Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 12:30 UTC
Behavioral task
behavioral1
Sample
e0e1fb17725c5140137a476e4be07a30_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e0e1fb17725c5140137a476e4be07a30_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
e0e1fb17725c5140137a476e4be07a30_NeikiAnalytics.exe
-
Size
196KB
-
MD5
e0e1fb17725c5140137a476e4be07a30
-
SHA1
f33a1eab95402e1e04d1c8270c6b2a3798e944c6
-
SHA256
cb2740e0f3751f2d2dd2486e4e2cdce870a870248a96bf114b8b8d38937b3522
-
SHA512
8deec99c79826f7f9d60234e427290a348539cc6023a1d24b6e3e76715861d9246427a35bf2729f55275f8ec3b9a681c4a1ec5b084b31e4d76fb4190ae89c9b8
-
SSDEEP
6144:hfAIuZAIuDMVtM/XS7fAIuZAIuDMVtM/XSX:ZAIuZAIuOYSzAIuZAIuOYSX
Malware Config
Signatures
-
Renames multiple (5026) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 4616 _cup.exe.ignore.exe 232 Zombie.exe -
resource yara_rule behavioral2/memory/1540-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x00080000000233ef-5.dat upx behavioral2/files/0x000600000002326f-10.dat upx behavioral2/files/0x00070000000233f0-12.dat upx behavioral2/memory/4616-9-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0003000000022a9c-21.dat upx behavioral2/files/0x000200000001e722-25.dat upx behavioral2/files/0x001d00000002292b-26.dat upx behavioral2/files/0x00070000000233f1-27.dat upx behavioral2/files/0x0002000000022aa7-28.dat upx behavioral2/files/0x0002000000022aa7-31.dat upx behavioral2/files/0x00080000000233f0-32.dat upx behavioral2/files/0x0002000000022aa8-36.dat upx behavioral2/files/0x0002000000022aaa-45.dat upx behavioral2/files/0x0002000000022aab-46.dat upx behavioral2/files/0x0002000000022aac-50.dat upx behavioral2/files/0x000700000002295f-56.dat upx behavioral2/files/0x0007000000022960-59.dat upx behavioral2/files/0x0006000000022963-60.dat upx behavioral2/files/0x0005000000022969-64.dat upx behavioral2/files/0x0006000000022969-68.dat upx behavioral2/files/0x000400000002296a-72.dat upx behavioral2/files/0x0007000000022969-76.dat upx behavioral2/files/0x000300000002296c-82.dat upx behavioral2/files/0x0008000000022969-86.dat upx behavioral2/files/0x000300000002296d-92.dat upx behavioral2/files/0x000300000002296e-96.dat upx behavioral2/files/0x000300000002296f-102.dat upx behavioral2/files/0x000400000002296d-106.dat upx behavioral2/files/0x000400000002296e-110.dat upx behavioral2/files/0x000400000002296f-116.dat upx behavioral2/files/0x000500000002296e-120.dat upx behavioral2/files/0x0003000000022970-124.dat upx behavioral2/files/0x000600000002296e-130.dat upx behavioral2/files/0x0004000000022970-135.dat upx behavioral2/files/0x000700000002296e-138.dat upx behavioral2/files/0x0005000000022970-144.dat upx behavioral2/files/0x0003000000022972-150.dat upx behavioral2/files/0x0006000000022970-154.dat upx behavioral2/files/0x0004000000022972-160.dat upx behavioral2/files/0x0003000000022975-168.dat upx behavioral2/files/0x0003000000022976-174.dat upx behavioral2/files/0x0003000000022977-178.dat upx behavioral2/files/0x0004000000022975-182.dat upx behavioral2/files/0x0004000000022976-186.dat upx behavioral2/files/0x0004000000022977-192.dat upx behavioral2/files/0x0003000000022978-203.dat upx behavioral2/files/0x0003000000022979-207.dat upx behavioral2/files/0x0005000000022978-217.dat upx behavioral2/files/0x0004000000022979-218.dat upx behavioral2/files/0x000300000002297d-228.dat upx behavioral2/files/0x000300000002297f-241.dat upx behavioral2/files/0x000400000002297f-248.dat upx behavioral2/files/0x0003000000022981-254.dat upx behavioral2/files/0x000500000002297f-258.dat upx behavioral2/files/0x0003000000022982-265.dat upx behavioral2/files/0x000600000002297f-268.dat upx behavioral2/files/0x0004000000022982-275.dat upx behavioral2/files/0x0003000000022983-279.dat upx behavioral2/files/0x000500000001ff76-5745.dat upx -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Zombie.exe e0e1fb17725c5140137a476e4be07a30_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Zombie.exe e0e1fb17725c5140137a476e4be07a30_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp _cup.exe.ignore.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp _cup.exe.ignore.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.DLL.tmp _cup.exe.ignore.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\msipc.dll.mui.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.White@2x.png.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsFormsIntegration.resources.dll.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt.tmp _cup.exe.ignore.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp _cup.exe.ignore.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_200_percent.pak.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp _cup.exe.ignore.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\VOLTAGE.WAV.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML.tmp _cup.exe.ignore.exe File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp _cup.exe.ignore.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms.tmp _cup.exe.ignore.exe File created C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL.tmp Zombie.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp _cup.exe.ignore.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp _cup.exe.ignore.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Controls.Ribbon.resources.dll.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp _cup.exe.ignore.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp _cup.exe.ignore.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1540 wrote to memory of 4616 1540 e0e1fb17725c5140137a476e4be07a30_NeikiAnalytics.exe 81 PID 1540 wrote to memory of 4616 1540 e0e1fb17725c5140137a476e4be07a30_NeikiAnalytics.exe 81 PID 1540 wrote to memory of 4616 1540 e0e1fb17725c5140137a476e4be07a30_NeikiAnalytics.exe 81 PID 1540 wrote to memory of 232 1540 e0e1fb17725c5140137a476e4be07a30_NeikiAnalytics.exe 82 PID 1540 wrote to memory of 232 1540 e0e1fb17725c5140137a476e4be07a30_NeikiAnalytics.exe 82 PID 1540 wrote to memory of 232 1540 e0e1fb17725c5140137a476e4be07a30_NeikiAnalytics.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0e1fb17725c5140137a476e4be07a30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e0e1fb17725c5140137a476e4be07a30_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\_cup.exe.ignore.exe"_cup.exe.ignore.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4616
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:232
-
Network
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request142.53.16.96.in-addr.arpaIN PTRResponse142.53.16.96.in-addr.arpaIN PTRa96-16-53-142deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request30.243.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request30.243.111.52.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request16.173.189.20.in-addr.arpaIN PTRResponse
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
142.53.16.96.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
30.243.111.52.in-addr.arpa
DNS Request
30.243.111.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
16.173.189.20.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD5c7de098415c13af5d94be049ec0362a4
SHA11c26c37d2b2c41bdf5e4d29e7508999cd06286a7
SHA256e5c165b6afef44f038a098915b2aba1f82fd2888b36f172d8de91652c4a37b1e
SHA512cae815a650c64a74c7f58bca28228e41c32c60d32f1a500109ca187c9c063e19984141bb99abdfb54fd5c63786ca70f2c8fa73c68a7708c105a25c020b140e7b
-
Filesize
98KB
MD5e3f9a63b05d6d0f026f5bb834cdead9e
SHA141b8374456053f25f2e25a948cad310e1fc9f0ca
SHA256f24e58cfb78af3e4724bdf44f066be6efd86bc4970f904be22dd3e7f81d07120
SHA512b84654ee9340a58896dce3607b9aea9dbc9b0b784e73cb0b1bd7f5098ed26c9812ce849ef3b72193a3f74354237c34380815905981744b87b3aa308f740ea36a
-
Filesize
210KB
MD5020781eb84ac4b5e7b546795aaddeac6
SHA1c7aae62ef19887cac47c874ae0380e044aea07c7
SHA2569b48adbc32f1f7b140cd0e73202354d6e65ce4524d97e8f88aea9cabd77a5b29
SHA512577aed6b219460fc04bc773d82e776bacc0e0e1ef97f951fde394d24b4317db0e5fb236844c43f475662e4f26ed11ec3a91a016f03f3eec0309c11dd71659c01
-
Filesize
197KB
MD5a3144ae931801f18b215c12e75bb965d
SHA135d391b48a4a99a0897033d5350c4a57417967fd
SHA256092d412da6fe465441327df5d66f085e43cff00cbf0251c3088d808cab376dc3
SHA5125d646775ffb0fd0602f6ff41e6d8af6ae3ab1833f4ec0731cd94279b83ece0463e496685380502416f3c3b4c14e0984c53e02a7cf7297bb957de304293940eec
-
Filesize
163KB
MD520683f251d7de6669b746fc025805f18
SHA1bd7b226c469389090a441f09abeb52dffc0baebe
SHA256b706bc1a02bc395c6dd7f35b37be338d4068e2409048049072802d770b15bdbc
SHA51212f3f5978d2794e22c752c7dbced46068f378375addcc428a4ff9c43f99023fd957e43faabe64c5fda47d81d592fbdd451044a645e80fb73e11f33bf4ca0585c
-
Filesize
1.9MB
MD592791a93c9cdb5f849124b05df4173bb
SHA1ad593fe8106d0d51f3ab8cdda2b6463cacf47153
SHA256337e5377d95ab2471cc04e2b43df0e9dc73340e4ae3f678dfebb413bf8131271
SHA512e104f98d41c84ed0152229a1c93043e1da7c5294b324447b92bdec11419ebf2b093a536891c1f20817e0f9574d028e8f7c11339f202096dc7decefba9fef601d
-
Filesize
1.9MB
MD598336aa73da60148a7f52c43e4a7dd7d
SHA18a40885966b0e456b413df4d9ef1317d013c9caf
SHA2568e8c917cd0fd80dfa767f7c81a207a7bc1218ea86e4aed8fce16f6b10ced697f
SHA5127662f0548731c921944e6dd55d19dd6d0e2a1e0b2e23aa694b16639bc0bb645a29333821dba7d79ce7ebc11dd21dc66ffd2728991db5d94ab3f2070351dca24f
-
Filesize
608KB
MD5e790167ee48f9ba8c760d62958dacd76
SHA16ffbee4fe23dcc5fa0863193cd99ee41bebe55a9
SHA25617a52846f3826e18083f1f02acb3fd34d8fb3d0a092b22e4fd4c8c32aa2bb19a
SHA512b1e307c044867f11729606d663a905962a5ac5ee1310dfac3f75efec2c63c8be1d0b7d346593267b2ed4eeca59a84352aa41ee0ebfb51d73f146e752fa641f72
-
Filesize
307KB
MD50be56b8eb6b432dc88c20c53305631ed
SHA16e9f5494be06732b955dcd596aa71aec32ba02dc
SHA256f2fb8d814466451ba1a14a5cb4cd0a19c29e25c1b1774731af2ff6dfe5b31ab4
SHA512f414d77d13a40285dfa1b2b07eaa3903598982e63f19cb131fa8a69ba5c04b6fb0bf3bc287b99ccdd4a02d8bd4210bbde8a0e6736f2782599519d4c6de95f6c2
-
Filesize
1.0MB
MD5e029327f1a5699dc4f4c17c7923eccdb
SHA1d5985a0ab3805ffed92101ae01d6b7d1107184d1
SHA2569ba58a5ce4e9533b0fcd59f1b14e91bf743dd0162db59e940eebd1510ce1b822
SHA512e30134439f593e23da6eaae142e1d5a317b49d5bcd8fdefaac1e4c90a65414620dc44c91f683a264fb6986aec35e97bcbb8fad84fb7589affa67c3c543d242ae
-
Filesize
782KB
MD50270b1ea25f7ed1a108748cc752afab4
SHA1a1e4f07e05ed273face575cc052ae19b78512511
SHA256859ae27946320ec21392831abf809bc49226dede466cf4ced332f13a980c0087
SHA512f8cd61090fbecd1cec0f572693ebd07d6d0466624efbec23125644becba97d60175a49608777cc747325213883c0739e47f38f7ec8a3c60952e4919a8cb5c67d
-
Filesize
155KB
MD57062f546bee33083ae2681b327f62869
SHA1421984fb15a6034e390418c0a99e4945618977c1
SHA2565f6f275f9f847d472ac634c79533ee6f81047a1cc71b584ee86ae86acc7c9d4a
SHA512f05ddd68633f1405ef004c399e31fc81230727ae10e049c6c89cd1a2ae4c1ef21e3470f426bef04845691f2c5e811053e49ebd859b0d0b55d689b84d40bb9d33
-
Filesize
108KB
MD50e46afe6ebfc6ca6970912d75bcc097f
SHA1d8b03ac2ff1969120ccf2685e973ecc0656eab91
SHA2561a1f26099a4c599b972c66b2f48854f0f95fa8de32fddccfd324be252bb8c6f5
SHA512bdcc45985d6b637231ec8d429f1ce16d355c41dbad51cd8975f35f16dcd13ede4ac39179546a6cad224fb5082619055574d33c0f36f3830678a0c5a34dac08fe
-
Filesize
105KB
MD5055ca0df58eae5cc93bae901049f3ad3
SHA188c9fe4e9368c305f31b958c5e820a88335749fa
SHA2564935fc4100d4e148012d697d2029af1f085cdb7926dc3f516c1cb9693bd1ddc9
SHA512b3ca33ba15fc1672019265ada7d0b190aeb1e89057671767fa68f70de05982138d4f62d11259d190ab308428ac5b4c8594eb5273483f76549efa10c19ea0038b
-
Filesize
92KB
MD57bd4c9f05484d9dc89695b146a9a4485
SHA152baec9f3bc67805e29c1062f652a66ed8e90d14
SHA256dd8942f8a51205ddcd73b753ecea0d060665a2c88fe93b286c1262ca382d60df
SHA512357cc87225080be86a8ed17f3f444b6bb34c612e3ee162ab1afab20105ff64c97d5af7403aead905f00b23dc0211d64179d99859afef869b2ddd31a8e414b2ab
-
Filesize
103KB
MD5514d6306047b1773417eda47adc75f9b
SHA146304a5531759b48311291632cd801e093a90fe7
SHA2564062fe1b2b0fff93df9787bf36fc1a1d40b89967e877843d823d05a8e7dd1fe7
SHA51225b1ba383705b96a6b87c9c3ce710df15c40939a696405c5de6e2ee16e4fdbfa761f0b8da62a3a95edfe92acf53be7a6402eb185d770d071ec248d271d1e0581
-
Filesize
107KB
MD595a4a1312356b9f83d3519ced5bfc66a
SHA132b485ccf4266852f1eccc03d6645bfff5c5a085
SHA256f21f0c3a691b85555e6d1c4172b6453fe7bb220a14ce33fe75542cb0cf5771fe
SHA5125c481616a1a8b3195b4c5e3a436dd244c6c9f22f41581c0b4ce695da693449d7d3f9e27e62aa4330d692fef7cec9df8c6828329db5993e4326072243ee1b5c26
-
Filesize
109KB
MD5a486d0e7c01d231810daf6e7d3bfedcf
SHA1307ac57356c07e78d78ab2570322ec0d8c2ef2c0
SHA256359df2ae53ce916f9f37b52939ae21bf5c0a19e10c012eeb024c74cc8a44a148
SHA512d161ff49fba850ce8e36f6343e93815dd8e36ceafee8cb85b7912ad8dfe03db678b60cf762d7fb7946fc960e7291017f73d5ee26277bd857999dfaaa5304d464
-
Filesize
111KB
MD5a2ea84b30b4661e780df731a51b968af
SHA156503919519067349b2b9734e3ca448fc80c2154
SHA25649d5e9c21f035ee299b749e1f88324116e11d6d0178382a1165edbda94957612
SHA5122ab53adf2873c5ab675feb751421d9178c865c871dc7b3301d02897ef57074879bf3449e61aa8339d4b683507bf9eb695a4c4507384b568be68bc9717acd5609
-
Filesize
112KB
MD5dd299a49f063492b32b215106a291abd
SHA186da5fd947f75065ec1d29c65fb875f562995787
SHA256d62aca3bd30ff0acd19be737816d6cb67ef3e5b7cc49b3a444e66640ef45b2bc
SHA5125a5c9465bb2b5b3b343f8f3828c305ae40e737360943cb6eb972c6fdacac015871d12080c62a036ddee4c7b108adbd8f618bbe7700ae2374e709cc9fde127ea7
-
Filesize
107KB
MD574bab2b4e78e81ab08f8b6291321048f
SHA15e173848e3b906724fa220dddce853c518202879
SHA256f2922ed1b2143c15cea1de807dc6c141c907361277f8c553f0c8f27519488b8c
SHA51235a26fc80711fd3ce03354f681c552385e96bebdc67cf64985f6871ae5ce4b0acad78aba12c6c8b956f32b0ad541c07f90d8b01f78eb948902605325b0e1b156
-
Filesize
108KB
MD598131a82d7064fcfb762d290a63c5076
SHA1891627dafd8d47c191c050b6afce2f23b6f8ce6b
SHA2563448c1700aa07241da8efa4c3d5e83a341d87fc246b2d48d2577a328d5db76c9
SHA512d25eaab69bd638106a8a9719c3998abecd4fc40fd3079534019ea3a7917516e58f6758505fbf8e1309a0aba028ab778f58be80f20c4cc74a9394eb812b5ec507
-
Filesize
103KB
MD5bc7989e31f283a13269407c555c951a9
SHA174e2fd3bcbabe9d9d44e1c2991bd395be7da0ac2
SHA2565741d70d6d7824c0cdd2ac0ceea2ee522c9501e50bd1874344a5a8d6f64b399e
SHA512e51828704062060d9b9d2a754d987e563adfd319df1a88ffa44f80c748334a1379bec9373602498046cea74526e4f55d5e29a29e61195320a9630bac85763c5c
-
Filesize
106KB
MD54555b0c263bffd24f3d67a6aade6ea30
SHA161637adccd3086f5310063464fd9b8504eb3c8be
SHA2569c024a6036d46e1e5b5f961ea668d60780081b7a67ec0ec637de651b38f61a51
SHA5125a4bd18b5e1d79bc4ff955b91ad79d827b72fe664fd4901df375a1365b178e6486008803f71f04dc23757e830d8340a4798c602a80e3a8f371ef305346d986b1
-
Filesize
107KB
MD5bb692b56de42c6cd0acac225037f13c7
SHA14a5d2366609b27406ab805c3d922a629cd0c6636
SHA2569f596717a42c80553b1ce5ed2c79819097d26162366d75a5e2e0981ff1571c3e
SHA512ef3135dd36966e4ac7ab100e07118f22f103ca80b94a3588b7c50da96abdb719893ec96f2a1b6a7853e34e18d7483d2439440c725085d2c4ac893a85f8e5812b
-
Filesize
106KB
MD52422efaea3ab5a8d237fccafe1f59a0d
SHA186f517ab96fbba2aaea25185deb5c4fbbab6faf0
SHA2563bc35d3e2bc5ef773af4996719767c4ce27abd8f89dc619733d6fd501e941c1e
SHA5128d76a18c9b9433276009e7c5cb41110515ec4aab8610863ef2c39b28fb5bf4fe7a42b81340cf23383a487d3b32682e00175ff576a5f02bf674f46c533757fa26
-
Filesize
103KB
MD5e55210a453d40f967931fdc56ffc6e9f
SHA1ea3a615398f8805ed79dbbc7be56bd42251ebfe5
SHA256e3205fe2ccde93859bb95e837c1a960ee33b6e73881e0087c41c2895084e39ce
SHA51266e8fb0baf26d9a3d04cea43e380df1947c7212f514b69f3efd1227153ba86a8e67d0ea545da68390f9f3674d494981f05d1dcbfb07867da9f4a994bff0dc69c
-
Filesize
108KB
MD5c952a722f811cb46ea3099eb84f70d2b
SHA1c6d86fed86a8025e4d7ca0fba8c3ec665e828039
SHA256605f158ad38c821db91a6afb1b5d916e7537139bfe21c6da8dc95dc1cac7eaf4
SHA512b8bf1a08432c0718cc0af4b93d71b9e43a66fdea4b6e25d4cf98aa4cbd2c9f570369a3b640535efb012a22663c1b0bb1d556569c4bee7aa6fcd62a1e043dd90a
-
Filesize
106KB
MD5dfb26ab25277acafc84242cd804a6f7d
SHA171b7fa8937ad640abe2ba9fef37933af354e22dc
SHA256fe269d2b0a78a46bff427a76d7f87b7c95b665801ef59e4d7a56ed825ff9d7cb
SHA51225c896f122625fd1541b7b4fd13d5b0a7ab0c8ac67e6a9a5a44c71473579ac38635dd534703f99961b5ed83c6ec9c2ceba9be65ae194a0bda339acdd1b330a85
-
Filesize
98KB
MD5018c79260eb4bf73113f0e26eb2458ba
SHA19f90ce28216bb166e71690b3d010d7bff1b88123
SHA25661d0c697b0c8b54617b02607b83ebef50fddc9ba916f282c68b4490eaa290583
SHA51260976dc8e6740bc79f0da4eb16accb94699249c16a00b1a606e5b4f0b5aabb14d42f7f6849cceb1b4e1c1d464e92f72fc35595723eb4d1cddcafd0c7c1207e56
-
Filesize
111KB
MD5fa9c65a67e0aed215a9be81561f8ee2b
SHA1fefc87bc92a2f9ede2594b3abd0fbeab28718fc3
SHA256063fb2e60dd6908538596e77fa9b8a70757aad82acd4d9a39a964c1dcbd3753d
SHA5125a2be23fe04b9b1b83c899d423766e6ddcf1fd9a395f0ba06852bbc4d20870ebc6bfc3ddafac89de6f44a1fb76c6de4c2950244246f5cd6d193e81558a22ca78
-
Filesize
107KB
MD5353623a9da6c3c7e0dc70113e7984cdf
SHA11a4461e36eec88f4f45820d2dd2403a6b47a5b83
SHA2566194dce7e6672b13330b15820502a56f7bddd3840b6e7364f304df28c4739ffe
SHA512f4bb132c814da5600442294fbfa831a310bf2e049fe7f25839fdd7d42464a64d3279f4526f55be5e96c03b06f951d65e4269c8a47540cac0f9941fc795b3ed0c
-
Filesize
104KB
MD5979ad2dffbc33edb9189bf9195dbcd0a
SHA11c4ec508e584df6ef43617be47676177989a9545
SHA256f8bfc6fc35b0f429b4bc5f643866574916850521a7f2edff7d53a1f39e7ee945
SHA5129abe662cd0da4256fc562ecef66b0bc39b04958505613d73f8532ce7d1dca6848e654c966877e3b25fad98d324d4f52d9d7417e7385103847d7cab486e57e208
-
Filesize
106KB
MD5b55ffc929eae7a9055c9459789cb0da6
SHA106b98569e20b89c502e3877b8da7f6f674d337a9
SHA25679c7eae8506771f5b46e187a73c6c3d26c3c3a5d5979113ef596f12cb037c21c
SHA512bb53a45917dea979fa14d00bb01dccac481d6c23b3b3e58a947e6724b934fd460d1153c9a9ded0ee3e4123d3f0bbdcaead73340f2806582be4eb5d4c2179c0e9
-
Filesize
115KB
MD5015589482537bac7af04ed17f559b7f6
SHA11c51d5d000c90ab8dd2ac2bac265521723d60a64
SHA256e5237ca424d3ba335f0badbad2508130d7b320cb5324c968dfaf6d7ed1c8bb20
SHA5124f70b4f1372e6a72b63a02faf62fa5e02fdb869abd23f341b4a3538c688f60bf64ebc061273b885aebd28878845b4bc1614a3e924e08c5f24a91cb029392b452
-
Filesize
109KB
MD5cf5c8306c53991ad983e08f72992500e
SHA1de3c96cda23f822ebeedba4227f83b11fbbb76b9
SHA256835a27425d554f6cc6ddb57b874f44b63646ef2886532b861580a9ff59e6fe56
SHA51224031c66b650612f771e9c61d6834f6ef779d89772b0b5bec2a59d9cb9a948973a49383bd6743d23213229f256e62ed7a57a4bf3c4c229ca511d09b7d94df721
-
Filesize
115KB
MD5f08f3359a57050a4d24db9b0e1a3167a
SHA1ff0619bff2efdb50e60b8ec5ef6c6e8480194cc3
SHA25635e293f6bd159f0e7cf6387198ad081ff5c7d1cca23d8452082d8a47ecd91c71
SHA5122ed0fc3ee986804ddf39c02707106dcd9491abd52fc1e7ac69f4fae28298dd820cec5d85fb4f69cd730ed37549065e584dff2c59ae51247295b03ed7f41007f5
-
Filesize
108KB
MD58e881b58946f92a7fe2a25381cdd7638
SHA1cb8e68f31a269727220cb4504dbcb17415c7e95b
SHA2565c32a1caf5d790c3813d4639a7c2bba1ba7b0e101e56d68af604e88b7cf5e9cf
SHA512b0c128bb3c263a00313e9a9d207926623395d84a383dd2d01b8c77f613201b3e0a08f5e450c20fbe4ae069b8dc61ca9fb81b9d0a9827fd84b22dcf1c223a9ebd
-
Filesize
112KB
MD5585090b3b1b99b1a1ad50ed0893a818f
SHA1fdbe7d4ac017ea86aaab112f8f3d4a8ec48bc4fd
SHA256a9a79147450a5eea838589703e3be55c0b879a38060e48df5384eba480e84da3
SHA5122ccd679e7f42ca8c81b5b9c1bba1a189a470e46f27d32fb3182282169a7eba140b49979dda8a8ed1582096392d9fbc7a89c07ebebd7616fcf3bf727cb654f550
-
Filesize
106KB
MD5382cee4dc8d61bd61f7c5faca5a005e5
SHA1da4a3ca19e0e3648e18d37a3dae8dbf0da8a5685
SHA25683fb6e7c29e99172494150a73e8e58f1445c90b7969f9959df6709b87079b605
SHA51273bf73c9a85ce184ba408f835dd3eebf02d6dbd90d03fcbef658de31f8a3e371c6d8c6376970717587c180f1f0c8c9f04a458b9e039be59496e9434788ead3cc
-
Filesize
108KB
MD50f093612e8d298ad3e0b63d714451054
SHA145ccc232e25016834058d9c71ac513893088b4d9
SHA256d92b4c456fb5060f7f9080b23812310ed94b9f1fcef7c21a203ee2858124305b
SHA5124f8f2eed3866efc7ba348f2d3f04a8a673e41595405338591cbf45c274c1d434c26f9ef85dd7dcc15112f7613b9a4553c3e77d3f16fd01f48d9f27ed518dd8de
-
Filesize
107KB
MD5c63f6cc7548d5382bb839d93a216dfc2
SHA1cc861a17ee70a798bc70d833c9078048b1f7684f
SHA256cfb2fd7c8339f02a00238d9f1527e93a2203189c267a1ad525abc5c8b2c9e0b6
SHA512e71e48c0e4f68b8ad2cdb12bd1cf1f9bccea28b468c697e489edbf4d27cdf46f99bb585ee9bb488f0679465fb778f05e11f8bbcca9d03c1da5279e6c6dc99955
-
Filesize
106KB
MD5e54bb8f683fb08c84d1f2292e267b4f6
SHA16f1bf4c88e31771e90f4547592970953582657a2
SHA256d0ae104ca0a3542714ea71c134fa20ac9f30e0733cef4923fb0fae5f4281741e
SHA512646f5449853403daf89ee93a6db0a819bdf5bbcaade2da572a0a520ef8a0d3b7f221f830c2aba6e3d087dea225e37f2e0c79a20d6e3f92478d82317b784b26f3
-
Filesize
106KB
MD5a65efc15fae0f31d9c807c0b4372d6ae
SHA1b3abc5190187502ae4e51184cc3e9829ae366fb9
SHA2565b0137aa9803aecc213fcfb7eabba08f27ef1cfd97015b0b9576547d28d4ec3a
SHA51223c75185fe22dff83ade6bf21186b70115aa151bb48941bd1328f6e76cc5a63fe4d55b4be841db978dc4c7605701f213d564c959adadd41fbe07260d8636a06a
-
Filesize
108KB
MD50238d1b3079e9cdaf786822329a7fd76
SHA17681491adca4dc4a7e2b92d30f6b858206fc1af2
SHA256b30192e70534477ca3cbacbd1e37d2d766ef4aa783bebcde8d360db6a5d3556c
SHA512c00f8676784a97a146b300699a69e43801ebe4358f7b17516bbfa0b76e49df090c91d2695ffcd8533b7fb6ea71a5e4c75259c5ed60c0b193b0c2a86e582d2e8c
-
Filesize
108KB
MD5f51852d62a8d4450e4030d5876690811
SHA15738ad347b59c39ceaee4278f8fa942583fffd79
SHA2562c8ea78d42d3d0d2683e96a2c305fc341c51feb1bf2b5ad511b188b682b77f7a
SHA5125f07ba711fd232874cd28b7c16529c2b44165593a11c470119af8ab67493d23b35ccf2148a1ec052e819bcae6529e1a0cf36045cbf9ecf5cbbca0f9d5f343749
-
Filesize
110KB
MD5ff4e633eab3f5fe1371fabc22ae453e3
SHA195e28f0161582986655cda7c03bbe5c37ddff2f4
SHA2568d29da3778e65e5772c9a1825d25a49d4c8f21ff98b2f7159b9bbca797459851
SHA512e080a7fe555baaa0620f1bf8152875afe73fc8cb2edac0c5e24f3704755f49d0d08afb91ac9b090936ecb1ad7c4d89034cb53e573de59372a7ff0f977ebf0699
-
Filesize
107KB
MD534aeb5edb22753c04a47451c7b3104b7
SHA10b4bc7f2d56a6efa7be01fa9b03b3a7898cd4d00
SHA256774fd69d1e15a8bcb34ae4d10a6f800672f7337785a8e1e1fbf14d46fbf0d547
SHA51279b8f472b4f5880d8e1a72449c0fc1f4de9cb6288376575e8a4189de723e15cbf5f116cf2e35de6871d8d8598db5134ce0c907364090960b7b270afb68049154
-
Filesize
106KB
MD54b1ab37ce0aecece0aea67b411dd8584
SHA1ab6d3b8938e2dc8fb16f30d41f53ad03fe186a5e
SHA256de0f0fc0b46342710a0977111e49eee3456ae394fe264e9bbb211da2c5834114
SHA512d3857bbe0a95533937531ed21336aa74d40269f43b02667e98315296b71216c558f4873677bfc4ece8b75c1bc2ca1c662f540d4202363cf8420d58f3262ab832
-
Filesize
118KB
MD517d0c840e148132d78704071cac606ed
SHA135469965ac038b43660706187ac9380efb5d13d0
SHA2565b262616097658f5e1e7e8483fa477e1e88bcf400310d866138299fa4d254187
SHA512180227d4ee789461e5a6f7ee26c2048bd91df2bd77c35d1cdf866fcdedf491368ba384b1b72639d8edbfc818110ca7c821cd690829959ec6d460d92d5edcdd8c
-
Filesize
108KB
MD563e5b695884a62b2436a8389bed0458f
SHA147c853247ae4ef90ce3b0d54cfd52e2850dbcbcf
SHA256b6a1db97946392607d2964dddf13633ec75f0cd6c497fad66e9ccd3705f61e46
SHA512a25589e0471a4fb6ee58c68bc6a89bcea890b0e69a67ee41e36cb680d01cc4b7c4a11ac3dfb12d04dac6a683a7e43e122df916a010e16d04fb455d0bdd1c5580
-
Filesize
104KB
MD52a40e6cff10817f58eb7799231efe986
SHA1f344e45a05e4424fb4c2205e594da1de3f50e5d7
SHA2567b7848c377544722c3bb1596264643073facfb016ae3faf3dd14c512082cda5e
SHA512d513c4ce695a2f14fcde2b11003281fb28b8bc2a2ffc4bb2c76898813ec9587e2a7fe38251f70032bcf297eaef183c34d01082db83f90ed0c0b6d530f37af442
-
Filesize
111KB
MD5ac74b9908480f74938dd380de88f68fd
SHA13cd46e88cc251e3cfbc27c2b91cf764e8f6c22b5
SHA2561b17353edf0adb776a39d146ee0fdc09e701f4ce2a20df8fa66b886515cfeeb9
SHA512f35dc59a06f8ba32cd79cf01c15d48a08926251b7e92af3c15115ad4c42a0b7427efeb52830d9ecc6191f51af421369dab5f34f8963e94c0ea086787bb5d2c2c
-
Filesize
104KB
MD53c9a7c2bf98399c3da63b65f156c5e45
SHA15533270a629c929edf5f13aa85b87ea7f5392204
SHA2564bf60ff364e815117a01bdaf0c514c4cbe131beb8b513cc8a6b26ebc013bcfeb
SHA5126f67866f6dcbffe45f2e658e40143cb72fe41cf78a4a18b9744c8eaf74f7bb02235bf0f1f7b96c307d4f9766d9fdcb0f68eac3d88181352e17dd5bb592000bf8
-
Filesize
112KB
MD520ffd36b729e3633fae808a568d805d3
SHA1f81b578630d907cf712aed1834e180ff8587fd05
SHA25609224ad00062070056fe3fc1ce1a2653606f7cbfcf1c3e48ebc6f91c5e17fcdf
SHA51235e1a4e55c5de566ccea3bc9304de5f7565c246b6460724e040076d05ed56a9bae4c9f13ac12c7815a5fd0d3fa9ec8ad4ecd6f6a1118844019e7a08eb4d37aaa
-
Filesize
106KB
MD533c08d53ffb09975e7ec8976fe7ea4f4
SHA10dd31b23b591428492e57e7c198b97e7229d53c1
SHA2562d6f5f96625cb8cf3f3cfca82be999cd23b214fb51203247d312e05005947f1d
SHA5127b9c9c926db476073550c308f2738d0ac10a2b8efc273196c7a292b101fcc70ee47381f84627adeb7823927b1048f343fe9f4b9e63f199809113a8636bf5deee
-
Filesize
107KB
MD5ff63aa820041df0386d9f3ebe5a1945b
SHA14c04ca61c38738cd17363f02f3eb9b557e904923
SHA25667e32b9c39834dedb4b37794d019fe704ce6a4ff2745c964aa5628322430e1a6
SHA512f6e7f93f11dafa01a64613abbbe918f4bc25c9a2e21704f9a8e65effb6e52c8695e9ce87d5cd2f1a52c01f58fff7a7e5a2f2f586587fc96f19cece460e750543
-
Filesize
99KB
MD52182051d4cee6a19238800f28e8ec68f
SHA1f58de111875aedf1412c54aebb7a57631675c974
SHA25618ff2dd58e965bfdab80fa81be00f53999a4cec413a90a2d235c452360d8f2ca
SHA512f9ebf59217f4695778ed01951c5661f8b0233a8043697e072166df3bab393d96a54397ca0dc6f35ad2a97b5925e7d1084ad57d100789031694bed1997c128a76
-
Filesize
109KB
MD5efe80e153196d63a6413387218cfcb21
SHA1d558d0b81b9d8877018ad5a6118a690085333751
SHA25620a2d093e2f08cb0b3c65db145376dda24cf5f152ebfb691f41d3c6a212e4e76
SHA5121034021025d7813c9ebfd7ddbbeb88807a5bc8fb4559f345f0308d8b094ea2e518a69a05d37373e5c49cfed57f24a7da4a7a18b969926db3f5b4192b5f6e6dc6
-
Filesize
98KB
MD5bab2d2b674a747c4ca5f54dbad20476c
SHA13d39b58db85f8f85fd684845c7250a9ca2b2400b
SHA256b7386de0fe3338f8ce759497bf98265f1b7c915389e46ac3a476dc5ae04cfd72
SHA5120852069d304b5d5324b0aa39da45aa8bfb556a8394bf0226c587a9662dbf10d3cecf096bf36c37905b6d8f071b201aca96a922c638dca0130f18bcee6bc4213d
-
Filesize
98KB
MD5a463c8ceb85f2402dfe441581c6e14a6
SHA160b96f558cb53df609973a722388076800baed72
SHA256084674975500df9864f6835078d6cca11f74ee8ebc966ae03ad52a183b69f02d
SHA512c0cc33a7cc0e80928cbc15c1e216c2cf1108b79bf05c512f2134daf27ae96af7030840565ab2d75deb7f7f06f17a2d538b706721dfbeaa38179350f66540b04a