Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 10:21
Behavioral task
behavioral1
Sample
da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe
-
Size
243KB
-
MD5
da6c46bc9113d30aba9983fc8ebf0040
-
SHA1
6fb20dd03ed056ecca0dfb1a6ff41c9854748886
-
SHA256
c205fbe36569c8431fc84fb8711ac0e67117077cd81fa38abd4f3a704ce87f21
-
SHA512
300542da5f24907294b9f47710c710cb86aae3065fac3176f3846285c695352c836cfd454e1d77c426a60147828039f5cf09c02ed76e7f8870916e27cd089ae0
-
SSDEEP
6144:JmCAIuZAIuDMVtM/amCAIuZAIuDMVtM/i:7AIuZAIuORAIuZAIuOF
Malware Config
Signatures
-
Renames multiple (3725) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 1384 _Node.js website.url.exe 2260 Zombie.exe -
Loads dropped DLL 4 IoCs
pid Process 2832 da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe 2832 da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe 2832 da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe 2832 da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe -
resource yara_rule behavioral1/files/0x0008000000015d24-23.dat upx behavioral1/files/0x0005000000003d59-29.dat upx behavioral1/memory/2260-25-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000a000000015c85-22.dat upx behavioral1/files/0x00050000000104ad-36.dat upx behavioral1/files/0x0009000000015cd9-20.dat upx behavioral1/memory/2832-6-0x00000000003B0000-0x00000000003BB000-memory.dmp upx behavioral1/files/0x00040000000104b4-42.dat upx behavioral1/memory/2832-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0037000000010430-43.dat upx behavioral1/files/0x0037000000010430-46.dat upx behavioral1/files/0x00030000000104b5-47.dat upx behavioral1/files/0x0009000000015d24-51.dat upx behavioral1/files/0x000800000001042e-60.dat upx behavioral1/files/0x000600000001072d-68.dat upx behavioral1/files/0x000500000001031d-69.dat upx behavioral1/files/0x000c00000001031b-75.dat upx behavioral1/files/0x0006000000010431-79.dat upx behavioral1/files/0x0002000000010316-89.dat upx behavioral1/files/0x0004000000010319-90.dat upx behavioral1/files/0x0002000000010317-85.dat upx behavioral1/files/0x0004000000010319-93.dat upx behavioral1/files/0x0003000000010316-94.dat upx behavioral1/files/0x0003000000010317-98.dat upx behavioral1/files/0x000d00000001031b-104.dat upx behavioral1/files/0x000200000001043e-110.dat upx behavioral1/files/0x0006000000010435-119.dat upx behavioral1/files/0x0002000000010442-115.dat upx behavioral1/files/0x0002000000010548-125.dat upx behavioral1/files/0x0002000000010452-135.dat upx behavioral1/files/0x0006000000010436-141.dat upx behavioral1/files/0x000200000001044f-156.dat upx behavioral1/files/0x0002000000010458-159.dat upx behavioral1/files/0x00030000000104ae-160.dat upx behavioral1/files/0x00020000000104e0-170.dat upx behavioral1/files/0x00020000000104b0-173.dat upx behavioral1/files/0x00020000000104b0-176.dat upx behavioral1/files/0x00020000000104b7-179.dat upx behavioral1/files/0x00020000000104b7-182.dat upx behavioral1/files/0x0002000000010438-183.dat upx behavioral1/files/0x0002000000010439-193.dat upx behavioral1/files/0x00020000000104ba-198.dat upx behavioral1/files/0x000200000001030e-194.dat upx behavioral1/files/0x000200000001030a-206.dat upx behavioral1/files/0x000200000001030c-212.dat upx behavioral1/files/0x000200000001030f-218.dat upx behavioral1/files/0x0002000000010307-219.dat upx behavioral1/files/0x0002000000010305-225.dat upx behavioral1/files/0x0002000000010311-238.dat upx behavioral1/files/0x0002000000010304-235.dat upx behavioral1/files/0x0002000000010309-245.dat upx behavioral1/files/0x0002000000010312-241.dat upx behavioral1/files/0x0002000000010448-253.dat upx behavioral1/files/0x0002000000010314-249.dat upx behavioral1/files/0x0002000000010443-259.dat upx behavioral1/files/0x0002000000010447-265.dat upx behavioral1/files/0x000200000001044b-274.dat upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp _Node.js website.url.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png.tmp _Node.js website.url.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-progress-ui.jar.tmp _Node.js website.url.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\autoconfig.js.exe.tmp _Node.js website.url.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.tmp _Node.js website.url.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.exe.tmp Zombie.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Reykjavik.tmp _Node.js website.url.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll.tmp _Node.js website.url.exe File created C:\Program Files\DVD Maker\rtstreamsink.ax.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns.tmp _Node.js website.url.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml.exe.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo.tmp _Node.js website.url.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar.exe.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Port_Moresby.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\Nassau.tmp Zombie.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll.tmp _Node.js website.url.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp _Node.js website.url.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp _Node.js website.url.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vincennes.tmp Zombie.exe File opened for modification C:\Program Files\Java\jre7\bin\libxslt.dll.tmp _Node.js website.url.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_ko.properties.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE.tmp _Node.js website.url.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe.tmp _Node.js website.url.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_ja_4.4.0.v20140623020002.jar.tmp Zombie.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp _Node.js website.url.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Tunis.tmp Zombie.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura.tmp _Node.js website.url.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp _Node.js website.url.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp _Node.js website.url.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar.tmp _Node.js website.url.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.RunTime.Serialization.Resources.dll.tmp Zombie.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Windows.Presentation.resources.dll.tmp _Node.js website.url.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp _Node.js website.url.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png.tmp _Node.js website.url.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha.tmp _Node.js website.url.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp Zombie.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt.tmp _Node.js website.url.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml.tmp _Node.js website.url.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll.tmp _Node.js website.url.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp _Node.js website.url.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_pitch_plugin.dll.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libgestures_plugin.dll.tmp _Node.js website.url.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2832 wrote to memory of 1384 2832 da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe 29 PID 2832 wrote to memory of 1384 2832 da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe 29 PID 2832 wrote to memory of 1384 2832 da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe 29 PID 2832 wrote to memory of 1384 2832 da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe 29 PID 2832 wrote to memory of 2260 2832 da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe 28 PID 2832 wrote to memory of 2260 2832 da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe 28 PID 2832 wrote to memory of 2260 2832 da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe 28 PID 2832 wrote to memory of 2260 2832 da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\da6c46bc9113d30aba9983fc8ebf0040_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2260
-
-
C:\Users\Admin\AppData\Local\Temp\_Node.js website.url.exe"_Node.js website.url.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1384
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
122KB
MD543d43be9a854270ef81c64ad84743911
SHA1506d4ab298aaf4f3476ae674317e541c631c306f
SHA256c056059346c82e3ccb4a2242956a4edb9136820a2b993ff7ba891688303301c0
SHA5122de97c548eba628a68e6b35e1022525d8ac8311f058cf75b6e4fc5de3720a8aa058a0b6d67a70eb5a0bd81c49f62c109c928144c1aca98b2c0133b2f1a115e9d
-
Filesize
22.9MB
MD5cd8b4fd6efccfe887ad04fe9399c1864
SHA1b8a70f731dd319e860a6cf769fcc70a69949ffeb
SHA25639f56bcfd8f7731151ae203f73a1e10a3d757e4077d33fb621b4433bc135cc81
SHA51279ad968fbca54745d08cc0836e7147308a0a26ceef57896e550235564d0c6eba5eddd42514c5fab5e02c1cb265b896e5584777bdcf59f730020e85347491e513
-
Filesize
22.9MB
MD503a7a2754aa37c05a971be2591567cf1
SHA18d0e0426daa7e9628f7dd4c3af0b39af5a4daf58
SHA256cb0f816a2d822b5bcb8704398f71c08470bdf14e654115660fd6f0140a23dd86
SHA512680ff6065769d0da341b4a6078ce10b54429ed9978dbc8eb7dc5a765628519bd0eb5277f37e1d2a453e6eb223eb799a2f4a53a21e8b13aece6c83b37e8d36ed2
-
Filesize
3.0MB
MD5e8b9ff5ab1de021bae30338cd6d28aeb
SHA1a88f046db9c78588312ada7f3ba2b378cef0ea04
SHA256c7d459bcb39e393af7a71e234b388a2389c754f2c6494f4238b64333882bb4a8
SHA512bbbf5e0acf7a514b45903d036998989a5499b5645f75a140a599aec7f3eaf20f79b58f5930df10bea1903524941a34887f2109c0422851e6a4690002c4c4fe24
-
Filesize
1.3MB
MD59ce69cb7c965fcd2180979f72d4ac1ed
SHA128bee23f8972fdd325100c4de608d2ca2a791fa1
SHA2560b4cbeb892769974d19720517c30c715a587eab83e9026559cc3fd6cf5af4c2a
SHA5120671995d4fbe469267095174d775ebb8acaa7e8e706c139770e85ca0538842ba8050d52740fea9f279193c89e498d3613c2d1eb58a4b2f50970c9d98b31494ae
-
Filesize
267KB
MD5ee8ba2acff6c4a44e5dd44184d5498b0
SHA19f7e02c0c8db4c302edff2cf44552da6a40267b5
SHA2569d31afdf19259d286d30cb4a1feea769fecaf3a96048b55d4c2cf57ae52d5a7c
SHA5128c99b796457be7296341799488a3c3f018ec50062e1df701ea06ba097ac7d27527bb861011140943f63d306ff8ea1f774bfbc85b4d1bc490797be22144b778e2
-
Filesize
5.6MB
MD56a202856ee1228f2f4092202cbdfe4ff
SHA186f968752eb2cbc1c3c61a4fe3d20632818a04fd
SHA2561de8592807fd809287db555a84dedcd52873bb1753f8db418a7823f2685d30c4
SHA5129f64c5c407a66a995cb4d3f9018461182fe8d1c17189d88d6d5cdb46dc5c0cd6b2733ef07e89220dbbd3328fa0beaf10bb5e19dfe3fbedec37ff5c80960e5463
-
Filesize
820KB
MD59a93b463fd5a8bb6ce9af69723748d9d
SHA1dc07ba1c952f9bf1c94ebc91a400eaf6e8d832eb
SHA256f54bedd819828fbb4562eda8783ceb5e4b6db7c6240ecffd31e13caa791b6da2
SHA512293071260053e45f888f5d31aaa2734741dbea18dfede3718305e1d8c426a49db11b2e6f8a8a9340438df0a6c8e48503a0c8877761a96f8538f3bbef95e2afda
-
Filesize
1.2MB
MD5c780b6b6c2a4efcbbc1fb7d7bc43bf37
SHA1a50de98a23ddd5ca4332763a34c4530332bd559f
SHA2567a5d8ba090ed4f021e8cfda62f4613398a825024976337626194430f86af1fa2
SHA51247e3583f65564aa98075850aed37cc110666a9a7934ab43e1c0b709a93851f64f82282c4aa224fe393a7e16712613e32288d9c3674dce397ef2c49243b42ac2d
-
Filesize
16.2MB
MD59567e62356974b3dc79b97dba14bc913
SHA184a803e10c6b91659e56f9feaf5a2f6d26f5009d
SHA256d82811ab3db211c22f84694e8091d483599d62a9d3d3bfcbc9364e93a2913826
SHA512980c895bc992af10155c66633c1ff275e774eb77b2bbc9dd06568d0777413640f452ee9ee8027f2e7f2cddade3b683fb53cad1b4c405fe246d82f7fd46b43e45
-
Filesize
1.8MB
MD5540ae22554bbdd9853963e0e8583e8c7
SHA1181277d1dfc06370f04407f083e915ecdd1737b2
SHA256b3ea73de931e2d6cc2189f6ebbafe7fbad97a8f31dadd6e3c5a23bcfdf85dbc3
SHA51236cd14ec693d44d194cdbb242883396aaf459b2097343dbd2c599edcf07f83096139a1c8e034fe9a3fe5791f011757d03c497b96362e77083e7920d785301169
-
Filesize
126KB
MD50f66432bfbb83f4478a1613e7e9d8a71
SHA144c19c897be2828f0c49f68fbec23688b40da890
SHA256a1018b4dcea9afa7b47ec6cbac557ae79b3db827c063b97bd21e959261e5ce09
SHA5128249657c51aafb18ce3bfbbc52e0a26ed2f1c25f2da85eb88b5d5654891a2e82ca8c01c5b93843ba9451388a0cc5d348975477567472c510f6121b0673a8768e
-
Filesize
1.8MB
MD5d1616cdb0df115addb5d54e251289233
SHA1cbdac06a7974b97f67c50d671c2c28c74d94d6b2
SHA25631f8084f726e4636701bb5dd3b25e0aa8e9035c7ad3a7b1cd2b5db42cd5a870e
SHA512eb63d3d6fb89fa1cf0ce817d24a3db4e1855e71b912188144efcf2fd5cbad63401c0a30f3b6f01fa21af73d5bd2e01e5afd1a69882b2f2fed2b5836ebd3498d7
-
Filesize
125KB
MD555d3989d265a74e6fa60ae1dc2410ecd
SHA113a47077e0fd492699595df70325c0be32312bc8
SHA256efdee29093125c108c89409714f9580566cec86136a72c91047a98b8882827e7
SHA5126ee394adeec6a754bccc47a8615fb6bb95787a51f00d2afbd63b1d8e5f4ed0da1a986a2ffbe94de3442e7f26b9c4b561b97277cd3d9555acd38504e228045750
-
Filesize
125KB
MD508c0da8d23d2e968a9935c4a2ea805d3
SHA1eaf5dd6bcf3657903c3a01b994aa09cfda281917
SHA2561e8f8939718a60dcfa34723cdf8486cc42ce1a8720dcd0999a67f9fb1959e50e
SHA5123c614a43708c4d80b0ec887438c4b1bf681dfabada6d024e166ad63969cd828a2dc3adc2cd234192b146ad36a68354e79a5cd5b261b9732a891e27bfbdd929fe
-
Filesize
9.6MB
MD52814cbda9b00cb985f72cb1f168442a8
SHA1973f34d1ebff9c58fcb9e3b4eca23e445dab19db
SHA2562f1bd6ed9d6aef8ccec86c8eb4871f7cd500e40bb2891a695cfa70f5b9ba4b79
SHA512c723835e2c2cf75b2310e2ba7fe0be8f4a0ebdbdabc2d91473e915f9a8738b7e0c0079255893c9b65171354025e8cb0af1bb3647656c9b2955c656b597b02770
-
Filesize
1.8MB
MD5f915409d0e0df6005c64309867599472
SHA1fdb370d17897fd0ca650084f0f48a221479913cd
SHA2562d72a019dcb350dc72aac51ccd027e450884256c51d061f93e4feb085147ecb4
SHA512bc0b8ab778199537e6887eec59913f798f6b0fd1688a7979d6a32b9158c60c80011826767ddc4a2d0d5fb5cab493205b8fb75d6f2451a8f9c0be938dff1a12c6
-
Filesize
1.8MB
MD5c43118a10aff9f87113979ee73538538
SHA173b17bd633de2d5bf20ee29de07ba34ea0f7e2c5
SHA256bdac65504961dec8e2d6bafbd83c79e630801cbdfea44c8859d89f8384f5bbc5
SHA5121086e8ca3c2a7c76cc6240722795d3450ec3b6e6712ff60d324b1b9c796bf2f301dd6402e6deabd6b53a9090a65775708cd769a792826a9ab82cabdce1166d99
-
Filesize
124KB
MD5b489dca2b676c2b9b1eaf440aceb2387
SHA1d6a51185a85010066e75999d5eb07a5e451e8224
SHA256a32bdbeb1cc60ad1a2415aad4f50afcf85f2aec666b8f8a0bf6f704a3e6ef998
SHA512c09ce63c11413ba213a902d755c89b8c960d79afae7d5169635e69e6acd3eb12e8d97eb2e6c313549195ee955679217b7e43197aa3c1cbd96672e1518abaf5aa
-
Filesize
14.2MB
MD53acbb19a98cb22684b97dcd23f5666d4
SHA1274cfc87a29115d83e42bca02926abf7e885eda4
SHA256f1be29ed3d1b3a3245d7404f70661385b45a0383c160a8440c1de952f6781480
SHA51225af035a26f488c8d55d98ceae5950d76c1978a63e1083b6fa7266031be07841e0679d23987d17c26a8241eb14b97ffc270b9efb547c9ab2d0871c462dab755d
-
Filesize
2.1MB
MD56d04dba300cb654b05522c4b8bd1ba99
SHA116e8549ee6d5a7621852befe61ae929839d9aede
SHA256944e379dab020af6ca6e9981f875253aea21a1f64f9aa6eb874e434ef88e3f7d
SHA5128fab58e5564fc2d87e8c959365a2f155e31a3adddbf2b068e1776dd01bcf854c71f4b797ea5341acd780ab60529b63039563ac80175b0a6d21d8c0fab8db9c7d
-
Filesize
126KB
MD52f36033e0680dad53735d20280bef46d
SHA1aeccdf76b432d18bd6be8a3f0fc0a1b5908dbc0f
SHA25683b46ecb4d85bff59ada0cec5bd00c3da324ee4f16d9d321cf9f563bb5c57fc0
SHA51294f189c125f4c1ba2cf43905a69431cd1cb2a60c1ee6f3298bd523bca6707901555b68a97dc298b5e287344fc18658b4c919ecbc041bed65bb5129cf83c30342
-
Filesize
1.9MB
MD5ff947280d47a05c527e183d03e969c1e
SHA10cd1e76cac8bc81de88bb1d13413a184b7aa4afe
SHA25698ec5716794824546a91f1a55c2d0da58b7aea01e16a4093ee2dbd81884a5af9
SHA5124365e70b7f19973242100f8437f0ab94c6433de03aeccfe99edb0d35173d647c4b5caef4c20ae75dce1661bcb1e572f2c60f79f4862578514dd5e4bdc12f9908
-
Filesize
10.5MB
MD5636682ec0cc568b96f9cf5a51560c466
SHA16f6b01fa60a0954f8d642b49a22686d0f1c599b5
SHA2562171c0e156921dccaa34e1ee256dfba19edcad63984d37c8c6bec2e144ac7980
SHA512eaf65148a373b065504a7f688a5f6eb64001230126121886b0abd6c85b43e64e84e1137e920b0b9aea3630ff125b1a072ec5fba357fdebb05f3dceea1db01d7d
-
Filesize
12.7MB
MD5e36fdfc726775cdd7168a3feef31b80f
SHA1c59a862ed1f5b63d7bb3cd23000e7bb09926a79d
SHA25685e5a9a88fc28d0828fef4629c4f88bbb5a95c57596debc4d3934bc3f2847dbf
SHA5122a69d094e600a99f355271dfda4dbe103833771724061a425e20edee8b0b17bc62712d714c5646a96fb375d9e94d532ae7a0023f6c87863e35ab438f11de3d81
-
Filesize
19.4MB
MD574f105d01e0125d48a6ed8f2e4cc06cc
SHA1f0000063c1d3895e2a6118a1b450e6656e961b68
SHA25660271ea967aadbd5b100f99cba51aed47b91940ce43e0f327b29e67bf4be0d5f
SHA512ed74ca4b01f75f4197519b069ba5f1af144b6d963bfe755c1909d63694712a94ff760f52e3f660e3f75615f1ad4ae60a8ab16faea9aad0be09d187ec0f1e136d
-
Filesize
127KB
MD5b7bab3b407f504f9e3dc7b429c7ed794
SHA15fb3b2bcd260a84dbd07510dc6a5e71eeac40b93
SHA256c7cda8849e979908f28299527c633f94aabfb19788cd44ed78089e35544f8707
SHA512f7f1889226eca7fa2cd033b4e10d585872d4e9de324ec601f6cf7fd393e9e73a54ebcd6864207f387a44ffd19011fbad8cb778da47f3e1f5a3de10aad2d8f10f
-
Filesize
12.9MB
MD566cabd8dcfe6877e58f7918d542a65e3
SHA1764a953b0faf039532916816f30e5e918d614220
SHA25608f07a36e95f74cbf9be12a37efbcc457e3e60f113afd3cb35f1bcda61b05136
SHA512be7b61abe385599b14c04ea40ac4436e6341a1fee410cac08253d3b64177b5beac7a587c9df6726ea30c512ef64f7f875b7fb9d3bee205fdf9f90d0782dbe335
-
Filesize
2.4MB
MD51a6111ef433d1c514a2fd2557fefd89a
SHA132bfecbbcaeada91438fef5d3ba6e10bb6e91313
SHA25673ab928b6e55b23ae6ce57aec861841ccae605e1d28323438bccd88c80e4f15e
SHA5121bb000611ef476cf67b6d4fc6a47b161a8ca0e8f38c5935dacf7cc8d444d520af355b6652b05b2f1dad2cab043539aef69a14cf50581bb2aed10758e6b58ed3f
-
Filesize
1.8MB
MD5dc3f0da3f8ebf6aecf570e408ea3d0e0
SHA18cd4862c2be838b983473fb0740095349299f234
SHA256c3876af9cb3e31319b9df06159f0d9ecdfff3dca0cd5714e40c82c0a74e7c945
SHA51226be624b6d9c59c78cc4fa66bc2300a13e4e633c4a12d40b7c4e5bfdaf4f9c37222fba27652ad0ae0a032e85c6be50d0202a97e719366980086605991031c77c
-
Filesize
10.4MB
MD5f30f3c861fe147298c30e035adc29b51
SHA13b65278f17b922e63af1671ea37d3de9001c6179
SHA256a99cf10758c3b89c3b4ad36071350531452ec7dc344060f32d7bdf9607f1e3f5
SHA51268e2a29db6832fed7cac30160fc0828f8e7566a36202fea44d9a2b2cb093e6063178880cb8cab81fcc865bc03840287e6e3d2da6da770c3040519a89441f9f5a
-
Filesize
6.1MB
MD55f395b299eda75f987275467aa7ba401
SHA193d445142fbcc03c8621486e3c52b34b7364ab9c
SHA2569970d82edc33ed0a40404cd635d97a27367ca4c8ad91817c0b045379accc3da7
SHA51261454dd34f956ec49e8c64e2a27c90338078841d6f63d0974c770a1e4d10acc4c179b1a7072059434456751474aeea6458be048fa32abccddcda5eda58a78769
-
Filesize
4.0MB
MD522c4027160bcb05f71ff0c8d73e83dc4
SHA197e9a67c75dbfb8e328ff869ef04b28335d2d824
SHA25647dea058dcf48c14c9edebeccaa67f8e0bbf232444ee677a64cfe8025ebf8f8c
SHA512c243b05530956a36eee6e25d4b82b2dcda4bd203c5e5ca8a4d4e5ca75f504a3e8732b1bda9c6812a8ebe53f017570915164bdba0c9db8a70a912cb0c924a376d
-
Filesize
4.0MB
MD5e33f496ae37ea6290da2ebb641620a82
SHA10185734452bc06138cbb36bd34e6b652f5904ece
SHA25642d88f6d02e719b06b04a0ec7b362c960f45833c937beeac3d17de072bee6273
SHA512ba89c2fc9266b5abe2af8fc7cf4618e3da287b4e6c30e5edc8a1b14674075e1abf370ad236b6865ddf02abd179e36fe3e8e432c9c2e368f485bc7c1da377c986
-
Filesize
1.6MB
MD5e09a0a3ab715d36e2d8fad2d1ea2f4d6
SHA1400a41313dfe7e382408e22d9af723685a67aaf4
SHA256a494073a096c08fff2f197f7abe43ea71c35ff4384dab1fd52c5237b38fab9ca
SHA5123d71f5a2aadd3373873e0ef0abe8f0a897f1387b3f7ad69e91edf4d06a80b548c31cbd4ccba2a1528f4d8b6048ee0ec376911ac25a698a24787df4b3cf664e78
-
Filesize
227KB
MD5bb1463476cf50670ae236bf5e7ed2563
SHA1002336b2711c722e80ae3e6c3f8d681e852b2eb4
SHA256fd10c9c75f41834645ca261fba1566af78f7240fb3a398398be3de18fd73cd7e
SHA512488c3c38f1597480c373fc558e2fda39275533d42f704f1c920af4a6c0d5abc7ba7019ef15124bf4535c43989801c33f084dff5a660597ae5b48ade3305aed9d
-
Filesize
941KB
MD5974cccfcfb066fecb3805d1c83f72195
SHA138447123971bf733f6787bfa1b049b20fbc3ee17
SHA256b06dfc375bb7d9a12e224dfc1430e721a670345a3c02abb85006239b0d660815
SHA512e09d19b3d464f85d399a7198b8ecb9760d93273d06cfdd5d10a1889c90fe919231ef1c8442f51727a5996541fbc7c6ff39733f692c74e71c96a32a881342c446
-
Filesize
5.9MB
MD5371623c8538cba5bbb6560982cd8c064
SHA160f7aaf6fe72b782fff1fe4698e859b27aff3045
SHA256b1454b13563e92abe5a720a78cab812733d72f7d12c20d7195faf431698f5250
SHA5120ef434f4f718b36ba7aad0f3be416026db7b27a649b4c5af3d8352a86ca32949c256ee6e324e2c17c9cd73b6db128645cd3867d629bd27f619b382c73bfdf257
-
Filesize
2.8MB
MD5c465d1c5e550461a01c6d5ba703383b4
SHA1d9f1826e1158375fca6608a875d0ab8aa3dcd6f1
SHA2560b3dd041106a85d53b0c19aad9bcc340eb6e2a22f41287440e9af3a6457b7a1a
SHA512021b5461e5d1a593db9887c01857e6db0f1a18ca330e810007f4902c5a5c3a2970e580683751eb341009a95a3824c19d2a02ea0eaba058e33ce0a98ea3d84c36
-
Filesize
757KB
MD582d0eebd5a985b3af749e0484560d644
SHA1d054164a061f736f7e5d46a80923d88c5cace586
SHA2567b574fd0b4dbae621e8d7e53fb37fb99c3f35270394fe336b076ca2eafc54089
SHA512fc4acfbc39e1ad3c4070c197f82f9299399fbb103b7b76cc268aef64595bf1cd1e6d3663d5c7010d4b08fc7037feb68edf5fbb546a2d985b040f01ec4079509b
-
Filesize
128KB
MD55a1ef308d4b0384cce7b56ac70f4f390
SHA1889fbb8913ce98981fb96c42e93333e6a1a1c6d4
SHA256195ec73afc02e42be5369184be2e88cd8ef723ba1e314e6e1baff02b71b71868
SHA512bb279ab24884082df502c5702dbc924493e5b3431efebb76272dc0a742362b771e02abce0270769c359dd77cc911b21e6b15b63dd29f28a6d74505356dcd7c5e
-
Filesize
704KB
MD54818b9f403c1db2aff2304089eb3b086
SHA14478328c0509e3b0733ba0d4f2c3a5fb05387b8d
SHA256715d48914c75845173df9de7f77df9a75638ed0c4a889106e03bad22f1789a21
SHA512d81988fecb5da09f43babbdc86f9f9ecfd13ae4efe82250fb9994f698c45d37391973fc17abe657451171fcd68552516b3df5be24d10b902b56db3938bb819cb
-
Filesize
635KB
MD5ded3081a0391319ab8a44b9c481a514f
SHA1ed6d38d17c0be5fc5377b665b29e33ff8a56df76
SHA2563233a39a127b7d24aa46553d64709dcc1e53c20d3f94123278b4e2d02294e23f
SHA512aa9f5f2c0ab7e62b9376b20e067edee57e740904effa7a534a9aa2b367a6013d886205120e9a35b51538f6cf675985fe949e34d52c674c2a6ee5756db5dbcc17
-
Filesize
629KB
MD5949e279a8f4a73847a14ad34e0b4026c
SHA1c17caa547e39f663e2cb70123dcc547c89062565
SHA256abf504ef6cec365580b4251c0c9c79124f8a3029b0c7c950001fdc17352ff7f6
SHA5128766016083e1d1fceb47c1e50abc83f2f2152a0b292f97f40912336986e9c31b869de74627526afa4399d6380ecb09df2524a0ba7485a5c3d5098d67c9471d37
-
Filesize
762KB
MD56ac82004cab49ad7934653fe50798f0e
SHA117926c72c9e3486901d4ec3db1a31dd27408cd9a
SHA2562efd0c553b82892a7044ff9fdb15fdab3d7897a30b0e1ed4c7040b860ad0e560
SHA5123d2648b642f534936c0f4cbd61f903b80145dbd0e39b972871b4d3f5fa055ae971311cd7ed55ca7ee100b1e9ec9c0bbcc452faba79e249a31c52ff295275cfed
-
Filesize
148KB
MD5444c58b2fe876f60187908daed2c313b
SHA1be676add9e1c48fc090f8d1ae81010bf40d2e4a7
SHA256ce7bff714fb1cc794f775677090a94afc08c6f3b98b491dc280b257e1d4e5f70
SHA5129256a1cf057896491c1c71cc28c0ff81bf0899ff6a6c416a8d5e1be77ab9b5a6964b0ee359b705f87eae105d742918c7de51e97f4c41ba70385e0c90ca56f17e
-
Filesize
187KB
MD5a99f21ec40f162d977310a097488e828
SHA154ed8cea2f153c00d4c72c1d2d1f72b38ed5d29f
SHA25685813405254c29471d8b500744913ef780f193d3a54aac9459726e5f662fab50
SHA512afbd704777f75afb22ca5f55d1c60c62829e17b78411172d2e0df918fff2d2c18f8eaee3b82c36173bf1debf9f8fcfb5e56abcc32359a9351ce297848c542e6a
-
Filesize
1.3MB
MD577162ab346a9b1b6e3dbf5f3a864a7a7
SHA1f27d2b3b7dd4f5417b9050b9162e5ae08569efaa
SHA256b0c21677c19911b77ecdfc6c39e905b0e47d84e98837e8f6b00db6ec7e238dc4
SHA512ff1a551fb82f2367b752f10222d7c1f112b5a3ab415a155b9886fddbd342d22bb3625cdb5a4441b7df8c46802b676a8c79a4d3338e47f9c5ec2cfee204e0133b
-
Filesize
760KB
MD5da53c5effdf47379d33266499e0c91e2
SHA1e9f26c71cec305cd480a6c95f8954395a309b73d
SHA256a927031875db39e1cd90f6a54b312b83c9bbec4796ae4bb1ff6bba2596a31fde
SHA51237089bc957ebb8a6120ef79feb66805e3328257e5384d689237754bc108d8461a3e989b3b29b58ee27872ba45a55cb384d16a48e637a8d8a60130ef57a35e31c
-
Filesize
124KB
MD57c5f6a7f10a94470802af823df28d638
SHA1c6125084fa2763948cd5eb7da3d66912f57bf859
SHA25658097a2196a1cdff7d8d22591ecabd26f63d92e7e5040ffc196ac0cf89b53a43
SHA5126dc93f630c6e3ec5a35301bdc354a87d2ac723fdc091b4e2e435919358417077d329024d2684a932c091b684a323b9234c409231c02518bf91f1c886f5ae94d7
-
Filesize
757KB
MD549a10f125034e0201e5d023726131b57
SHA1b928662529f2d68d0681a4893d83523b51314f18
SHA256dd86f6088c828d6716f5da7bd8c4ba414be01dab31db458d350c1e7387642bc1
SHA512854e2fbe6bee02e467046dc1b0999bc407811d8a5177f533422782bbfbb7e32866548e9d50f0d0225ee55efd2ee931d25a4a3e193bb640410f96ca4d5ae03def
-
Filesize
2.1MB
MD542cf03414741fc52ad314b1b05162e80
SHA18266754198092b48cce904db6a6ec664e28ebd7b
SHA25616d653f7c3be39aa1b892f27d177ab8209a36e381e01416f20a17e4d2cd1f902
SHA512ff0452696f48049e5e463071e230d2a120afe02c65926865699fa21d95a60d9e1c63515f4327bdaceb4229fdd16ff662abbb526ed782fecd52f6426c03050569
-
Filesize
1.8MB
MD544aa93f79bf4950df55f0e1555793648
SHA112ea09dd6b5180548e252b7e289cd6c858cb88cc
SHA2565d2d877c3b8123ec07fc1ee8e4e6089bbfc2137a49bcb17e5c0a71f1366e3d04
SHA512f64fdeb16b8ee74becb88c0c0b912a163921d2f41b99b721b8c091073593e9b620d10e0c8e1a98a7a4fed37e5f4019869975e09953989720cc4f20d7fb8fc5d1
-
Filesize
122KB
MD50198e9893bae5de3339910986140d52a
SHA1381653d835855461846e220b391eb564df8a400c
SHA256f2c8afb49dc586f5a8a5cc4aec69b85936cc451ea8f5c3b262ef155df9d88af1
SHA5122408b794c26624cbb50fa77517654c5a0d86ca8e5b4e70e4aac6eb9018cf4588fb914bad2657acad0f0c87adec3d510e00bb6d63f50b8258cf1887c36b661bb1
-
Filesize
121KB
MD58f11f3322f4c3c02bf58eb8cafc31d29
SHA18066f7edf9cfc0aeb22d1388ff07fff9e94a1a75
SHA25660f2b57e91b825bca68b4d5fc3c9f9cdc92129f1c5f527dc0ff34004717d2d44
SHA512b7e17b985684af4d37958f5ebc455cf2f9b7c4445d2ed0f5badfbacc883cf2ca3c5fb5cc472762abe5dcc0e08e5830362de1d7cba4dc3d05d96ccfa671f149f9