Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 15:49
Behavioral task
behavioral1
Sample
9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe
-
Size
90KB
-
MD5
9e6f174b10a6c1d04b78cd77eac43650
-
SHA1
de78ec06da3b0333e000fdcb1c1fa1c78cc99fba
-
SHA256
f643cc23d331615e933a5dd250ce70676a54a6f8dfcc6c4e4cfad8bad8485995
-
SHA512
3ff5cad8d7db600a9edf60d8aa59e00104aa80b555971933a4a57d38eb75557ca3a6553cd816a4043d5b112d216bc8ae6ba1dabe738ca076d7840826ca4f980e
-
SSDEEP
1536:CTWn1++PJHJXA/OsIZfzc3/Q8ITWn1++PJHJXA/OsIZfzc3/Q8S:KQSoDQSol
Malware Config
Signatures
-
Renames multiple (4620) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 1712 _desktop.ini.exe 2620 Zombie.exe -
Loads dropped DLL 4 IoCs
pid Process 2280 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe 2280 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe 2280 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe 2280 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/2280-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/1712-14-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x0037000000014230-13.dat upx behavioral1/files/0x0007000000014352-16.dat upx behavioral1/files/0x000a000000012286-18.dat upx behavioral1/memory/2280-19-0x0000000000320000-0x000000000032A000-memory.dmp upx behavioral1/files/0x00070000000143db-31.dat upx behavioral1/files/0x0003000000003d62-34.dat upx behavioral1/files/0x00020000000106a1-42.dat upx behavioral1/files/0x004a000000010492-43.dat upx behavioral1/files/0x0008000000014352-47.dat upx behavioral1/files/0x0021000000010494-55.dat upx behavioral1/files/0x00020000000106a8-59.dat upx behavioral1/files/0x00020000000106a8-62.dat upx behavioral1/files/0x00020000000106a7-65.dat upx behavioral1/files/0x005b000000010323-66.dat upx behavioral1/files/0x0005000000010737-72.dat upx behavioral1/files/0x00020000000103d7-73.dat upx behavioral1/files/0x00020000000103d7-76.dat upx behavioral1/files/0x00030000000103cd-86.dat upx behavioral1/files/0x0002000000010320-87.dat upx behavioral1/files/0x0003000000010320-93.dat upx behavioral1/files/0x0003000000010320-96.dat upx behavioral1/files/0x00030000000103d7-101.dat upx behavioral1/files/0x000200000001060e-107.dat upx behavioral1/files/0x000200000001041c-111.dat upx behavioral1/files/0x0002000000010430-123.dat upx behavioral1/files/0x0002000000010610-126.dat upx behavioral1/files/0x0002000000010611-129.dat upx behavioral1/files/0x0002000000010611-132.dat upx behavioral1/files/0x0002000000010448-138.dat upx behavioral1/files/0x0002000000010452-146.dat upx behavioral1/files/0x0002000000010450-162.dat upx behavioral1/files/0x0003000000010464-172.dat upx behavioral1/files/0x0002000000010457-178.dat upx behavioral1/files/0x0002000000010457-181.dat upx behavioral1/files/0x000b000000010325-184.dat upx behavioral1/files/0x000b000000010325-187.dat upx behavioral1/files/0x0002000000010400-188.dat upx behavioral1/files/0x000200000001040d-198.dat upx behavioral1/files/0x0002000000010317-199.dat upx behavioral1/files/0x0002000000010311-203.dat upx behavioral1/files/0x0002000000010313-207.dat upx behavioral1/files/0x00020000000103fb-211.dat upx behavioral1/files/0x0002000000010315-217.dat upx behavioral1/files/0x0002000000010310-224.dat upx behavioral1/files/0x000200000001030f-228.dat upx behavioral1/files/0x000200000001030e-232.dat upx behavioral1/files/0x000200000001030e-235.dat upx behavioral1/files/0x000200000001030d-236.dat upx behavioral1/files/0x000200000001030c-240.dat upx behavioral1/files/0x0002000000010319-252.dat upx behavioral1/files/0x0003000000010319-260.dat upx behavioral1/files/0x000200000001031a-267.dat upx behavioral1/files/0x000200000001031b-271.dat upx behavioral1/files/0x000300000001031a-275.dat upx -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Zombie.exe 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Zombie.exe 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\currency.js.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp _desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.registry_1.1.300.v20130402-1529.jar.tmp _desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera.exe.tmp _desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar.exe.tmp _desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.tmp _desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-io-ui.xml.exe.tmp _desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\jfr\default.jfc.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_stats_plugin.dll.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\settings.css.tmp _desktop.ini.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\picturePuzzle.js.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\gadget.xml.tmp _desktop.ini.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_ja_4.4.0.v20140623020002.jar.tmp _desktop.ini.exe File created C:\Program Files\Java\jre7\lib\cmm\GRAY.pf.exe.tmp _desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp _desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\icon.png.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_h.png.tmp _desktop.ini.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5EDT.tmp _desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct.tmp _desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar.tmp _desktop.ini.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\RSSFeeds.css.tmp _desktop.ini.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationTypes.resources.dll.tmp _desktop.ini.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac.tmp _desktop.ini.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp _desktop.ini.exe File opened for modification C:\Program Files\Windows Journal\MSPVWCTL.DLL.tmp Zombie.exe File created C:\Program Files\Windows Media Player\WMPMediaSharing.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml.exe.tmp _desktop.ini.exe File created C:\Program Files\Microsoft Games\FreeCell\desktop.ini.tmp Zombie.exe File created C:\Program Files\Windows Media Player\fr-FR\wmpnscfg.exe.mui.tmp _desktop.ini.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt.tmp Zombie.exe File created C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp _desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.exe.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wallis.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\library.js.tmp _desktop.ini.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\picturePuzzle.js.tmp _desktop.ini.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\profile.jfc.tmp _desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar.tmp _desktop.ini.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\calendar.js.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\42.png.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar.tmp _desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt.tmp _desktop.ini.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js.tmp _desktop.ini.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev.png.tmp _desktop.ini.exe File created C:\Program Files\Windows Sidebar\it-IT\sbdrop.dll.mui.tmp _desktop.ini.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\settings.js.tmp _desktop.ini.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libvhs_plugin.dll.tmp Zombie.exe File opened for modification C:\Program Files\Windows Journal\it-IT\MSPVWCTL.DLL.mui.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp _desktop.ini.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-3.exe.tmp _desktop.ini.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.RunTime.Serialization.Resources.dll.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Design.resources.dll.tmp _desktop.ini.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo.tmp _desktop.ini.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2280 wrote to memory of 1712 2280 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe 28 PID 2280 wrote to memory of 1712 2280 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe 28 PID 2280 wrote to memory of 1712 2280 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe 28 PID 2280 wrote to memory of 1712 2280 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe 28 PID 2280 wrote to memory of 2620 2280 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe 29 PID 2280 wrote to memory of 2620 2280 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe 29 PID 2280 wrote to memory of 2620 2280 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe 29 PID 2280 wrote to memory of 2620 2280 9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9e6f174b10a6c1d04b78cd77eac43650_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe"_desktop.ini.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1712
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2620
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5ff852b6bc2520569c0e0873c04c50f94
SHA197e7a8d2fa99b49dd97b99039ce05daa0235290e
SHA2563c51c8e8ec853e2abbb638ca5c4906c3857b246869e63438287ef87a003769a8
SHA51262a7e64b4f0aaf54c2b76ed13d820f53b4237b114db0bb96401f354f0aae381f8b02eee490b40ed1cae8f47ed40ed294e8c053ce9e5ac3acae153935edeed5c3
-
Filesize
45KB
MD57c31ac7336fe40171e097c1828219ac6
SHA10d536fdff1e832264627f2b5ca39008b3a214ebc
SHA2562dcec1385012c3fbf72de120bbbc39ec67e1603d85cee22d43e092b76e13369d
SHA5126a63348fbf0316867cde32035a98f13c23b47e29f478e59d5676668fedd358fa94dba39f3fc79bc5439b2ab037d1a99a72b7934f70370a4a74c99bc92e0008a9
-
Filesize
8.6MB
MD557500688c5d9ec83e7f40179fb2763d7
SHA1e999c7c0dc59b5643854b59645ffa82eb7a06285
SHA256f1e7ac73876d818f0aecc74a5cf2d8f767a3c91b3aca7d37dda21446c63f3f72
SHA5128505df0b45796a705343423326905e871a6dc8e21428ba8f01364727907c841631e383579b5e7cb86865df3fe60e8490c9f9b504a2426c96dc43b816165cb025
-
Filesize
1.3MB
MD5fc20b56abcdc84d4c5cf5619f8e678fa
SHA1cbc620ce98997757ce097e965fcc2472db3a6df7
SHA256fff5121107b2bfb8c68ede853106f003ae5ca8b3445f599db5d551e9e9092537
SHA51293185144807ecca4f36d47a7447bcf17f5961f4765e92bb369419f2b31f9ca7689b97762f275ab56241fe3ab40cc39368b183af02d223f98dd1459bd89ec1894
-
Filesize
1.4MB
MD533cfe6e42878947697debf44b9d3058d
SHA1aa7510f813d71334f63d856ba970d3280b5a4e12
SHA256b96a2833d927cae8edf3fc0340facc9c28574c5a48ab2291eb1f70a8846f9611
SHA51275197dfde04528d362a2241ac200c12fa3bc89d497ae8b76c0e7de5bd1b3be38f0e233d5ef4ccfeab2093e0b257d524f0aca24a07edcbf0b5b7ae981c9e5450e
-
Filesize
62KB
MD5a49c73830e5d605787a2cb84a034992f
SHA18554ca9aad0085ccf4c961ce6c2ee1b10d5f1599
SHA2563c005bc6027c04448a5c4976c91057ef4fd1d5bb2cb4d6c6bf3869c0a4b3b333
SHA5124b343a683f1910da516db8e04f10f79d35cef38d543020bca10af660745bdac031904375279f46fc86c68cf910edc660bd056f8006fa729509e5a7c6e87d8322
-
Filesize
62KB
MD575d51282ff9df1865744c5dcd1ef9237
SHA1e7da0a9ac3d8cd4e0846bbf062098ba3c60409cb
SHA2560d29bdb53e091b1a22cd6831e99459481662b3bee0e5010c2b88324101c906d3
SHA5128ce933d46b72fee71e56067162c1f9768819af44ee531e8b7ac2d336844e19dddfd1107785e3fa9824f3c503964bc97d2b4fdb8a784e027f81fdee30d1160692
-
Filesize
76KB
MD5076e635b3d8206794a56766bdb19518f
SHA1b313998ab5322595bbb800bc3f8a1e4df7a03f8e
SHA256419c8a2ad1e69e5680a4f1f44bda74bf2bf5d55e0d49b406dbed1e8c5b99f4a2
SHA512a5b7d704ab0ee4c69e66ebcacd5d4e795609d79b65e510c54c485a9e50455111cf3bcba2e7e35f9b2313639e026914da3f0edba7db33d2f1bf83c1ce155a5bf8
-
Filesize
191KB
MD5ad13fd000e7461f552ca2f1e1e4fcc09
SHA14aa642c5a553a017c14215189a1aea956d856a6a
SHA25606bfac2ac33f0feadc7f375e28f6046d6ff2f709af3b0d5321eb940869e2797f
SHA512f010fc4f4cfae29f6711b89e8914081b689f45cc9a05f1f40b13fd791612a88457267a8f8f79c99f6ae7e896b039b508f7c2231f0f77d5619268079ea455feda
-
Filesize
5.6MB
MD5b34e7ada3fa2b3b035e4ca7926b494d4
SHA1cd02dd851849f169125a157cd308ebcc23ffd96a
SHA2561bcf5514902164c5cb847fdb0cbc2e957dbbba76d39b294b2637d8b1fdf3dfa7
SHA512143d292b999482e9c10d59e930b5fb68b067b0eaa35ec0194b75e4aca3dde43db23d2f251a2c8145dad34c1526b3ad0cbd7e09f6be77ea083edfd102d535605a
-
Filesize
1.1MB
MD5f2d3a44624d2b205fa2a77d55e6a4d14
SHA1057ab8644ff418b72585748e3bdc65dd89484fa1
SHA256752e45e272d7ee3e1d1b8a97cd311901957756baf97a04bb4aec17f1fdf35eab
SHA5129d47429535de301ae7fdf5804863e5375d011f8b9c070bb2b438f12b4d559528fe39a47f4f21228aead2e166774d97d34deb576a1b2851add64a95fa3dfb6136
-
Filesize
16.1MB
MD57f8f3b9274a1397ec4c90a9c6d4ae671
SHA1074bb8c34a4b3f90d68c2537d4811a01cfed7c34
SHA25690937cbf73b724603fc9bfc7681fc658b42b50c96435c7a666bd2945d8bb149e
SHA512a686a2c3e6cde145ae4b0cfb4d080a8ded4bbd02b35327a313d166e9b40e55d6fd0dcd215a77395cefd9a279601072a4cef22c6a516cee1ebfd21b4ce3af242d
-
Filesize
1.8MB
MD5ee1f7040a55d19a94541c531d37bb14f
SHA14d02a429c1d710cc8e71986ef067e536ca95c0f2
SHA25666e40d7c1d898bd608770510e63f0e766c1aef24935253b944a8b5d931c5a3ae
SHA5128f6b80c1b6910c0139b4e37549d5c97fa63940a894902ab089a17045aee4fa33b1fc882de9d3a1ec5e5583dd0d4c7d7e102b932f85c83758b6dddce587a2ff0f
-
Filesize
1.8MB
MD593e662664cc359bfffd4fca4bd7d18f5
SHA111ae2966216fb95a130f048c286ed1661ea00b49
SHA2565740de55c48f78955edf17589c780414b711f1e559e3e538554731d75beef8c3
SHA512024748c5d9367081ec6117ed2a2986747705ac4dc5ecbefd687b2e685e3ce4eb55872b3da797d7ed15c056c03ddf3e64267d2d7e63eb7e6dc717f1789a1add93
-
Filesize
1.8MB
MD5830b7f37636e37bda92c3493ce7b44c2
SHA19f3f0a7362f83b81621a8f9f94a4bd388ffd44d7
SHA256ee31e3a5dbb8d32a2b01fa41e663519b62c31a21139c821dffff5dcb454eb7ef
SHA5123fbb54f19b47611a6fcaa4a18c46a4c9b1d65025489794de9089cb3624321250c50731610bcdd6ab0efececb52a5c0ef540be80bf12c5fea8625ffe24fe2cbcd
-
Filesize
48KB
MD5275ed6e4305045c9ea8a735fed55fb77
SHA17fe015d95b55ac4df6d1aa93605087305e4bb7f9
SHA25643d0389efaae0ba161907e082ba8ca3b2ecd9457908e889d0a2442d608d749d4
SHA5126dfbe3ac0362305e6ea1bdf590accde73d890eedf31df384fa1f25cf7aa952d09fffd3f92c4a9b44f8d8a2762f20a2e714268f7137f92fbd6f9c239f824b2587
-
Filesize
1.6MB
MD5e0defd9bc4cdcbf83783ba04c4c7ecfa
SHA1ab2fae097d2e25689a6b824fb0d69e16643c1d91
SHA2569f5d709c702be7dc18efc8c1bdd1387f3f7bbf13e41be22df359eba707bec06c
SHA512347d8e0bdbcaf14efa907362a6446da64aead634b5ab75193676a29defc9e4df3d71fc7abe7a07287ee308e81bf18b49b0121a6f459be4d7042e30e089e4b387
-
Filesize
48KB
MD5ea6f1c20b2f00ca6a5b41386bf1d4857
SHA1900d75940e985a7d307b8644d8b7cd635fc85fc8
SHA256d6f2ed6d63f125b7e8d095cf37c92c5ac65e45fe69219e65e17b3827894c64c2
SHA512cbfc61f13bfb5ab5ddc92619d0936539d4634bdf7992cf766714c625ff268d57604cf3fd0d97ee24ed33433956cb9c37499446da6ac5d875ca5ee6b904d0877c
-
Filesize
1.8MB
MD53d781f6f7fff8ad4cc391e56edad00bf
SHA1985e2bdd87824d8d0efa3f0651dc63b76aedb627
SHA25636feafaeaf6db3e21ae812fb5eee9adf340fcb50d6b94b4fc00b3e938d327458
SHA5123eb5754c6fd8301e3f2ed575144d66d3f0f5110f59b0b2fdd48c58d3ac59c00b30d8a18eb6b37ea2093e1bf569b88d6ce997ddd3b92477e821ddd8fb222c0e7e
-
Filesize
2.7MB
MD504f761c7521215b4794a357ce1d6d88c
SHA17dd36a4d1586bfbf9c8efd3644aac53d705d75d2
SHA25668d5e2ff6c43067bc95bb0aaccad74dc4115f9b688366c65d7c8a5c9b2840e60
SHA5125a3a3fdf5eeca75beb0e825f303f65243c250892aef679388c4ba5d7b7102eb2f13e7b3bbdb886c870959218ed35c07f2157a5896a4bedb418f6b7ce25ef6f3f
-
Filesize
1.8MB
MD552462ae29219d09b1aff037cc2e251d6
SHA1a6512988102b1b8d641a4977818b3a3512839ce5
SHA256b8f681b2402d02512f00f53cf275e88779c6639055defb0c42ad4e1d55d25408
SHA5127e132ee120410c7c20b4418703cd52a32ba3744e42842a362525e8cafbd4de6dec735007831669328b962b5f34feb755638065637c0e759d2844fbf80391081d
-
Filesize
50KB
MD55593f273f18b97a5766fc1739aaa07b6
SHA1d768f77b07a2db78b069dd146af0c43935235d82
SHA256edb03b0a45c07ccec97e937ec420680851a8fe4b70ec468d907a708cfbaddc27
SHA512fcdb8b30adc881932f5e90b1cb961ebb51a04ab10ce1194a8b5b15b73e2a462c86251c0e250760177a7ac9ff45f106a1beb5d351ddf9891998977af5de6edc7c
-
Filesize
1.8MB
MD518cd6af206df78ac670a56d32766749c
SHA1e628ff999a7251cf9a6f8d9f55993c0a5fccb412
SHA2563077d47c5e65e6dc2937c5f19608c6f9eb01d097b264e3b2fbec5b929dbcc264
SHA512bee298212b641edb0a79244035e3d90606ed47ea16845385ccc1516a50f86a0c41f4cd1571688f957a5601fb24c753990daccca2174e3f7457f0ac2944ca5378
-
Filesize
68KB
MD5e2bfefab9caa8d2c81c350de763f3ac1
SHA1d1e77f50e69c2a8a11dc484276d90cc390503416
SHA2568e80164b24bc944c82b366e351ffc72354509fa563a856725cb767c8a30d2c53
SHA51241a3772de4dd34080d6f5fd3f68b72717d6d99b406f4dfcaab4a432ad311bca8b8ec718f3c5d956f220ab429ac38d9c75b0df5a5e5e1f725ebca6a3d3f73fe7f
-
Filesize
10.5MB
MD58515782482e1c634af1139b40d4e8bd9
SHA152b517f42f11821037186a6c77d1fe5053da4630
SHA256ec5136b74586bdfc8065e391298a27354f2f9ab2e7ffe1a8111895ca2b6ecb8b
SHA5127f2d799545c5a0bd208d294331f29ac50922b0588b5d82177d7ea199a1263c2fe7b164acb42f1ee2b6513ae34e2b0042b9b64d015ecdbf9e7840d59e52890011
-
Filesize
7.3MB
MD540c0b9cb23085c076156a08f11c393b0
SHA1e082e04c5311b6b13078a1860e00c3bc1746307d
SHA2564e7a4d28634937887f4746d3e1faf59aedefaf24c4f2240730d98b919d9af5a7
SHA512cb5889752988d0bf334bd4ebb8fdeb19b36eef0d073bbd46d19690c5605b297937806327760740ddd8c7a824189b47554d45600c010bdbe4f21fcb7b6f377b4a
-
Filesize
14.1MB
MD57b712611068e6f2aa7f43d981f6acce3
SHA1ee35af7a4f33df5ac98c7c165ce6cdfef654ea49
SHA2567992b4a58bc20ca2bcc0b14aec4958475e0617cc7dcd6b73c2848d8db89cf912
SHA51279c117508580e74789242f05f9aa5d5cf8d8ffae376bab51fb20c0d0c2d358852987c8d6f3eea7c9ee53e43d54342fff4fa4f1d34ee0e095210f3e9af13f2ff7
-
Filesize
7.7MB
MD5f008f1f2ef564dd6c2917e413cd8a3ca
SHA150404ec417dd06e9c33d82d3156af75e166b62d6
SHA256d60403f71b9685184dd0d247f995e6942ba911634c71e53065be8947efd58e18
SHA5120a1126cc7e6db81bc999a7647064408f028cf5bd6a87029c0a2855e7e59a94aab35e951f842d069cbed7dae68c069035e364cecf30168c1e64d3441d8a262e42
-
Filesize
1.8MB
MD515250c3fa3bc6a798508b006dac9a8af
SHA1685defbabcba52bb946640fbfed471ca89e0c785
SHA25607a4d88bae28d2cb85f5b90095817bce34440989ecd11e88671ddaba4cbdc9b6
SHA512e31675e888267307f7bdd61cfe79a8a3aaae7ecfb7bf636127fc7a7b5df9a540c34f6a843642fd44dc8fa2a441b3032d4d619a081c3291e083db883be08e86e7
-
Filesize
1.3MB
MD5e04f03b66583d04bca8b82f2790dcff3
SHA1fa0f6197b26dfa2ac880473ddeba424226eafb24
SHA256239713f1edee68e0c2697f3998c4125a20d075e34d17dfbb68495275a5dfcd3e
SHA512ebacbe281eab9b80522b7bc334ad3e0a865cd524501e0c4a0c93c6e15273204a3ac494531bc85e0a39774b037f29060637252b4bca93d1c8248689ee884f7605
-
Filesize
16.7MB
MD5f6a4305d1893ad8ece23ac2d287b6d65
SHA172cd1a57241bfc08546663f77c01c3a8ee7f25dd
SHA256ef91f18abf8e2b256451aeb24181d692f0c16b3e4e6d145a54b9055850d16874
SHA51228bc73ad86b5cbf019b548b91e6ec0e4f8a094e434fdd1b4d7a1289a4fc1cff41cf56935a239fcb43d81fa69a76c1756196dadcef9c385c5f3fa2957f900b45a
-
Filesize
788KB
MD52f6895a21979aabc8faca7e5365ec378
SHA11144e833f89c9bd2e441df459c1f48d433d446f1
SHA256ac8849f6a76771cf858c3d545b9ad95fe776999f17395d8b1c6476bc182c2c33
SHA512ddff8ec9fb4bdeecd4b6a49ccab752c48bd0933301887a7052c245aeb663bccc4c15e2fb01aaf4ce9411f36baeb580fb256b01e1d27b86d7c71f81a8462746b6
-
Filesize
3.9MB
MD51df51f754019d76935c3f6c3425b26da
SHA1e64dc186d9b00aac3e13e773e088293f2088aca0
SHA256f4a5918dd75e113f86a8b891b88f31073c96e2b41082f9d7b2af0437bd30b082
SHA512c951e5be95163f45868000047a2c83e5d7c7c258bf6488f629031741d1ef586816b487669a3252d0fb5fedc9e489386011068944f8f0b19fa1224e8201dbada7
-
Filesize
1.8MB
MD55bd2056ff2ecbe4610a2ed8f0dd9b5a3
SHA179427e6ec65ed82f2b94fb1a6235ce1c867a35e5
SHA25610b854e6c15b9a5b133545bdb12e1be93fa4249b69e5f344df1dc0b50ad4e5f8
SHA512b977c3b3e85e5e8be1644cd4ce7b7408e50089cf6d5adfc4c1f8c642369d8ec39cbf1ef840e001c0656ca9741dd4abe3e9a917a185db30e108fff89060cf354b
-
Filesize
150KB
MD5f7952207922f569445f098db22cccd51
SHA15c6cef71e3c1bd0ebf5b9562ef748412f1e61271
SHA256611c96b3e15740e6beefd8f242d6b0e0bdc2ffa181ff7e995659d9db4488f7c3
SHA512ab66a38a50d42489ffd0c20df1aef94335bea668dbffc4835b5092de38fb6fc1c31b2f6fa8fa1611ddf87f766ef2e88d550b84e792351b925cce7bd574d41bec
-
Filesize
44KB
MD5ade9597aa0eadfcbc90cbf20e338cead
SHA1a9c35cf1e17a643d85eb7c59755f15e44923f1e9
SHA2568c4ad943db8bf880007cfe7faada934d2ca46958adb76ef2bf585b11a130a920
SHA512238061f17c5c93951b3b4f80bbce8f79138696e10d8fd2d23aa0996e28297994a30eec200726f505e14d9c723a5900bf8d238477251803350842807e51934e00
-
Filesize
48KB
MD5c7faeee920d15b64e2299c65d1d264da
SHA18757cac8e1c6fbf4be39ffef1182f18780d0ab34
SHA2561765060d81609199d061de5dddaf9f4e9bb47426021f8b8ba2e64d9b1ed1081f
SHA512ee419152eb141eda934e6b48256d5963939441b85e061345cd1e8efe2151b0240f0faa7847c1b8db14f0459a458e63b22f942eac2f7f3dc680c277e7b64a5320
-
Filesize
50KB
MD5c27bf1183f67228e5e2d26208f3d3821
SHA1e9f86b64bee0bd812bba9d089ebb1c677f2bfe13
SHA2564e87d6f1077979d56b0f1c9039a01321b07ec3bedae7f0ec3d1f11f84d77cfc1
SHA5129d840d7562d68b34c6038f6e29aecdf8713650b9fc095154d43984450741fd6fa82f2f801f653745fd4dca56533ccf1602792290030106c0005f53424a92ce37
-
Filesize
48KB
MD5c9245a5ca0ed25295723d925e79f7c0d
SHA1429e9ba0ed1f8ee7c9ef4e996a099c646a008ed5
SHA256c271339230773d86edff19ccb2190ed58a2d594feefa7a7a8224584f4ac73440
SHA5124afac281ce2c8ac25bf69227eec5ec9d7b939d6294f98227bfae3a26ac987f1ffbe5344a4f2382fe4cf846369b8782783341c71244fc6f7264519f8430b3a384
-
Filesize
680KB
MD575e1b6e91e24ba8a7f350931172851c5
SHA1f78969c013d9e939c14843075361d02135462b85
SHA256c2688a91c1699952b3a80fa07b81dbec2493ce97c01fd3740645cfd304ba92bc
SHA5124f1dfa0dc4963f71e43a2620921dbb9bf1bb6fdf6dfe7384af5abb9ef7b576e754519e8644413f332689954a0c1d80d37a296127608382f8668a6595f78af6f7
-
Filesize
46KB
MD54fd5bf6d1d1df9f737047cfe49cc23a8
SHA18d13dafc47ec2e4f87a96d115e191777354fcccf
SHA256506e6c3308554cdd4eba74d148e1e4079405f5bbffef765e05ba32e377aa5d0b
SHA51265164d978e54ba1bf58d4998b87a4399ed437f35e00106735f4b823548771c28d722999f0c7adfcf8d8fc267952aedd00f37e61ab287a278fbd0b31955d5d3a5
-
Filesize
52KB
MD5b779c3077fa46207f67503aa84c99df2
SHA1ab73b251a2cbbe79bdc0b843dded5fce1e533afc
SHA256e87ecc0dae2f619b82c4c141ad571e448de2cf342d28864b1b283d06275ffa3a
SHA512fae5d6db4af8e551206a31b65b5328a92d39d24425449eeb18248fcfcba5278884418ab842121d54463772535e044c790c4add99098e3fbff0f7603ea92dec3e
-
Filesize
627KB
MD551f569b391ba09cd6c048b8f050f16e2
SHA151bd10daa84250669d427961f7d0ab8de6ea45a9
SHA25640f95b6afb58087178df961f32576aeea93cdfc5723daa8c0df428a7234224f5
SHA5121fced87cc90a1e34d64334e929ec994cad405ec969fea5e513e094d6035369436f217ab0870d25ff963dbe48f5a5d1ca60ce7abf1103733746f96a86ce203b9c
-
Filesize
559KB
MD5a51cfe92649dd55f78ab32f404a75549
SHA1e55c0d3c1015e59c1164eef4c43df87b213f293d
SHA2561aea674bb3f7818531e45e65ddfe26aa5785da03aa86eac385ec9cecca8bf244
SHA51283d48be3b071e826c238d649179f4854549ed4e1fa0d63cead235178c3c07f9475cf1ed00f35961b880863e26133e7da05dbf84835b95c56f42af17bf49ee771
-
Filesize
552KB
MD552592fc3ad320b31b50df44ecc29ef92
SHA109b37725904ae4db2acfc141dc454c7c4693ac86
SHA256331fed2587e23bc12c1cc6f6a67d9da11663667228a52512b41f3a077fb556b4
SHA512e14174ddad90e8bf7492dc40f851d10d7783b3f885082daf00f97057cb57df7d3088f3bf2a8b29f24abd31a6af48c92e2762751fbd5dc27db0ba63d05b1ac806
-
Filesize
685KB
MD5b59a93187ee5ca0c25bad24af7be0500
SHA1dbc2fcbf279c727eef856bdc94cb4813073565fb
SHA2566c6329f218f6bccccf7f6981f49a421015dbb1378700701f27eb853b9be7a85f
SHA51296af2def5cab62ee561178d5907825743f2c58d52ae0b4dc21e1b8876a81207662c50b38a0abfdbf797bbaaf9cd244496c636bcb2ada5284de76602cf3e4455a
-
Filesize
232KB
MD50f3b10ad2344bf9877eb1dd238bca3a9
SHA12883cb8766b59c610573d878149e21508294039b
SHA256399f9450b5ecfe9136f68c6ef34100eedc11536124b9c7f1451b0df7fd7edb4f
SHA5129dc42efeb45fc4809122e9b0b629144348e642b4033961c5b9f5705cdf20f2306515a50b3695394a1e0ca441b9b0275bfd3852baddd7fb5b72d0025c53e72132
-
Filesize
52KB
MD5498c78592c89a72f45d797ba8f7f8929
SHA1afabdf0e4b625d48bb637b6d4f80979b7e217ab4
SHA256ddc8a0de3f99a515ccf9829c907d8296680a687ea8bf3a762849a3c0109e7685
SHA5126fa5b2ecba205921a08d868552391e49eff0a295a6d28f5b95afe213b15b3009f03ea47f0206361002ab5c5f882729ac54f1dc0c11ff89e50184012a65e8c527
-
Filesize
48KB
MD5e55210f8d363a70edcd183151b717150
SHA1324da08663c4558923e34ab0f5bd504c84935bfa
SHA2567e0a149786171a9b264a48420112d2393c37da63e50b0d097288a36d5e178f9f
SHA512c2cc605b5a727468e537d1c107e6e599779f72a231e0f80bbe9bf04838b407e3bbc872b1344a817f18f1d26aee1f3b7be6c2b5e493e7d871d0cd93549cde5817
-
Filesize
46KB
MD578eb4067f7a074fb68dbab3711eda751
SHA113968c74d7ba39b2f333055bca555efb8a740fb5
SHA256cfdaba0c9fc049b5b0f8254d6ed3afef4ebfd6faf7337109cfa387dcefe3d77c
SHA5120822a8b0199ddc108242d281f8b57af7e29790fd1ff8387ddcda222dcd7dbe5feeef5e3bf8d9b48f2ff284dd8f660dddb79233669b416e2aece819ca281fb998
-
Filesize
49KB
MD557d8173595bdf85dd85454c5bb182a11
SHA118f5ca41c02dc7d95b70aee05b8340cb88666970
SHA2561c9a00bafd9f3e02ea028f93313de28427f8c68fc444cf88f84979b2c562811e
SHA512c3f35cf8e1b4828ffdc563d09d69642ccd322c6c8a37edb46578dd0bc65ac7b606944bc3f36ded4f4e77ca003558fc39e6b63817c24b2c6e1095ad8ad05302cf
-
Filesize
45KB
MD5b2194e9780f3f2004e5c10e330f1cb57
SHA17d2cd68ebf9da33366d54b4e7173a636a6bcfc48
SHA25648002c3a7fcba159b09997a4ea1f3dffba21821ce9f46ab437a41bbf72a2fdc7
SHA5121842d913cafc88dbcff448babd00c1fe107bde78b08d429f5a9f2d0bd5c0c2d77013b2c29eee8789b20c70d03ef977c12f7741734f2b66efb5f2ac7a8180af9d
-
Filesize
45KB
MD59671984104a0c857bf56a303aec142c0
SHA1a414c5af094936c38312fe1eaddddbed51ba9bb9
SHA25623b8cc1e22f8a473123de0b91312ee77c9e3e033fcba91912b4cb08588b15c17
SHA5123e21a2b683c83e4ba64f1ff5a72a036e4263e88b9b35eebe0a8035dbed451423365bbc00b5afcfc9a8af4c20c60a7cc560a6808afbf36299f465d05ef91d7ce0