Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 12:53
Behavioral task
behavioral1
Sample
a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe
-
Size
131KB
-
MD5
a41dcc8ddf3eecc2bdc222055ca4c350
-
SHA1
8d46f66c4eba374f3b10fc8034a74cbc197b19cc
-
SHA256
4825b8b49320c44f1a81d05c9565c619a4d0c6771bed96ddbcd31576b9890ac9
-
SHA512
0e97f43f8afcb74c3c5533b2cebb881499688d88df7408e18b0d61cde7eb13d2cc4b18e550c6c2e3e699b4e02943d12a31ba7d92b03141d818682bb83311d6d0
-
SSDEEP
1536:67Zf/FAxTWY1++PJHJXA/OsIZISWh7SWhk7Zf/FAxTWY1++PJHJXA/OsIZISWh7l:+nyi/SWh7SWhknyi/SWh7SWhl
Malware Config
Signatures
-
Renames multiple (4375) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 2352 _MS.OIS.12.1033.hxn.exe 2532 Zombie.exe -
Loads dropped DLL 4 IoCs
pid Process 2244 a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe 2244 a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe 2244 a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe 2244 a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/2244-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0039000000015d56-5.dat upx behavioral1/memory/2352-15-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000c000000013a06-14.dat upx behavioral1/files/0x0007000000015d93-18.dat upx behavioral1/files/0x0007000000015e32-31.dat upx behavioral1/files/0x0005000000003d59-33.dat upx behavioral1/files/0x0012000000010455-41.dat upx behavioral1/files/0x0015000000010335-42.dat upx behavioral1/files/0x0015000000010335-45.dat upx behavioral1/files/0x005e00000001031e-46.dat upx behavioral1/files/0x0022000000010676-54.dat upx behavioral1/files/0x0003000000010680-58.dat upx behavioral1/files/0x000300000001067f-70.dat upx behavioral1/files/0x00020000000103c0-71.dat upx behavioral1/files/0x00020000000103b6-78.dat upx behavioral1/files/0x00020000000103e9-82.dat upx behavioral1/files/0x000200000001031a-86.dat upx behavioral1/files/0x0002000000010319-90.dat upx behavioral1/files/0x000300000001031a-94.dat upx behavioral1/files/0x00020000000103b2-101.dat upx behavioral1/files/0x000200000001059e-108.dat upx behavioral1/files/0x0002000000010408-116.dat upx behavioral1/files/0x0002000000010402-123.dat upx behavioral1/files/0x003600000001031d-127.dat upx behavioral1/files/0x0004000000010408-133.dat upx behavioral1/files/0x000200000001042c-137.dat upx behavioral1/files/0x0002000000010444-144.dat upx behavioral1/files/0x0002000000010445-143.dat upx behavioral1/files/0x0002000000010444-147.dat upx behavioral1/files/0x0003000000010445-150.dat upx behavioral1/files/0x0003000000010453-154.dat upx behavioral1/files/0x0003000000010446-158.dat upx behavioral1/files/0x0002000000010442-166.dat upx behavioral1/files/0x0003000000010442-172.dat upx behavioral1/files/0x0003000000010442-175.dat upx behavioral1/files/0x0002000000010449-176.dat upx behavioral1/files/0x0003000000010454-180.dat upx behavioral1/files/0x0003000000010456-184.dat upx behavioral1/files/0x0004000000010454-191.dat upx behavioral1/files/0x0004000000010456-192.dat upx behavioral1/files/0x0002000000010459-196.dat upx behavioral1/files/0x00020000000103f6-209.dat upx behavioral1/files/0x00020000000103ed-213.dat upx behavioral1/files/0x0002000000010311-221.dat upx behavioral1/files/0x00030000000103ed-225.dat upx behavioral1/files/0x000200000001030b-229.dat upx behavioral1/files/0x000200000001030d-233.dat upx behavioral1/files/0x0002000000010313-239.dat upx behavioral1/files/0x000200000001030f-243.dat upx behavioral1/files/0x000200000001030a-247.dat upx behavioral1/files/0x0002000000010308-253.dat upx behavioral1/memory/2244-295-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar.tmp _MS.OIS.12.1033.hxn.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml.exe.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\Phoenix.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac.exe.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\SpiderSolitaire.exe.mui.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png.exe.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\gadget.xml.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\gadget.xml.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp _MS.OIS.12.1033.hxn.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Norfolk.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Windows Media Player\wmpenc.exe.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_h.png.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\ClearComplete.dib.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui.tmp Zombie.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\AcroRead.msi.tmp Zombie.exe File created C:\Program Files\Common Files\System\wab32res.dll.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_ja.jar.exe.tmp Zombie.exe File created C:\Program Files\Windows Journal\fr-FR\NBMapTIP.dll.mui.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp Zombie.exe File created C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\ja-JP\Sidebar.exe.mui.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Java\jre7\lib\zi\America\Belize.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_livehttp_plugin.dll.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp Zombie.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\RSSFeeds.css.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html.tmp Zombie.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_ja.jar.exe.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\time-span-16.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd.tmp Zombie.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.tmp _MS.OIS.12.1033.hxn.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-full.png.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp _MS.OIS.12.1033.hxn.exe File created C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp Zombie.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2352 2244 a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe 28 PID 2244 wrote to memory of 2352 2244 a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe 28 PID 2244 wrote to memory of 2352 2244 a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe 28 PID 2244 wrote to memory of 2352 2244 a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe 28 PID 2244 wrote to memory of 2532 2244 a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe 29 PID 2244 wrote to memory of 2532 2244 a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe 29 PID 2244 wrote to memory of 2532 2244 a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe 29 PID 2244 wrote to memory of 2532 2244 a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a41dcc8ddf3eecc2bdc222055ca4c350_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\_MS.OIS.12.1033.hxn.exe"_MS.OIS.12.1033.hxn.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2352
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2532
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
131KB
MD5041d1f75f7b053f94df60a1a4244591f
SHA1d5e371539585819db5cbb2b07742394c866e840c
SHA25615ec22d5a9625f5e27b2e2291c7c6bdd450676eaf9e3e927fbbf1d56d96c153d
SHA512c06fb5496af7601f6a8ab4b38f0998e5edf7c48228964f8cdf6861fb44eb0e1223316b3f22fc43e640e483715e67963b6f6fbf81a85b4a9d50347bc04cb4cb52
-
Filesize
66KB
MD5a63acc51b816e065aedd162e1a2af7f2
SHA132b0f56d7a7c7def878fc6ebd0f39bb4fcbe4be0
SHA2566f7f62e3cd1ffb29ed306668168691208fa9ef94af76439d4befeabfbf925863
SHA512b36ca36f5159b3bb7eaa5fcd7ae304f012b91bbd60a9bdb180886583696734c57873acd562b2107a1de6161a8320f8867ab477b0377959a2955445ebce665409
-
Filesize
9.4MB
MD5449da6e5eabc400398d54ed9fc5ec9ae
SHA1e59ce1e539055c056a28c5ea4f682a0cfc869a3c
SHA256f29ac5c64aa170df9fbefa638d3a558e746e65c8edb78e01f10dcae70329760a
SHA51294abe0345dd2095e06b6b77979461656d5b89d678eb220d2dbeca8932a70ef719fe9e3fcdadc0f226f44327fbad0c6c96da5ad9d3d3ed98aa5b9e751371d47f7
-
Filesize
2.9MB
MD577e801238e857264f030e063747a8970
SHA1d9e2baf02488cf13c129041b660f9eaee5a030c2
SHA256a42eeafd177c3c71cc4204218a65dcb03821dff36fd4e8a2c77f1c803e02cc83
SHA512a31299c2ff8cf3e41378f2aced4f2b799165a604f7c0d3367fee14fc6a6352d70e332df2194f13a20f0d326f38007980d5ab9854cefaac02836e8f2cb4759841
-
Filesize
84KB
MD54c4f1a3a97e7e4a5cf0030da30b82186
SHA1eb88d107427a22585887696e632a9be5bbc552a1
SHA256bdea5d0e9efd3e22fb8810b5c2ddc8d06874767974a29809acea78c4fd5292ea
SHA51247c69cae846b53be2bfe60767b2a6a22e90b3b581e047bb98f5cfd747536a557f053b35e83b74b9c520e5c6622fa67f3863f0c118699c70e1c20ac4f737ed3f9
-
Filesize
68KB
MD5c13e277821e75f87739bb499fbe84555
SHA1548e6dd64ea96cda14f6000f427ce799fa68f653
SHA256438163818441b13b19449cc08631ef26a9f43fd46fe1668c59d56d8b792b43ea
SHA512a755850a1bbe80959299f48106cb8b0bc819fe5ff6c2294774c2a0ff1f618ebe1b119dfcb8ce174cc17100469be2ff242fcef6c0de87b5951c610cc5be15d199
-
Filesize
212KB
MD5b51a84b222fa918653a69a2e9ab7fdc7
SHA1c923efe6830f39c4922ca8502e14da636b138613
SHA256ccdeb43ad7fbe5c0ddae28c05ac0636a52f9def8fbb9158358a578a519132ddc
SHA512cee2b1f66da9610906a7a21be9fc165289dc5e1a21183505edd676435585bbcb618b883f86a0db81e04e9a730610973073d390eaee9daf36dfff0b8eebb625fd
-
Filesize
2.3MB
MD541eca2b5a7ed0c14ea0b75aaf36dc3bf
SHA154adaba1ed6e4640f5a1bd38c095bf33d7542485
SHA256e0488935450ed5c3c5c581f671de0f344312c0e6132b213887dd9e0d7c536b42
SHA512024d23140260a6653ee15658250744357f60b93d6ff4c8df669ae8cf2908853141b8263fa32b4b8f76e5828bd78796ce267177e3d8109e5d85647274d8579551
-
Filesize
5.6MB
MD56b5b3df2f35e67ff29a7c27bc0f56cda
SHA1744d1f2da553ed5af11300f6df25bba18b43e240
SHA25634b29415bacb1b06b445fbeda38e0cbc50d13e696dd09c58809d6810c128d5f6
SHA512a8a3ca6c93f5a88d12b7bfbc81f3ee1ce05f7d3adaed526fde1a232daabecff7f1bfd55b9fbf9cd0b3a7f959d653ee4fc664dda9826c400e413b05dac71ab818
-
Filesize
64KB
MD5f5bb600f4b131cb0cc7f37074648c267
SHA194c3a38fd2fd7587dece4be771e421885f9f3d06
SHA2561f073425cf9886ee83c78662709747e382aba9d84a4ab2848633b3cc65a376b6
SHA512547923bef0951644ff5079a5a737822e1f1b0af180ffa7b2084b4b20252cfc998e5dde18f7fc35faf6e784834a45edf47e816b347d1de74b73098c0767382407
-
Filesize
16.2MB
MD547e1ea91ec0d60abe202127dc3a1fbac
SHA101d095fba455f68104bb573b9fbf256dae6941e2
SHA2564cc208597a0d64f774d50b4e4275f39e21aa1b5e61c3f36c05a7af93cd1d2589
SHA512be1fc78d4830f53b98aa48a1f5e8bc33e78fe38002fb789485fe66e4e3571417595735cacf8e5a8635ea4fb65731cdd447a5d437b9143a2465e28eb2bfbec2fd
-
Filesize
228KB
MD510b2a889e97eee3a3c690056294d4dc6
SHA14e2e621e3d0f974084dcc86bdc95a178123a9295
SHA2561ab28e55d7ba99d86175ac685caa7e4230371d9377e79e1a699bb48f2af40db1
SHA5123acd6b877eac76d6f0cc9d793a6c8451566df8bb98ac3a88ab3f29fae60b348e8b99e00dbe3cb0a208140ab3d42d77277ada883f66c00e2a320bcd10a58de540
-
Filesize
69KB
MD5c1531d06912cd88a3c8d7c9b05cbff5b
SHA1b4785832d26fdf2f401e972bcf4073f3a755159c
SHA256c5b217ba5961da6fe09d2c5360ac755bd5dad80165d477e66e0285e036b0d0b5
SHA512f2cd12a8ee72a9246ba87bca652c006b897cafabcfd1601553c2d3d6e3d2ad92355dce42009f61e49fe4d2c9ddfa502584efe183b6b65ed0c2f62fd73c208ef3
-
Filesize
64KB
MD53bd1dff49329bc67da1955549cf77c28
SHA13ff7946c877f7c515e088e8a99f11004403eda00
SHA2564eb0899b3a7b1881e1cbb1b0af42b9867afd3aa159e3595b44894c56d13b35c4
SHA5120e609c787532f87d7a6ea3858fa28bff2618477d8b75bf228a237914d9867c4ebda52601a57bedadb1d5aaad03ff9465ec386a67ed8f575cf29bedff5a310db7
-
Filesize
68KB
MD5e37b1214ee354dfb7565ed5fafc4827b
SHA1d62055187fe3b979b76b5777bb5456ad581ba0a2
SHA25631611e4e3eead0607fae5766ba7ad9e48ad2e525b54fea0195c84eb20c90064b
SHA512b534efd94eec39d8fd333c2445eb23199442c309fa1af243d7499504cc131361ee9a876310e17ffb50a6aedf8beb7a1fec37b3224a911ed52603ea5b5d32ff8b
-
Filesize
69KB
MD51c5d35caf2c626e0b49789572bd62e05
SHA1c4b74cd87f440da72c82d239ede65acd098f6f59
SHA256a511bd1f20359e8b94061769221b1a70a535cf6aa64ed773143381ed8b14d23f
SHA5122251356891abe94741188490f557945b15c3faef6d9c8ee7a4e25c45fa7683c630b947de2600bd27f8a54b8b8beee7d6a4a2e13f2fc7fce6b4b61a7fdb09b361
-
Filesize
72KB
MD54f2593c921b8180ad1e66fc9d7b96def
SHA1bc188c8a7a76776a42c5d0f9fb1971720b83eb66
SHA256e8a4c4d17994d2082dc23987932869e97f146d1a815a2e9bd0a208cb6aed6f2f
SHA5122e2590cd67fb805d3530a94fe3fbba5fbb485be734f345c10665edb9085e4238e164312a1691d572604b85759a135dbf52c814e18650971c8ad2b5cb52a255be
-
Filesize
68KB
MD573db5772362accee9dc73693ba38a02e
SHA1d9234e5e72f48966711f5d07087dcb4023c8d878
SHA25649c0677e8ac1b236c87315e08a5b2aa1823f535c8593187e61b4ea0e754bc7b9
SHA5122ebf6b1ffd46c49b2acb69da37213f7c8f4f5720f28039464e6d8d77f1898252d2516d087b14094f992d95f176551e973472d381b735b44c7ba3412b6509e662
-
Filesize
64KB
MD5ce7d6e885d87c05637087aca976f6c38
SHA19718ab01e47779c2929d1f98a4962054e24b088a
SHA256d564208541ebd6919eebf251f78558b10ba8a6f35eceab23fa8f13069547f37a
SHA512f41df210f6ceb0baf98d54834ffdf87bc1ddadcf4f0bb8f09086f2a9b35215fc5b2ace8e20accea7fdcf1a057dbb8181418542e78416ec0c590084262dc7dc95
-
Filesize
71KB
MD5cda2d16645de438c51865062a7b2d224
SHA18963b6e19b34c7850be45d4c7691081db02e2b68
SHA25648213feaba94dd66d0543202807896f437451df13ae571f55f2678f54040cd21
SHA512db21fe4c06806db2c2b8009223360495d25278b8aed144f1573ec8c9f5b3ceb4c03c245f0dfb77c8cff4e523e909011f925a5ed57648d6108b91465df73fbb4c
-
Filesize
74KB
MD5bed047ecca727a430ab7e89d249be5ea
SHA1994598cb34f5b9dd87e8f2361947f44c9bb5ed29
SHA2562547ce57ecb5ef1d910972f5d164ac33d81ba82ff4da91b7efed241b7d12b202
SHA512f477d5f880e2cc9e174bdd90f81f36ac8584453f8e732222a01111d0f2e39b244a8257be57ba9f0cc4044daf6ae61f1aec2540bbe26b502bcd186b8ce9a2594a
-
Filesize
1.1MB
MD5a00383ac149f8fd540ed44529d28e725
SHA126dc209de9dea2a1ce7fae2feb77b9809a18997d
SHA2565b997d5145936296996ad0e13c73f7dc500d50958e8560c5af47c898c737b0f8
SHA512e94ae37aa2ec13f6c2803ffd6e3d9ceae94f63bed238f55d7f336d61f144d8d47003fd5cedc3c37aa2ce16e2e0019aef51b39c515a0b45a299e14f8b8c9cbcb7
-
Filesize
1.7MB
MD5d63013cabf98a2b675336acad91f2c3e
SHA1c2d4a63300106ed36ef43f41c9d9eda50281a8a5
SHA256052fa2deb0ddfc719c082a24410e6c14b7a81be66c2bc02b5f4577f37a195759
SHA512d8ce9b19c77a0fff4e553dfd2420a212ef0da869d7afc53c1b69640113e7b974f920bf01772b4fb4fed3a7394f98d0e0de234e28fbb0a06e2160cd4973cb28f6
-
Filesize
707KB
MD50607b2b97f32e0c087c05436ff76044f
SHA158cf6d70ed5949fbde14d35f1fae9dbc1ef7e49b
SHA256d545b4638d760e229e1fb9f836b795ee1ba209c8a92471f9f3a243f3cecfbb08
SHA51203e87758c2e1d61ed5bba6a26840457a1a407ee3edffb15fe414123793697b78b7ca240a2057aed9da70519fa03208479c7a0eca11a7206cbef4fa18a7062f2b
-
Filesize
68KB
MD525055120ba5896a6bfccd9f39b255362
SHA1e8abb3baee40ad6dc73419ada2bedde5ef6eb5e1
SHA2561f3ebe4e7467becb172e306ec81ca5372b811fc25cdb2e6447cf3cac7c6cfad8
SHA51243a4489871e97f7cd5f96ff55fb252c3b86e4d6532f02893d780803285104039c1a6dead8c6151f7fe1fa2612b98a17138b3bf432de9e6e0b8e9c38e0f5b18c5
-
Filesize
3.1MB
MD5169f8b1f0dbeda9fb4bda38511fa2ad9
SHA16430fd31d0ce6dd5b024ce589ef84ce69f484c45
SHA2569772a7781259399e2f2b559c4122d5f320615dfc64f85f7cec4b3583d398f21f
SHA51299762a59dea5812f048584cac9626725073c55a7a4b714e5d3eb27e8c295867580532a2987a7688c78d38d25248130d783182eaf4bb8f11529f6e3df585fac63
-
Filesize
12.6MB
MD5387adfd78098f355560ce2749f4995d8
SHA16a59b18f3f5ea7aaf73c728471a73f775a74290f
SHA256c8aff08acd19488e8bf807cd75314fba527aba3b0a3f49f3247a8aa3e3ced841
SHA51213e442a3675417ec21f97a4a4597a60660a58ef6388d78db27d6bceeab672102f940b6acc22d175c671fdf1c50ed0fe731dacfd547f6ae4cb9cf4cab0e2cebe3
-
Filesize
713KB
MD5d2e86d899e4ee3be17bdf22e49063ca1
SHA1e27e88ce6498f6ae3e364bf977710bcc91c7a0e9
SHA25638c67f5d2b46e79f03b505d19844ade7875d8bef9ba42332f1d17c1e4c06502e
SHA51274e63e731e88b7647f8571a73d0d1ce46f753049f1e0c0ffc6f30441cc75211dc5cb67d548895212f00528463dd5fb21ee3834e08a3dc003415a825dd95d772a
-
Filesize
64KB
MD554f3c74d10b01a53c90d727a870d0935
SHA1320bd92215c2eab915677c4182f00b75e706ea1e
SHA256fa16999e33e80927abf9c411c44a95da5b10b9f59428aa46ee5c74a0d65cd3c4
SHA512f43e675064721fb3798f2eb061f8dc77a20dd4dd3c48be6d297861855c26568368b8ec8318b5e6240fd97fea5e1a303fdfe7378d5e8c236908fc34246f1ce0b8
-
Filesize
717KB
MD5ed77a1be424ab8866fb9eabc01c3e631
SHA19c30d193f2ec1f0763d3e683e0501f9a2aae3c4b
SHA256a550487db564fb52a4456a5ec550607a1816f6348c0094d63bff1923dbcbc721
SHA512e72f6dacb0015253639704d66b03d00f5dd86b7d0d08f3bfd62609362cf3790b1bb9a5ef811afc8a110eaf6cf5c4df7df0f1d2955155269c05c27a7d339c271d
-
Filesize
67KB
MD517d9d5bab30a9151d3442567b1d027a7
SHA19539baaf931bac98f4a0ba6f42afab53d189f301
SHA256f26aa882db7a04595ec19738141f5781ad4e6de8e5fd590e4e8907c6296cea2d
SHA512a44a757095c360a5addd548f5c75714d33cb2955d6e1715026cc5980ecc53362f95d9764c685cd36dbd10edb5b7987af754cfbbafd3c116778fc3fe2da4b2525
-
Filesize
6.0MB
MD5409a50f34bb23faaa6b1988baa629a79
SHA1b02addb2438286c15091d5137db382b63720bf47
SHA256a61e32de4cc415f9c9002211e2b7ac340d07fa4e90cbb23fb1f2fde99effa16b
SHA5129db017a0605ddc54b0120eb8de34ef957960e44f90cdfed96a4ef096807eb0b99e88900ce35c69d5c2f347bede2b1b9bf2602cf5e3bb64e5e7e336928833a50a
-
Filesize
15.0MB
MD50b4a47233183c8f01f1a551f3b7ef440
SHA1aec5ecefd261cda3c34364b66a9d4e541b6e984f
SHA2567d65a9cdd92ef8b9bbf9a05ac292a118f7f78acb7efcd9f6a07dfd1eeca7c895
SHA512d840c35d16f64dadfc074c6d227512ff843ff9da4fec907a1b1e6bffb34e96cd563cdc799300b8577e1af5fbff5b5f20c648e148594c4964d59f4bc0b86b5217
-
Filesize
72KB
MD5582f122e5b18ffe3f127784d655f87e3
SHA10de2802529c0c172de25404dbd664b56a201658c
SHA25601253efdd8e3a71acd810a1875f8f941404177fe038522479a135769be91dfbc
SHA512dc2c44c3cbb771db071cddeb4666541e8a7f6c59fd83f30d61483e251184a84174c8363b8d2e1686940f224519afa1174e1738982a53fefb922e823bfb245c37
-
Filesize
67KB
MD5ba2ef193b405c844f85aec355960188e
SHA1a59a423760d1efd72b4db38086055deb403a68f7
SHA2560cfc17d10c9c286359ba364fa6e69ce98cf9d3173afb33465685718d9da6e6b2
SHA512d6283506b7b8d45b3d5fe790f00fdb725d4c0a9b5b23afde944d14d60550c7ce0351f3db0fc7ef1e49502b2d7897a671bc8bafc45c07484fda5bc5e0711df1c3
-
Filesize
69KB
MD5dfe1678582b9d431503b5377729e69b9
SHA1cc8c4f9719e738d8dca568b7e8b1c4426a3dd849
SHA25618e9f5ee87906db78b15e68a7270553ea2114f19cccf2ea8b0555459222056ca
SHA512f3f2067fc51df2e3e435dbff05e4a9b27f6543d8294ab86b3bb0edf7e93379d925f1e721c26e7dd0eab31058eb22c840d49710ceedda0cee854245455cef150a
-
Filesize
1.8MB
MD5fccb1ce781e4fbe8857865739ca29dc2
SHA143e16d13803f9d9b335ca1da46b61ec4fa8c121d
SHA25693203aff95ebdfb17e247f7104d14d75ceb6bd71a7155864e6e770832f4982b5
SHA5128a4e0a0a3ec94c840995125a20312f0a6673a34c328018adc483250fc49ff77c0ca248efbb807341164b191d32fb60d6bc4af3bfaa3d4feade8fdb4efce82944
-
Filesize
68KB
MD50e0d5c1d1d2417f39e733370349d3438
SHA1c11820b68599884a26b7b1a5282a690ae44c15c5
SHA25621bc026eecc0a6f549f3fc33ec3bb6de9b545d9a2b04695b7267340dbe5a2d4c
SHA512e2ea78f061b628a59402656354edc709f8abb6a70ef40298c3955aaaed346899e1d9e2628c06a9c173ce3505bb4ed0cb9b417bea17f3b1d11ba4d63295c4abfd
-
Filesize
4.5MB
MD5aab80298a7a10f4926dc8c02e51a0dda
SHA113867404d6598d5d84948ae401b0d1d13582f8be
SHA2564ac801a2671189c9337dbf495673f2d6a39a64e44b7624c7dd440858d3dccc16
SHA5129bac616d6882e99870779e66a05e67b45f99ffa549a137449089d33640cb6f85a91c208f5f637ef701fba0e2732a94550a112dd841f90c42e02164a5cf3a7c13
-
Filesize
1.8MB
MD5bbc33d1baf18a040f33cdff37a225a42
SHA158c4f881272e60c94f340941cbba8a64433a93ea
SHA2560aa1a948d5e319c7ed52a2d9c7ea08deb73ae308b0ef1944b3dc87fb34c68cb4
SHA512b0cfb95dbeadceb921cd99ae7da1511f067dab48be46a82f3f194afe1dd058e693052489d324cd54c8c19555fe73d1db1f4bd112b9caa8c904c5d1efc2b44be9
-
Filesize
68KB
MD521369239a588550f26fa120ca45ceb5c
SHA16035e5ad5218dda4908602002cf7ed764e0fbc43
SHA2560a8e055f02804aa2383e4916b0f86ff945c0d539a68268d426f5d96a515f9f3a
SHA512bb83b05748155f095852cc51cef8ed3fe148e14031f263ee2f76449c30ae26447c45488431e1ce231a0a19c1da043bfb74cb3f5f01bdd5109a14e5e466464439
-
Filesize
885KB
MD579b4165c7bbfe133453b264634049e60
SHA1e38843a864cb5d50154f9db1d610ab74446fe9f7
SHA2561c1235f76c501a0a3ab0a658e5214286cd30e1f2386b608a0355cb31c34e5c25
SHA5129dd76422ca21690f98534b543777d1438ef542c53f71336678c42c2a6b4b5fadaf1667581320a35bad385c6874e9fbb91b6f5064922ef76fa16c5d640fdea06e
-
Filesize
2.4MB
MD523c99d72fee0294970658db6eb7fa456
SHA1633e735038937d633577b4e6fd5b02396cae2a5c
SHA25678834c21424207f310d6f468a833bc665fb15b7a94afd3f4aaf46fe8232f7292
SHA51240dfa8fea0b2d98f914625b6e78a26cd1afc78a76f1298d88b8da594f5de92084d89e8d2cffa40d15af389680e92912312a65df76bf1f880884d1e5a2861a17f
-
Filesize
856KB
MD5ae9e50d7159c4d9d0068086010bdad28
SHA1d86af6f798c1edb45a5aa07bf87a3b332fd52786
SHA256800ebc68aea2b435c5bc82e0c9785bf8c254931a2ad9f3bd4a3e53a328d8c4b5
SHA512b542e72455387b12d24953210a0d7794ee7a5e84f40f316ccfef37a846a828dbc10513fc51b13f0dbc89dfa2ec2bbcbe61a1eb621268a30c385e9492706a7795
-
Filesize
700KB
MD5bf085185d76831a9ad954cc86acd006d
SHA167b968963e012356ab87c4c93174e6b3174841ef
SHA25682443271f358b6ee31971386e5a426f1497513471cedafe4e68c081c74a4d99e
SHA5125e22c50320ac95edcb26acab0b79d4cc1147656968cacf69cd608e4741509f1233962b4b29f06956f46b94be77f768046cfd03369aa530d91dde7f3b5aefbec5
-
Filesize
647KB
MD5f5ea9d68c25a4ffe7ac3c1bc7851c344
SHA1c6008583fcf0de1a5c09706e8ce31a4631d4bdcd
SHA256bc3691588080f4b7ddbc0dbf9709e03a6affdea1d5f28db37711590852ff49bc
SHA51214b5803ca153c21bbe3e4b41605dc374f2b8b1b688ef98484147f7d86d457a24c066f29dc8e1e8412ceca977b2cd852425120a4c434c1f506173fbc1b2adaf00
-
Filesize
580KB
MD5dd882821b7693cc9f6035b1ae4f77b96
SHA12f8ef646a83501be492ecda12da815b175c23d8f
SHA25653e98b33e9f3f2dd6c3e6e2e2f71de84fe94ade8f708512f8ee6ca5fde93bf56
SHA5129797f468a0ca3612cc50e021d203ee2013e01f214525c10522961821a3166629a4dd413a131ba6c4721625b56df52858ce825e33921d995e010dda59b668f804
-
Filesize
572KB
MD53b27141492a5c9576be2fee718a94c0e
SHA13449a4fe32a8c8122452adfd5239ab3d74d390b0
SHA2561bb2b24e31e098f8dccaa084594d0caedc2d0cd960e4988a94c369650401bf65
SHA512cf6cd6ab38ba484c3679c83fb8bc397a1165b7064ceef1af92f81f576bf32660839f1aa72e1e0514d634e5548a1c970db544eaa8bbc630a55361c7317437bad9
-
Filesize
705KB
MD5e1682b6de45c8ed9e82d05c315d564ef
SHA1678d34fd87564bd670cc78364b4ad0d7baf9aea8
SHA256be21c54d197247f7e1a58af6b477a1e6fd14f6f88b50741bf4f03db2d1871c22
SHA512102b29096eceff7027328ce62f294528599902065e78832622d0fb66249a54bedb88f63c45f857a7b1a02a46a84c710ad2bccc75e453918cad3cf3ff0d8b7556
-
Filesize
66KB
MD5d1dd03d04f119d471cb1a17d78553fb8
SHA141935c08c2865ab7723c0dce67098ae5f75779cf
SHA2569d8f35df27dd238cb5a63d9fd474b2075a8e02d6e5eb710be44972e4c7839b1b
SHA512f59d241b6bd140c98ede5a3a4dc1c887347f1b547658688539df544fc72ebf222c8354a3b6282f929d82aac4c427c8f8840b6d65686fc6e80e01b8a067aa523b
-
Filesize
66KB
MD5b30369fea907dba3409a2cdb5af3e92b
SHA130d35dbea6e094073c15819b8c6e889353ada314
SHA2563eb4f593b0a816e30af8f722d672ed28ae3bf0dd5d5fb2968c1ce9eb309f6967
SHA512802269093a11d6a5feb2294f01917b92f24d4a489b80a719a5bb73d2f0abfbcd458f216310ba4a5b8b4e1544d970c39b2a154b5fa5a250ba81d9ec8ea3285176
-
Filesize
65KB
MD570b574287a668e0937aef9f68af0f548
SHA197c40dd9b987fc6317f5a03e8a92d6fd00c17478
SHA2562c20e27cc98ef24db654e3f26491bf90fd263ede681a7c821e4bb5309855f775
SHA5122be39fab9e637aaf42f8fb32362592ab430a249992141db6582bc037d5bf63d1d1c3df33c215ad6e88ecb56f97cdb1b67bf0e8ee455d830b7feb592edc91d4b6