08d2519e619fa6dce55831c0a3d6067d
-
Filesize
1.1MB
MD58f34072b50c46cbd4d7406bf48eaf309
SHA1803b85e42225666db5627347eb425d33635e4f90
SHA256cbaffbeb7d6bbf876cd1508b383bd909f8b43e7f5c1d2c5854c629ddf815718c
SHA5125ea951fca876a2eafa55c95ebd6828003acdbb5291102b1430bd3d571b7056577ade8e5758294df5bdb644a59999603794bd4d4049cfe552fb65cc04cf15f9c4
-
Filesize
1.4MB
MD5dbd6b2b5876b2dcd718e50fdfdce6216
SHA1b44531cbfd1412c6f11a81a871a7b4c3e2877310
SHA25618dfd7aacf49e027258e51e04911ddd81ca470c52355c2a1bbdad11ed59ee831
SHA51230ed6039b9326fc2d3ba99d92ea1612225a798bd8f71c6faaadf6664b8028f6529baa849c77ff4b4f7a617c71cdd5a544f3abef8b888b585452d5e914f77bc6a
-
Filesize
1.1MB
MD50674d744bff576bc0949c69994ba147b
SHA1bb84a895382f1a63cd7223d7f73642456a923c71
SHA256562dd168bdb24c6e46230df6fb66a0c53c7d08aacb6353411672ba2617c6c3ec
SHA512840ed383157ef603b367dcb525537746c083f14438b259b5a0e2a3db77d9bb8258cccc268de79153287c346b946b0df7f65c3081632bf7a02936854e87efe2c9
-
Filesize
1.1MB
MD5290fef99d640ee14d92026bdacb7dbd4
SHA1007884a077a155b2be6aaae7a653c58d70b0f0bb
SHA256ebfe5ec6f2ba0b8d73c465e08ab34e550324faf2529630d38af9f2215c155138
SHA512aac00dbfe26ce9f62506c51ca4f9f1556c1b42ef55956dacba7344ff0b71fa2240d25867c1d983849f6a0cb31630480d699c262cf86b73c13c4c0381b8222145
-
Filesize
1.3MB
MD513b88fddfb6284ca45ab34383bfc0c73
SHA13579b8f45f150d2c6bf7fa1af0be32471a2f440c
SHA256f1a4e5b4ea05aed0dbf081485db62f977ecebf1d43b82dd501566d821a37a6e3
SHA5127ec0fd84a91c18763545fdfb56854f605c2e20f9f42512d53f1958ea33c029f6a01480a998c1d098362eb5c5a6074b5ff9188895619e6eef2715c99924b4b2ac
-
Filesize
1.1MB
MD5abd2944c95bf220dcf533535e31c8bcd
SHA15666c31bcf2a02355cb6e07e1246deeb56bfb048
SHA256ba0555e67d8479b4b274c8ce5e671b3bc089d55daf3cc0cceaa7737ffaf830b6
SHA512e195fbe5e22f7f2a6403de9cd7409990b85201406e2f3762dc6d949a4dddeae44feffe7da87d4aebcd628cd206bc34c9e06d404fda102c9c50c4eeae83a317d3
-
Filesize
1.1MB
MD5625061bca3a51b41a19916387116487f
SHA15084e6032ae53883ff8dae2228e3f6e6c38bd5ce
SHA2567fb4bef5cfcc655537e678e219377a51299d00e39b64d5d0b08bc827301d8380
SHA512195539828f739d9409511b11a3a360846fee1f59237816f4985cf5df2a72c1397fe225a490745fc69ac717d2d981b80db7efaa45b5c46d4a1cdd59786def03da
-
Filesize
1.3MB
MD5677bb7d841a3ae587e26ea210f036a14
SHA1670e43989cd4b6dc2a8834a36fb5f2d8923942a1
SHA2565fac07f8f6e37d82fdfaa321efff992ae21bb5f592f1fc680c030d261891c2c6
SHA512ad4624195db66ed6e4712245a3fa3882251977e911ad18707201d8b2cded8378c75ddfb269f21057cf9a36348860d146b97a56e318bb8c25ec36a805d9596530
-
Filesize
1.4MB
MD52e521f6e64e800ec68f816d42a5cf3ba
SHA18075b60f82288b607ee5105c0228d701d9d51da3
SHA25648b127c8b3aead10e2d7ae83759dc6a6aeae0c5e5d6e4badeeaf3845ce81f627
SHA5120c4383c3aa7d548cbe8eddaba7098eb4d4985dc02e7c8ec6b0751ef6d389f8ba236573207e4aae81b4858ddc8ec3d6ecfc5d61aa895561e1d7077f430385e284
-
Filesize
1.6MB
MD59d3b36a3b6a1c6571abc185af91e00b2
SHA13a6691f2ad0a917d825c1a89a9abcf89dd82f8b6
SHA256df571654317da130655e8a1c61442439f64fdc27d57a5ec1e039d0dedb9b9601
SHA51244ee27744611aac953d96814d3a0ad9afb7f7826ed346cf9b21653b2ab4130b34acd2534ab8290d21d1f4164e6ac059160df0315b54b2ac9431dccd27e8ef95f
-
Filesize
1.1MB
MD5b2d453142c2886461a5f9fe5a772bece
SHA1116df3c21f99643abc94320717d96cd71f1fda35
SHA2562e13a9e325e48746cb5af4ed515fc57e6982aa67b20a245c9644ee608910742a
SHA512e4bfa860d23084ba379e40fc0a3c4ab4c321baef341500908cd49938152367eef3e5c56758d51d22f885f8f26b400c3aff3e100aa48c8ce20989e1952b6f8ad1
-
Filesize
1.1MB
MD53fab04a51aab5ce85b646cb100586842
SHA1218194a8f8c863b848b4ebe30ef57e019e0f5d21
SHA2563f1f2867ba41cfaeca1f1109595523fa5ead1a4d112dd53da6a0527f351db7bf
SHA5126145148ecaf2ea4f65e0c48431e5bf32a1be1f3ce302c9b8baba5576fbfa972df0d91dae0e0279e92e7709cc850c112219260c6886eba58347d04375553597f1
-
Filesize
1.1MB
MD53e6a74feb0818581f633f83a090a0f8b
SHA1249b617bdfca10b5cd4cb8869c2daf8e1d8a63ab
SHA256212a5bb74f72b55ec0131355db4265f1843af4b9a28f78c0eb6f08351ebbf86a
SHA512c2fd2751dcee51ff32aa4491706bc70cdd501f77478216167945ac82042d4e36da01832bf3ac31109512505f42f95ef70e7db0c74d7dc10e26a874ce5afd7da3
-
Filesize
1.1MB
MD5dd625e52414c5cbe0551bb98faa5f442
SHA1c69fbb7250a35800ee707319f8ccd42ef7d690bc
SHA256bc851f2c7fd099e41b97c4c49f73fc6ce10f4d71eb42d648dac6b84d5feb9923
SHA512c4eea300f94ee29f87ad13a9e5b8c70abb74d409130a11993f1d6bcbf17fe1defa5230afcfbfe37512a3e4d0608ffed1bb902a74798f12b7898ba6202364f231
-
Filesize
1.1MB
MD5256c1c24d18401e7dc59b544488353d4
SHA1f511c81f1509c891980f830d4d796e67f8c7166b
SHA256c987b620f42e74dcb23e887daff36445abee55b589ef3763e335c5a8c5753c47
SHA51286884cf2398582ed58859942f745392188588dac2d134e54fbcdffce24d546aff93398f075e1d7589c7ef714741b7b56872669904a66ddc13c132a8cf746e300
-
Filesize
1.1MB
MD546088ee3c5878e5aaecb19027dc6a5a6
SHA1bf382eb681d068b993c8d0b54e36df1b3e98de86
SHA25614af3fbf6657648a755e5920c4844c2c5a43b84a41e2a1069ef688f70d31cded
SHA5126736370b2011fb8b11239eeeabea1be7b89085f42204cadbb1883ce5e4708773b2948e469ca0a6085862d2d63f430908d575836d74e7258093a212d9c13d7961
-
Filesize
1.1MB
MD57f0d9d6c3fb05907aeef7ac55eb69f82
SHA18d856c08a568c496081bdbc1baf040bd38960d4b
SHA2568c74dbc70b88f410ce4ae1029ed36db7a34b8d5830db615ad802a833a59faf7d
SHA5122e64b2fc0a1fe3f61100fbbfbab84dc62f4831bbd5d594e6270b8720996e6b8c0a58011eb3a4b0668d5213a67f9deb1199ea9e1295e1ab6d355a035724dee617
-
Filesize
1.1MB
MD5ddb2f0fd45b87793f052ca32116afce3
SHA1e9be1424944239beb28b316e3dc4df5080305c3f
SHA25677bae5e70b9d9b4289b7c9923f5bd2f72a9e9c5ee4ee387b46e4c50c0f1ae888
SHA512488e5b1a029228ae8046d047ea8b56321b1f32345ca0be832b7114548ee5dff32def0594a4e271a3bd74e65adb73218b717f7c31357a58d460cc2efcc2693e17
-
Filesize
1.1MB
MD5c2868634eedf873754fea7510ad41ade
SHA1d225d6754e425cf1492bf7d9201a3565b47f574e
SHA256c6e5e2c54e7d04114acc86bce20b1af3094b94b322909cc7bc196a03af41927a
SHA512aa8ce77777963fc0050802f27a4cbb10ed2180f0eab3b0f740ac171289ec7bf39a30f828f70f44593d2b6700e107be3b8f695c6102dc6c3bb1fd182b40217ef0
-
Filesize
1.1MB
MD5c3a5aa56f0afd5cbce26542517dfcb35
SHA1acda73174272aec2e220f03d13d1b27e8c6d702d
SHA25601f6ef18ee561a227a548de6c61b7d4561fc86537324768e8b45d08f7645ae1e
SHA512a529c6cf548b105cd38bf867c4615b105fd50658a2f366f60524b9b008224d43e502265abd662260797d4704c13f7e18d3436d89a7585858bfa477051949853d
-
Filesize
1.1MB
MD5aa75e8b0938885b42a6317406e5bd133
SHA1e85d230c221f9b318ae24ea99a61448c3dfe3fda
SHA2568c2d7d9f41ee670288666779e03b064b82ec565f1cd351f7fa501e8c381f36b4
SHA51281528ce0eacc97bad0ebef46232ae1c5d7aed0c603e2877f7b3d653096c35ae5180237fe06f0ce9f3ea2748941be1abca16d279928d3988e19c27f8161e0c551
-
Filesize
1.1MB
MD56fc793c10fc2ec2a9d6c17e8fa7e0243
SHA1d730a341e855af597b25d1bea88ebd75c5b4f83e
SHA2562219d4c8d96b9db9900e856a8a9c1843769146dd5befd8e3785d9ba9af82ec90
SHA512d08da97468a8850f9f00bd130b3ccb8aa1562ddd4f6acb76ced5edc229db9b7be53a7854ef0334ea553e2ee9a99416a5c4af9e7e42f843b2e5faa60bd51b7314
-
Filesize
1.1MB
MD58698a18a88871663a16d87dd5413e84a
SHA10f8d6f816f6bd54caeaafce5f914ffd6493ba5a8
SHA25699c8e6d14fa463175e3d9c84257c052196a8fdf9f9328ade9ad23183d003db00
SHA5121f2d2deca4b506967d2614170fea8d2404a81e0eaeb65fa28bab0171d480459c1b590fef0766f86d7cf33f85ce6e5500278bd6cc98405ee0b4addc8e3dfe93fc
-
Filesize
1.1MB
MD58ae5851756a722821c451258604d260e
SHA13895d4c2c826417777ca0f45bc373ae08c107403
SHA256bdab40da289f09ab0ac96d8546a91f54de2b7377e18a741ae23bae1692579e4f
SHA512023927876f8a7a6ece538e53a7a1fa81df83e0ca705081a451fd571e34c2cc8d1e5ea4a710d2b50e886910a1b36149645e2c33a0a2e16924fd868105bc1127b1
-
Filesize
1.1MB
MD5782338cb1958139cd007fcb9ebabec7e
SHA1d7fcf92497c5f6132b315fc242209fbe0f465e4f
SHA256a6d972b576a86e4792f5970e8c3dbbb4c9d09534e4188bf279c72047d08c2e55
SHA512980fcfa4b44fd0bf9a358291eb5a25c26a0a6dfe99578c398648dc93a7d28bfbb63860120a2f96920d7441e89f07d5ad7d4bd48ef3f5a35335da58bf654ef9ee
-
Filesize
1.1MB
MD5dc7810f4506d486966af11794093513c
SHA121ac62f04f3282d1e4a5bceff56e714c63c99520
SHA256dcacca7a3f7a30068ae2ef47d9fd48692f8a51c9e762be0c0d51f49877b23758
SHA5125e3c00bbce923fe7e07a275dc55a89b9b347065007a19e9e02d103cde100a74666fc871a7a60dfe6b2f90a28dc29c330669ccb18408b37e74c2c3f219f0b2424
-
Filesize
1.1MB
MD55ea952593e0329d6457b94cad35cd161
SHA16a9a1a20f4c6e8520eeeda4ab331ae1b98453337
SHA256d0e0d3f404e47497cd3f80b675fc3eff0ec52365dd2e966dcceae1ef95280f5f
SHA512a7308e62b9037a16fb0ad5cc45dbae07ade4c23714ae814c62d307017d46993c0625a3bc4f0da783a4c7937b84f8568b93fee7362450e972e3b0cb6505da95f0
-
Filesize
1.1MB
MD54eb71b101f8a120006efe08684d4fe57
SHA1e3cac04d6e99251be497aaf4eb4f02f6413651c5
SHA256c2b4a3e11546acf25ddced0621e58ee38794489c33eedc046b44a3c8cfde6d9f
SHA512041921d93bf09de04f90d38d85537b83eab8a77d11310a38a4a38d75eb2e889f61099ee58b913205bc90eb9313b84d5e3d4222cc9c4d453cdeeb3f2ddbfc36c0
-
Filesize
1.1MB
MD59d78a19f9d43062f77e1eb84064f7385
SHA1cd1cf451ad518a5bca56d20167dccb596c1cb1d7
SHA25616f05388bd70578a494319192fe5bbe658eef868df37097af3e6f954343bddb2
SHA5124f0481094823725fbc3bbe20f14e043d12c2087a0faa11e7e4dd0be62e9b7a0c1d41bb0b33d8960998512df50180be7516491353df7be9cd038dd229758bdfa6
-
Filesize
1.2MB
MD59e30c781d7c2803786e4f70004416922
SHA10369e2aad57057eda2e17e762f33e004954b15c9
SHA2569fe93ed62a0f9021ffbaf8881c978d67649677739073ae8bb63004919f138e7b
SHA512069b7313d45df2146af4428e05a059d11285ee3e79163a91f34380eb9663bd24576c2071674090189f115f73a15e8afe61695dec5aaa3c25e90e472a17fb8310
-
Filesize
1.2MB
MD55645ea04289953fed16b672860c51b34
SHA16a78bcf1ee9e22969da71829d4e04ffe102554a2
SHA2562544a275eac66ed98cc6e30124b9bbcb06fcd8a1ecf2a2781e98d2c52a56b233
SHA5124747d3c8ce851bdc732b20fae012a17a6c63bb0bd9eff5131ae7a31d55a38d804051fd0619f9564641efd93d0298b01ca95ee919865d712cb71feb45c5072096
-
Filesize
1.2MB
MD5235d7a7d800a8ffd3433669d5284da39
SHA1c9389ce07a82a3ef69d54d1ce036887011dfff4f
SHA2564fa06612f454ad60b3d77b39edca46063a6396e23723daed1d2c9d03418034e1
SHA512cc43fd3c78c80de690a8317130f7a964d1888d6b0e9fb45793993d4126138636d95ed6b4e36f95785514a3b51a892bc670fadeb39a227e2d2bad10e4c4e99495
-
Filesize
1.2MB
MD50dd7d2b8e824c28e2ddb5b10392d8d90
SHA138b410ac5a14336bc2eafe924163c36d9a1e0e47
SHA2564a734de7ee4f7ce8063eb8f05a36ae593476cd9470e54e6f71b51837cbdb7dd5
SHA512db0eba5bccb3bbdb3d3e13eaacb47dcabe37959702dce10a19811b7f22df2a73ca648f9ebb8fe5279c7bf7826c89731c5c830467f10e418eacfdc86da630795e
-
Filesize
1.3MB
MD569b7dc59a9618d57019b6247f67c45ae
SHA1ad397913c7acc11d981d8bd0e2b13dbb3f0dac53
SHA256b83f9554a541f64de0fe5b27a63a1d995df2a70e704c0932d9d9d772e2df9a60
SHA51263840769079d84577d0665c84c9b64749303f695987d171611abd687d7dddfdc80d67a201adba2c8d9fef57ce38420abdd6b39ad959cf81754c5fe31207d72d7
-
Filesize
1.3MB
MD5c6628bdad8fb2bd5de5a47faabd365bd
SHA162b341f1c44b90801bc261dfe109a1ac7f7c51c2
SHA256b1056cd5399955587a47e49040c41bbea8baadd5c9027d01ab9a22e18f357d1a
SHA512a5eb1a520249517062ea4364391b6d014a38abb2c2774fbcafb4722d35c3f89f7500366cec869dfcea607cea93a2aa5f2a5f3b4086f8dfed03c32152028dbb37
-
Filesize
5.6MB
MD546ca2354fe6b7a25aefc8e13c55ed7cf
SHA114215d1b4c533e58c0fbf6a71c29db61d6864ccf
SHA25692697fe9f1e731353c7ff20e2d41b9df85d4ce855c0d6543e189129687b65c74
SHA512c7d2c67b06c9cac93c58d5b2ebe257dd2fc9d5862c94607f483b1555c7e52dab2d27a5f253bdaee5e905eb6813512c224d18167e9f610586ce389be12c30d110