Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 23:06
Behavioral task
behavioral1
Sample
1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe
-
Size
192KB
-
MD5
1e95d3d56141dfcd50e03eb81f0c1e70
-
SHA1
998ed0083b606e02864a56fa29634c773531b215
-
SHA256
57170610adc9ca5811f1b0a04a8847302ade656a1be5a187db0cc776862e7b4d
-
SHA512
bb4f9b419397f6877a7fffd143c59844291f68f95df9be1e177f91e5be9792278431cc7d67fa4a7c3a675f08adbada3a4781fc1b90844d3d3f8e779836ea4d2a
-
SSDEEP
3072:enaym3AIuZAIuyxJrQul5naym3AIuZAIuyxJrQulG:wHm3AIuZAIuyxJrXHm3AIuZAIuyxJr0
Malware Config
Signatures
-
Renames multiple (4540) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 1832 Zombie.exe 2996 _Desktop.ini.exe -
Loads dropped DLL 4 IoCs
pid Process 2256 1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe 2256 1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe 2256 1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe 2256 1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/2256-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000b000000012252-3.dat upx behavioral1/files/0x000d000000012345-6.dat upx behavioral1/memory/1832-22-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0008000000015c93-27.dat upx behavioral1/files/0x00050000000104ad-36.dat upx behavioral1/files/0x00410000000104b6-37.dat upx behavioral1/files/0x0037000000010430-41.dat upx behavioral1/files/0x002400000001061d-49.dat upx behavioral1/files/0x002400000001061d-52.dat upx behavioral1/files/0x000800000001042e-55.dat upx behavioral1/files/0x000600000001072d-61.dat upx behavioral1/files/0x000500000001031d-65.dat upx behavioral1/files/0x0006000000010431-73.dat upx behavioral1/files/0x0002000000010317-77.dat upx behavioral1/files/0x0002000000010316-81.dat upx behavioral1/files/0x0003000000010317-85.dat upx behavioral1/files/0x0004000000010319-91.dat upx behavioral1/files/0x0007000000010431-97.dat upx behavioral1/files/0x0007000000010431-100.dat upx behavioral1/files/0x000200000001043e-101.dat upx behavioral1/files/0x000200000001043e-104.dat upx behavioral1/files/0x000200000001043c-108.dat upx behavioral1/files/0x000200000001043d-107.dat upx behavioral1/files/0x0002000000010442-112.dat upx behavioral1/files/0x0006000000010435-116.dat upx behavioral1/files/0x000300000001043c-120.dat upx behavioral1/files/0x000300000001043d-124.dat upx behavioral1/files/0x000400000001043c-128.dat upx behavioral1/files/0x0006000000010436-142.dat upx behavioral1/files/0x0002000000010450-154.dat upx behavioral1/files/0x000200000001044f-155.dat upx behavioral1/files/0x000300000001044f-159.dat upx behavioral1/files/0x000300000001044f-162.dat upx behavioral1/files/0x0003000000010450-163.dat upx behavioral1/files/0x00030000000104ae-171.dat upx behavioral1/files/0x00020000000104b0-177.dat upx behavioral1/files/0x00020000000104b3-183.dat upx behavioral1/files/0x0002000000010439-195.dat upx behavioral1/files/0x000200000001030e-196.dat upx behavioral1/files/0x0002000000010308-200.dat upx behavioral1/files/0x0002000000010308-203.dat upx behavioral1/files/0x000200000001030a-204.dat upx behavioral1/files/0x000200000001030b-213.dat upx behavioral1/files/0x000200000001030c-217.dat upx behavioral1/files/0x0002000000010305-227.dat upx behavioral1/files/0x0002000000010305-230.dat upx behavioral1/files/0x0002000000010304-231.dat upx behavioral1/files/0x0002000000010303-235.dat upx behavioral1/files/0x0003000000010304-239.dat upx behavioral1/files/0x000200000001030f-247.dat upx behavioral1/memory/2256-261-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0003000000010310-262.dat upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.exe.tmp _Desktop.ini.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\service.js.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar.tmp Zombie.exe File created C:\Program Files\DisableMeasure.midi.tmp Zombie.exe File created C:\Program Files\Windows Mail\wab.exe.tmp _Desktop.ini.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.jpg.tmp Zombie.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp.tmp _Desktop.ini.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp _Desktop.ini.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png.tmp _Desktop.ini.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Grand_Turk.tmp _Desktop.ini.exe File created C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui.tmp _Desktop.ini.exe File created C:\Program Files\Windows NT\TableTextService\fr-FR\TableTextService.dll.mui.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png.tmp _Desktop.ini.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt.tmp _Desktop.ini.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp _Desktop.ini.exe File created C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll.tmp _Desktop.ini.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll.tmp _Desktop.ini.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_left.png.tmp _Desktop.ini.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile16.png.tmp _Desktop.ini.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif.tmp _Desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml.tmp Zombie.exe File created C:\Program Files\Windows NT\Accessories\WordpadFilter.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp Zombie.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp _Desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.exe.tmp _Desktop.ini.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\skins\winamp2.xml.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_down.png.tmp _Desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\Fortaleza.exe.tmp _Desktop.ini.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\library.js.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\Halifax.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\skin.dtd.tmp _Desktop.ini.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET.tmp _Desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp _Desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.exe.tmp _Desktop.ini.exe File created C:\Program Files\Windows Journal\es-ES\PDIALOG.exe.mui.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp _Desktop.ini.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp _Desktop.ini.exe File created C:\Program Files\Microsoft Games\Minesweeper\es-ES\Minesweeper.exe.mui.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libdcp_plugin.dll.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp Zombie.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp _Desktop.ini.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp _Desktop.ini.exe File created C:\Program Files\Internet Explorer\en-US\DiagnosticsTap.dll.mui.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp _Desktop.ini.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Tashkent.tmp Zombie.exe File created C:\Program Files\Windows Mail\msoe.dll.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\gadget.xml.tmp _Desktop.ini.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp Zombie.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\wlsrvc.dll.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_snow.png.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\ext\access-bridge-64.jar.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\library.js.tmp _Desktop.ini.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2256 wrote to memory of 2996 2256 1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe 29 PID 2256 wrote to memory of 2996 2256 1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe 29 PID 2256 wrote to memory of 2996 2256 1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe 29 PID 2256 wrote to memory of 2996 2256 1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe 29 PID 2256 wrote to memory of 1832 2256 1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe 28 PID 2256 wrote to memory of 1832 2256 1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe 28 PID 2256 wrote to memory of 1832 2256 1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe 28 PID 2256 wrote to memory of 1832 2256 1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1832
-
-
C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe"_Desktop.ini.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2996
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD562f70c43cfb8783d7c655f3972d0f321
SHA17c70e66aeef8ebb08c97366c57944482dac71a30
SHA256f4534cdc3696206ad55b2a54c234e042621bc9c7ff17e9becff4c911611ae43e
SHA51218a2ddb064a7de71e036e5854c6d6a23a3f828f2ff31e40fdb29a61f0c8d9b75082dc627508416c8eb363942ea707f46b3a3b78ad1eaccdfbc5ccefb9e1ff99c
-
Filesize
3.9MB
MD5c50062ec7e679a45583511e3e46d1381
SHA1309e66a5a1bc6b7e260b3efaf0016973f49f1cc7
SHA256e926b0209a4725c70f8980c7b104d309bcc1131320c1cef03e992ab1bc60fcc3
SHA51205d6086bbf5a0d5beadb4e8cdd7a3026efe4e9553e6dc56a5706d0f88ddafa0da4afb8fd32a9dfc7055337c491a2d1ab086bc2c64316cfbd4d6dd6d587152b91
-
Filesize
520KB
MD5bc96bb24128e69e007fe0b45ed9d88c3
SHA19f2b0ac1aa59d20b1f2bde26dd2497748965d9e8
SHA2563cf98b4df9239fe2d2f7ac90a8936d811677702506b1557d6332e434f02c5151
SHA512f3ec197719432993575b0cce86200bcced98acefc6d547bf15e9b8a1d1240a861c883027e8666dd962f144ad2e7885cfa5a7831d90cd18ccb6444d8af3678281
-
Filesize
712KB
MD58945fa1a5e472841a9f5d6cdce3b5c87
SHA188024fe416a432dfb96f73e58ba66732f26bba9f
SHA256625b234954ee4a4d0c102437aae4f552a8a77d4b90a09a4553ebcf1e2197c42f
SHA512d0cf04f4e704f16e5b99afc0bcc672a65e40a7e256832184d522261abe37c7d6e1d91d4f6651ee90b1e03e344642dc3e69c83b0f4db37e6a74cf9469e783722a
-
Filesize
23.8MB
MD562019e1c1c0510391b94ceb3d3a150bd
SHA1772914a31f50e3217567d606a7be5535e1e2e997
SHA2564faddb8e9be0506fcc4465e5d8bbeb9f6a4ee79a5aeab0f1fffea6e00c25c904
SHA512fcb1204dfc2039b5dd8399088c2ba8bd7d896e9b68a5ae2f74ef22a19f54b2d39f82459732be00fd2518b6cb82981f400ba628ce0f96f6adf716f143e5180fb9
-
Filesize
241KB
MD567667178a934d65fd366a96c058d13a8
SHA1a5108c36c0ce6ae8f806f88cd53bf5239ecc7fdb
SHA25626193a6361e38aa8e392733973c0a2596e4ebc3581de879033799d984b0e4550
SHA512128576f37481c973d5e14e8b84070958eec4a87bf3794e921af6bb57d2c9f1f0a7168ad443adc31623919314dfcc739ca66cb02f2f87566837653daf166a14eb
-
Filesize
5.6MB
MD571b63bb2e74b1c3bebfea4c9fdc79f7f
SHA15d7bc7cbf2f4bd1a50e13b8dd472eb08bc2647d7
SHA256f4845399c9c25bf119f832443a7f7a1c3e116a0b2cec5770cd92df96c823cdd3
SHA5127787919cdc0147d1cfd5d4864a033d2f87126684ce11da3e06a0aa7063139bd373f675766a72ff7a7e7d84ec7f2e8df1de9e895f3e9cc9361574a922554d8943
-
Filesize
1.1MB
MD5f78941dc743f4d9ad4fd350820f948a3
SHA121b7525c12884e89aacd779f75c13e0296a47400
SHA25614cd92d1a30a67b7ceb6da4c9b79fb0cf1bf4378dedaef91c1cbda42611f8c31
SHA5125e02d604059f230b286a7f7778329fcbff92cceea44ea6a84e1bc59448c00e409074c506774add9329bde90b7381dca2e0414b977d25ba81ce7cc3775821634b
-
Filesize
1.3MB
MD51e7d4a132a0b438c54877a9040befd3e
SHA1355939c8b7856949145764dadaccd18d816397e8
SHA256bd47dd3b6a7cd1d6142eb475e74f070a623885d100d0a71e79736d20fc7db88f
SHA51283ea6cc922fde7ed21a84b23f3441011087be3347eaa4662360f56d8d42bdba63ebe0f0dfa393e216a36043522e14f1e1860ab2c89f679e41c3b0e60e4162dd7
-
Filesize
1.8MB
MD58457d33f7b3b32b6e822f40895793d01
SHA16841ee22a64d4f269eee47de9c73a9bc67a5e54d
SHA256dcd69c8d143cfa2e7af9b96da8cb9580adf03f6c2e21c4affee35789b20396fb
SHA5127ccef93920a45790041e16a2f7054503bf8f889bf701ac363606bb0e7f0a43661565ce925125003a73806bd92a0d742d128ed25fbc3bd16249779aa78165ecb6
-
Filesize
1.8MB
MD5b962acacdf76b421fc5c684d689c6a4e
SHA14f15b522acbfbec5885339ed5e25aee002f714fd
SHA25606a8636a84979b643975c8ccfbce791fff7da29f78b50f21f639850641fba47f
SHA5124a140d0de2ce6ed6cf30d8a891dc6b29246a5bab420dfdc4ceb02ea90f77d152f041040a3ddac34cc066241a238bb36b51eec02f88c0a3035818bbb8c7feee30
-
Filesize
99KB
MD53f50db313beb329d50f1e4eeb8c057ab
SHA1b91f2fd9607bf1d1b4b9db9f8fbdf2e645d9ab6e
SHA2565515ea16ecf877f8ab651ae2aa6a011a17f54ac5f9faefb4bfcd6eb3cd06328f
SHA512966f0ee8e6815580752e3cfe4631dd25454b1f2f7e4233706b6207cf09307a6d88ae11cda01902a9597762ecfb94232f7552ca6d9eb8e62d309542c065b7fcb9
-
Filesize
99KB
MD54a5f2b6f23ada8357fb6318c3a1dd66d
SHA17a96ce93ff9e69d803a9edfebf1c9b9c6467922d
SHA2569f687c02de43dcbbbb64c23a34ed78262d1b0c46ba303e134abcb091add87268
SHA51225f40e94182814adeaeb57093c10fc2d12e9327cb070120e160e7a5ca19ad79b6e543d2d0ba5081b80b05301c1c9b26595627e3d65767516bb66186119320d09
-
Filesize
1020KB
MD54acca3fbe225c1c5550e73ec8906b3ca
SHA17925f7147417c963418b0144d2c63b2436eb77d4
SHA2561193d764c21729afe15746f390472738a225105458ab0c18bcf7b9dcd4cf8848
SHA512d8639f3cbea9f10437fadf4de46eb2699232d4ed039c2fc2fdd68a9c1984a872444144c57dda78596779e4e7fd8e0c955ad8720738ea9d8ff0ce5479ab9b2942
-
Filesize
1.8MB
MD50a674ce91a82a3153c1f2bfe7d9e857a
SHA1a0f6d762b7379082c16fe0bf2f1b43acc9dc80cf
SHA25689bd65693818d68ec474200ba34f9765df0ec6c5fa67ad7470b5aeaf4fd29e79
SHA51271d3c917a523809478388fef067af3727da1b62f9e19f33dfd06c87a8717b6f61fa1004b74716489b43579cdb7c60e3a5fa0671c052dd22148c6a570b73638b8
-
Filesize
14.2MB
MD5e90d33efc8862c4ada95e9e00023f44f
SHA1cc1fee7b3fa8fcb1bfe77fd2e95bd95bc11670e7
SHA256c396f3723bccea2ab9bd575731e8445f3de3f118ff899e483189fed3e0b162ff
SHA512c41a0c72175befb5c5a0842ab1f359ff0f69a3848ef12a22f75ad11cee074a675cfe419f5e4bf9eac10f7db535c2a6d9d7840eac0b0080221ae365b9014fe615
-
Filesize
1.2MB
MD54b349a115086d20ec93bc1003b62556e
SHA1b6c0a37b9fd87606387e5aa3a1acb5b55f9c5cab
SHA256649ead92302e0272b327d85ddd50a981fc518d30c5bf6a346a3139534a2ec58d
SHA5127291454f98c652e680d11bd73ac47765cb48a7146d5750a22b031c29ddd66c56098b44d3d079bc2eaf8b6df9152a7a4d4d683cc62e10fe6bc58692dd7d2159fe
-
Filesize
104KB
MD5dea53e145e56ecb839fcc66d2ec872c2
SHA117817e010111de51b60599361e2f48ab57784a8a
SHA25631f2c040cd0a1ed0e711591249683b389ec004481fe9a619620ad4a126a17199
SHA5122db689d0be39376cbae3b6ca4022019c251c1b057ef194799ec152f964aa43c443e4a8ba42fe5d7f2fc27cad038f736514e79ae903a53cd2b707b696c4b9f1e2
-
Filesize
2.1MB
MD50a9f4c2505face46fb56000850a3ebdc
SHA12ca68fe6e3f46bb6fd40078edb125911137ff3e1
SHA256c4c2e9715283e69998255a6d9e80871055adef7ec9360279dfdc2d570aca11a0
SHA512b7ce01e884f0634f5842e47c51f4461da60063cd386e97ac0dee074e77c3dc192add85ac9d1c555b1f650826142b1805787124019e1b52c540e29b7bb9355423
-
Filesize
103KB
MD5eca375cb4512c4ec83f8879cc2053601
SHA15937f7234d7b9077e8c42f9e794e4047db064014
SHA2561dd16f88a7db93488ad7cdf5919b6de4d6017845d930dbd17a7629ade20bccef
SHA5126e4367e0138adc226953895e12bc8b0b4f2bca58872302da1e900c29bcf7ea661e19c1b6a3d1b084b4fcebecf625050c9d7a4ed497170e6efdd6e3683800c154
-
Filesize
105KB
MD56b3758b8b0af98f86e3f83d1f5ada78d
SHA109e2349e8de0a2d6a015257452618496b1a3eace
SHA256c490b827e631d5d1ada9c8ae3fad5b10919b4485c7a7368f1d69e95f86131b3d
SHA512f55c6cf078bd12efb20c6260d1f48dc4f18bc736c3235519243ed619d401ff132850fdf6ec406a9ad174a4330c5b09045c099f7aa13e577938b2319a61cdfcc3
-
Filesize
100KB
MD5e4def1b8b167da65f729ade69306ffe4
SHA115d7a421a11d82280229852ca50b795ce854c62f
SHA256753be18a7481abf7cb71bbcb618a167846c13e3bf6bf8186975e2a670da0f624
SHA512b31887ab08d65ad5524108720bbaf147cadad50b3756acfd6d1bd621272ed4d20431c3f84cb96212b7cb79a9770030b3c23ac73dfad148f64a79d5c584270457
-
Filesize
180KB
MD5f2542951e918024300c76db801e2ef98
SHA12dc097963f9a308d9a50b3e8071e8c3e865526f8
SHA2566db15166e228c71a2e2d2e258d45910142f5155b9978927cdc330db805101a19
SHA512d08c1e084a385948f7368ab76bc657325af884b74cd55e6ee54fbc9105f33713cb54188d789282df76fb2454ffc5e109b37a467cded7f2d1080c83076906c94f
-
Filesize
99KB
MD5ecf6a6fc9f63f48e9c89fb9cecf56bb8
SHA1fb763e133ced5011c60f99b124cf52da0320b397
SHA2563041d0bbc3f6d88c9a8624c5b1f9b29e04e7644c98def464866e08aa80ef11f0
SHA5120b6118fc99f4c119a39766e10c5e12ef5a3caf7bef3dd903a75094ebc5332df97789a0a5585b0929633c834b0200447955aefc9af161d250ef8253e26d7f4e20
-
Filesize
100KB
MD5bd0bcd5a22d56ad6f0b7f7a91686dcb0
SHA1be265312c30bc4a2342417054db2e5132fd855f7
SHA256119f53c211f563720110a5721fcffb7cdbf9a5ffcfcd6a33276410696fd909ff
SHA51209f70333723d78379a9520a071cab4e28ccdbac483b0494685de0bc298845314e28c7c009c42b16078a92198343582304e5286715d813a4846d446d2e4b2bb90
-
Filesize
737KB
MD5bd46c040c87aaa45b85ee887e9593680
SHA1b07754df0ed54606b655131d430b42ae3dac0511
SHA256da727dd95be98d2db01887053cb238e72932e7f749d5caa3e526bfd0778ebbea
SHA512333d723a0edc7ec29b4642855df4a37d1ffa689b547477dd640bae2065ad5f57559e9934202552a1fb14f36967f7abba35d55741ecf0b96b58ba3db9ae390515
-
Filesize
1.2MB
MD5b2f2bf7d031641d14508235e1496e524
SHA12f57a3c15abb9ed5034338db427ca99e7a4145a9
SHA25671efc38bcf68b4adc7d163ac8a338b685e3ecd4db1d109a9e8630068b2a4188c
SHA51262af23f448838ab8895db9086474ed67f1850aa420d498c48a3ebe64f7ea2a40d161f07711b585e808b174561345c9493d5967dba6afbfef31bc5e913675e108
-
Filesize
3.6MB
MD58f7fe38fcee3282db9d73eb7a44425e8
SHA145d23de8dd315680ef7257add1e80a81d78122e4
SHA256de20500c920dc5112da2d7cf394332c0f154b3fa574cef38de32112864a07b44
SHA512c65bbafa212b4369b17e0f7b7036fbd47ef49830e107cdc09d03429011d900964086200177f218dbcf53ff215a2ba43df99993e4cc2891eabb317d13d5c531e0
-
Filesize
98KB
MD52e4cafb2ed6ef1b33f84fb2570244fea
SHA1ff395c412fa84dad01dc2bc21ce29001e1440962
SHA256f123f33534d7322ad38f63b9d621d258531e28ed1d574d07a6a7fc64bd2022bd
SHA51292ee168d81e4d741283fab4f32626cc02eeaa316a87bb5d2b2b23f1179f1967a0cbd334c9fc79339c20814861a4b22473141ab7196b0754d586ae43a5638469c
-
Filesize
102KB
MD566fd051fd00b90534c8e6c796d2d4b01
SHA1288a7d51a6b0627fbd0b542c5ce5d1bd98508ff9
SHA2564be31467d8f581826bd8284f31d9e1ebdd455a9f3d17feae84834b83e6fce5eb
SHA512ec87e51457a54d6c6257b4784e952d83d0ade05bc5d26904cf3fe3fc077b3ed4c40297c71acb38e46da9f3b0c5aa0b3e91c1b4c561b0af7f78579651223ee316
-
Filesize
100KB
MD5f60495629a99a393650fdd61a8e6bca1
SHA193b68704f07bcf8d7e3bd5e4f0bd86cefaf4859a
SHA256685c03beda7273697ba8e8fab0c28c527dfabd521a8f2c430e8435af0d333741
SHA5127d34750f4ae2df6adf068200d0b470efaa4c4efe1a0be7c797434f88ef263360a61e8077c8f39a7bab65f6b9e25ecba2f0e7aff190ef8b94351c191e40e73f63
-
Filesize
15.1MB
MD5bf99f57de0b04010049a98df22b9faab
SHA1e9d82be666ceca58e389f6971c45503466f25828
SHA256e6a5e558cedc6d5fe5eb4eee216cc58aea6f690ad2b1d8e9a8142f3744349d7d
SHA512e47adf94ce7b8c44354f1faa42c9ff49f17afe1384bd4910bb09a94fc52aa2cfd3bec1d5b47b234b299e5491fe6e84d1bef2abc48595e352c9f2ad3b89d8a07a
-
Filesize
2.4MB
MD58cba291b8fac87c568040a37fd605364
SHA10dc35b518d18979f965071bcd2d94f42b4af4284
SHA256826bee6dc534537fae2a26f011be3030e4a9c6398522f71eb9f6eafb6b4e0a70
SHA51244bf2baee9c3464da6f01705f3d6ffdd5fe6b9c7cba8346ab70e6411c365b1998886571969870dd142c76fbe66e9d40ba9fefa40aff75095be626cf984805479
-
Filesize
1.7MB
MD5ed40939424a9c675f8a459376e8dfc07
SHA17a8ca5af4e285788065a4b9768c6c943ffeeb644
SHA2567109a02ddd1aa6b322a4278fb010e20066ec1e1e544dca6c6c415e3775e0fcea
SHA512f3f2762836528139d3e5099839f86b604585c3dd2918293f250116ecb04dba6b286516610c0bd3cc2a21f055e31c90b7e18234c5e7644ee9750f4b66677cf4ed
-
Filesize
3.7MB
MD50d530ba0393caf40794304aa8c090594
SHA19b90d99bb34bed1901ef2d394daf28a739f72f6f
SHA25628670bf5f230ad60bb3fac2ae9871ccf6d9f20347151af6d913dd63b6b44400a
SHA5125788c4bd1417b9c55c01b2e639ad141a8ed964eed289d191addbcf7c889696e37333ddf3a7b56ebbb4a535672213582aa8b769da3d479dfec6901f56f5adc8cb
-
Filesize
3.8MB
MD5e72a9983747fb08d7408e3d4285de2a5
SHA1f053ff56f1f88d7acf91ad49e045d114f0cee358
SHA256e660f0917329418c6d38897b9e12056e2d90a4afaa90a62d551becb8b5708ff2
SHA512fa7bb195f114e317443f1607d3a2fbb5d6919d0345ae13ab5ec3d0439af87e3e5cbf04e57c96dac72a16fb1df31ad51fcd35f97c03579b19aa8d86f7c423cbfb
-
Filesize
201KB
MD5c6c4d70035b1fae3f3f560602d447e46
SHA13dd827c35050591ff8c42386f881a734f8bcc478
SHA256b9fd633c9fee2cb5d393c9e82575e7628fa98cb646d41aed8121445e615677cd
SHA512fedcfe4b0a4e4e19a513a2896ff56096df5d17bdcefce8a25f74a261f494aae44566dddedeaf4cad960be15cefc8811963a50cd7f88c1c0f4b0befe1588d9ac5
-
Filesize
164KB
MD5d4e9c123b54588a1330d591970255fc5
SHA1c6a146d574a0198bb5477732eefc899e2862a23b
SHA25679e48f5a97b2d86d42463883fadd3219cdb8319e829d389f4b7022d23ea88ce0
SHA51218985e05c0e8c1a879f62eed97f54bc615d89f5837e591b70baec67bac8f0352ca66173f14d46aa3286b01555796432dcd9a68103c5d50440b7040816186a9d5
-
Filesize
915KB
MD5f03b9c44204ee438246c58afd5310d3c
SHA179491cd107f2087e37a8c370de47a3762d797d37
SHA256226603ac4c87f6719b698a70b65c4cc6940354cafe80d2f39ff3793f06d7f4c4
SHA512fd0b5dc48e632546b19b1c34ed7b3072beb07ef51f13b59d79a6a8b24b6ac668017fc2c8547044c8b3f3b50f570ee5d07193400574f12f74f85aabec315fa10f
-
Filesize
3.8MB
MD5ea1319e55144d96e5d08e3da4be2bd08
SHA10752fb12982f59261e6822f1a489137f82cbaa2f
SHA256fb23056ef511e1c5079096e6f8ac8bdaa58f888803c2463ac01e0240e8607e1e
SHA512401baa111906d1091b69e42da5b02b1ec5e185807172a7e9b3361a3693f649fb78fe9a669d9fda3ecc7f0ef5e14ce58b519ea35953ae3719457b39d642b25111
-
Filesize
756KB
MD5be916500cec181ab59923aac00117445
SHA1c6bd92fa41abbcc7d9598823f34f2332a7ad3767
SHA256ed908ba13238d604666b926b8410985cdfd0ef1c1231256c4f404da897ec16a1
SHA512e57c7b5d11b82aa39773f25404f4519d203f37576b2c77bf6a60cc1fb93b21936fb0bb9b104ed63b587423a6e10a724a222c1c139bd72c13c3f83826532b6244
-
Filesize
596KB
MD5ddc1c8b2d64bf8a78f013de2ff89d046
SHA1f53574b6694dc7baf4dda51097816953e1e0a7a0
SHA25622c61beed5b084a090a7d699685886762888020a16bfdf62d8bc62a0a96b6cc3
SHA5127e920c1cf5b48d9422788d4f5705dd3b18fbaf9321a8012ecbcf19d31b40c17afa4cdf00ed0e68f6bb87cbc1815fd44debd15a05945975dbf2c0de096e90962c
-
Filesize
731KB
MD556394063c134c77fb79252d9224ca276
SHA158da3a4e6a8fac8678cf1575a27e3ffbf99624f2
SHA2566bf644e3e9b2b46cd769ff5465b8f35beab5fd13d1f5df1b26fc271789cb3380
SHA5120fa7c077d746aeb17619d2d8c4121ff3b8b402be501bec5c65967100cf4415211590917712e88901bea3726ac3a29f4b3b16f21b792a17a972434733c2696284
-
Filesize
97KB
MD5c0d93963e10b863f40fe72002c854a15
SHA1e9b46b48b74831d8f35ef2a4bc187acc2e6ce7bc
SHA25636830f84aabe3c52c6ad3f24e510d214a28507c95da6f83eb679739697b61b40
SHA51225efb5b2a9b40e2e4789da21e948913a2f77ee480cbdcd86197f32be68a30793d8828c671a3d338e2a97725fbc20839320c96d12a76d51837c404166eb8a9a5f
-
Filesize
105KB
MD5fed0f115deded216f8dbdcfaa8d7771c
SHA1a36875e04f212c166ed8d541fed58f18e4fd37bb
SHA2569b0418b3fcd4dbe41099d99404a5c91511c059270496da87752882032bd191d2
SHA512a9abe6973a6e65f7c8d3d2c14e56735fc60cb341e0f6190fffe6b79c0a69928b7a870b0e0f1cc1e64209d5f7e52d5ac716dbc892790e74989e2f661db5089233
-
Filesize
52KB
MD5b49d39b1abd27773135b226f25e8da6c
SHA128302d16440bb08648c3336a14382433fb6812da
SHA25699e407fe0862ef9a9269a5d445931c5ef6e2e40220674cd90259a7db9901ce9b
SHA51230ae7a891f9d565b9a7e847a3b1fff972bb2699d1b451b05df7287754f0bedaf71db7e9f1d2ca04024a472e9b66953642d194b4f34073baee27ea5b5c3406dd2
-
Filesize
679KB
MD59d15c4eb5ef4a13c3f1110a0f1252406
SHA14c76e1023353d64c001fbc92ac34889df81b38a3
SHA25612836c8d1dccd6643c1543f91c89ba25fbc89a4d18018f4c78fd14567873eea6
SHA51222641386ce632e17c72ad80465a7e285de33ee42ad2702be06560f5e75b8d8a309bf5eda989b3a62e8c337abd62f65bbce386df7fa284c09f42512ba12d5ff48
-
Filesize
610KB
MD5c01ff6d805f34644e0b3533008042034
SHA1b300a904e586877e65530c8636ae027c45efb2bb
SHA2564f2afe78d835eff030a2ecfc112bf582bded0e15ed6c711f7cc77e5a8bf0e579
SHA512279072de14b32ad0754031300f72c124d3c7b7af72781a2ebe319fc6843a7328281a64d5e8a7a630d27aa1bae898844fc3a6d1fc1cede7427ef0686392e294ff
-
Filesize
737KB
MD5f78711a87a6885715f26efef0b93c4bf
SHA1122d4227620c1a4d4128ae733bbea8f7559da085
SHA256a159101e6c5d56515500d20720b7bf90d8753c8939a266e51905b88d824cba81
SHA512f422d61e6ee5eed7bf7c1cadf53f104c547f51083f3c7129ddcf5b94719e660ed29b87f7d0a19a8dff8c1c764962b97014c845fb464822e8af30e6e7b30e8aa5
-
Filesize
283KB
MD50e6f28bc911923e264f48febafdc3c5e
SHA175059a2e6482e2d68c560c7437c1fbc67d9f9d33
SHA256293ff255c6f4063c428e9a1e0ce04d4b5f9b7c052a02a5f0f43aaaee38d69568
SHA512bb26713f1d6a233d9b008202191b142b0450dc36ad2f462bd681dac002fe502cfcff48f2a6c301f4eac0e1d683a9a96629466563dbd66d2842ea6de6de3773ba
-
Filesize
123KB
MD528b67ec4e2ba7f91082a8e3270a8e0e2
SHA190e1f4335c52df4a271c3272e3b6a70ff6a7e78d
SHA256b91542587ecdc20102da79b8dc323512d54d8a8aa98578a5e59d32a8c3bc9ce7
SHA5124567586537c6ab5287d72970f722de0526fbb8f89d2d95b52e76e925d9e4b238a979118cf0d82f34c06ce683b0c31a88f1c8b122bc36e522cf8222a907dd522a
-
Filesize
36KB
MD509931233bd5a387f9d9ce16dadb32f44
SHA1808218574e996164d44c05c20dbf728f392eb1f7
SHA256ceb07998b404a4a037f465dcafa566b2cda7b69d308f4d69288939dbafaccb31
SHA512e2ca979e735a378987a4378ad8c3f7c0f9cf4cd8f5dc088c90d2c14d1a65d8e1b06e63d2446648ff776d5e4a3d4f3ce2f83c66e31946bc2fb31d4224a5b43874
-
Filesize
96KB
MD55bc3dc152d1098ceb422085a577a644b
SHA151be4ebaf348495a25956d05779cd407c73e79ca
SHA25669f80882981b5af95b6da5cbd642681e92da30d3d5731781fb383bde9cbedc0b
SHA512b2d128bcb3f48148c4558bb381a7f47be0e09b7e6d927213d25dbccc94384788fa7a7568460ff1533f4c9633c97e81b89542ffb475bf6368c7bfc8e7c300aafe
-
Filesize
731KB
MD562ad0265490b625717cc0df82e04c7d0
SHA197d4dc90cbf684cb81b133d19685dbe955382fc4
SHA256c1b294ad0fc9e3656058fb227051d52f7bf27e0a5033fc3c0541ffa08898d858
SHA51229a9c1cc549f05391ae154751a9c7d893cee4cb72e0135c80e6724acca8f118d43cbe14c82c1a6a628c87ac9573350e227fa800521ba91e249fafbe15958a8f7
-
Filesize
96KB
MD5100b44c673d371eba3afe5a74a73651c
SHA14dd69dd670d0f6ab7e8f717667f328dd7d68b22a
SHA25662c9e4dde81459b02a477410722c997a86023f0375470a3d48057ff77ea28cd4
SHA512f9c5a553e598da05985673331c077692650cca2a7b85542dee0fb98ca0fd3564a7c058baecae50412b0dd4d8b244456faa1f63e55b7144a66af9176b0b34d80e
-
Filesize
96KB
MD55829fa8dc997f814aec5aab48c031cf2
SHA1bfcb09138d6f55824c5ccb1f3c3efa7c4b0ec180
SHA2567b61abab5027b6452db8e8405e64b902d9f83aa6f65854a7055f48daad8ef6b2
SHA512c61def35c728dadfbbf097cc0c06aa4f5de1663ad17003b0339c6d0d591cb1ef3adcf6eb9cf7555e5de3e0c942e514e55139dc1dee68084b399e7fdc3a782774