Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 00:05
Static task
static1
Behavioral task
behavioral1
Sample
2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe
-
Size
82KB
-
MD5
2014a0b6d02bf1ae07fe00b56f580ba0
-
SHA1
c4b1179813f5981eee695db429c888e24e8aa5e7
-
SHA256
b073a0610707a692621f422fff00062bf90b0c823bade8feb2db54b73872968c
-
SHA512
ddcf6b99a161367c58eb5c5ed3896a5c7ad48cb33714ffea11340d08658a212b2bbe23ae580eddaff8d1d18f579354e4a710ebc5b1c2c578b6ba204b1c9afd4a
-
SSDEEP
384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKr9Bt7Br5xjL9AgA71FbhvuNBNM:W7BlpppARFbhWJ+7BlpppARFbhWJa
Malware Config
Signatures
-
Renames multiple (6198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 268 _ChocolateyUninstall.ps1.exe 2712 Zombie.exe -
Loads dropped DLL 6 IoCs
pid Process 2440 2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe 2440 2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe 2440 2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe 268 _ChocolateyUninstall.ps1.exe 268 _ChocolateyUninstall.ps1.exe 268 _ChocolateyUninstall.ps1.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Mozilla Firefox\lgpllibs.dll.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\slideShow.html.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_disabled.png.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif.exe.tmp Zombie.exe File created C:\Program Files\Java\jre7\bin\pack200.exe.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Microsoft Games\Mahjong\desktop.ini.exe.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\0.png.exe.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\handler.reg.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_down_BIDI.png.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\cpu.css.exe.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST7MDT.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Oral.exe.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\settings.html.tmp _ChocolateyUninstall.ps1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm.exe.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-disable.png.exe.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Bissau.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml.exe.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+2.exe.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.exe.tmp Zombie.exe File created C:\Program Files\Windows Media Player\en-US\WMPDMCCore.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\ZoneInfoMappings.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Cocos.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_pressed.png.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\flyout.html.exe.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jre7\lib\zi\America\Glace_Bay.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac.exe.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_dot.png.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\picturePuzzle.js.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kabul.exe.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\micaut.dll.mui.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar.tmp _ChocolateyUninstall.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar.exe.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89.exe.tmp Zombie.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2440 wrote to memory of 268 2440 2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe 28 PID 2440 wrote to memory of 268 2440 2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe 28 PID 2440 wrote to memory of 268 2440 2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe 28 PID 2440 wrote to memory of 268 2440 2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe 28 PID 2440 wrote to memory of 268 2440 2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe 28 PID 2440 wrote to memory of 268 2440 2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe 28 PID 2440 wrote to memory of 268 2440 2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe 28 PID 2440 wrote to memory of 2712 2440 2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe 29 PID 2440 wrote to memory of 2712 2440 2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe 29 PID 2440 wrote to memory of 2712 2440 2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe 29 PID 2440 wrote to memory of 2712 2440 2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2014a0b6d02bf1ae07fe00b56f580ba0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\_ChocolateyUninstall.ps1.exe"_ChocolateyUninstall.ps1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:268
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2712
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD529d60fa7ab3dc331e7e473817148c827
SHA14560b5e3e09d51000845db9c2bf8ec669e2cafcf
SHA2566a48689562a67c809a24d82e0f4dcb5c85ee82af3c809e4b15bc8f1122c68c40
SHA5129be6bdaa8ccbcfcae7cc39cfd1d25ae74da1f2692315b353e708c162b2fd3fee50af5a0a40e3393f4a3854794e097da6200837cdd6d72a66749d830a8bca740c
-
Filesize
3.7MB
MD5443ffe6a5c69e41b03d95f7cd4ca106d
SHA1e85e774706afeea89db838cdccc8f1bcc6fdea59
SHA2566cfd1514a2454d4a5e34c256f290d6644ee5d0720d842078d69547798e34cd75
SHA512f7f3da2b5584dabef1a1e1684afc125166cb325bb9797577a18d2b068b5a46fe9731ff80084c2d30892b82b710456fb9463ea47abbd71aad83ba515d927066a8
-
Filesize
22.8MB
MD520238ba2a185abcba2baaf8eef7ff178
SHA1137edf00d1ee410c82641c150d026614ba30e5d6
SHA256eace23cc765dd3c01c7a747290d113a8d70b1b7d1438363250322264b4cdf1da
SHA512c9a9eb2f117372845e9b77cc7d3dec7c4f47fcc47ed5debb38cba5c5020c67e89442fec1337f81006ad9cc48393572a2832abf1eb5fafe4a57e6ec7f29a40f74
-
Filesize
44KB
MD5468f035d583e13e5227217d69f90a62c
SHA1e9b6178a3042d33ceda3527f1d45ddffca97adbc
SHA256e24e05e02632a3d9b9e89bc894600f6baa58a6ae1f8a8e03996859b96fb91ef5
SHA51209b39e61b5c396ee816d492759160b2e5a0893e2400c9bc4173568f39fdd1f177b1c2cab18880d8fe60b3f5d15ea7c0d8c38f86bb5f1e3f0cd7d3d5c8cd75102
-
Filesize
1.2MB
MD5568952457bf4d8bf95401034c275271b
SHA196f4a4e48516221a19b132606e3c00e738a7c6f3
SHA25601c84856c63090df6855c0c4b5bef2115331f160e32ae374bf71882644795012
SHA512a992db55b1a3ca6f5d5a341131698bfc83bb7d9b0f196df1bbe65b507b6c69f9691548533d411397b3b9fe70ef86e44f19001175ba567349a5215a07665b9c5f
-
Filesize
1.2MB
MD543354d82644aa63fd3219113379273b8
SHA18c48d02aa41d2d7d24e6833cf5836603f30b2d46
SHA2561a0cc56eb4fd86d2bff7c4cf0f9c5ab6d0da7b0a5626d3f3e8c0dc638e7756f4
SHA512961f31f0032fd04ead6bfd9a0ba65c39a0593506f5b75e7ffa84d1a9a8de3fcd9b2c86ad4133a1806d2db494d9ca98929d3c5a9f9a86e6b8ba6c7c3e3faf4e0e
-
Filesize
2.7MB
MD5e7bc60e1772937e53a3fc90050fd3856
SHA1e158c247fcb95d6e98fd686b00c1b9a388d23c20
SHA25654512597f822aced868b36b4912ec9639cb4dfffa1e507b5c857e119588fe718
SHA512dd4f145e7d575e3b61d71f6482e4531d109e17b87ab9776ef12c7a256dd1b1eb67616e29c5d294bdcfb2fc906effa57a3362d0ccc96c5d2b6b9c411104d996d4
-
Filesize
187KB
MD57362c2286ce8cdb6b88d8ff9eb8b703f
SHA17977b529fc28ba2733095ebd7098a287231681de
SHA256a33f01170cadd60ef2255963ba3a942e66e3eff36c5bfff5c1c46f4faccd696d
SHA512030873f6ab5f3cbf4e3b4ddd3a7207a76edd99b6f217c2cebf647a0f996b91b30147d67275d5eb99ade55169b8668d1f8da096b7d091e2942dfbc6ac02623499
-
Filesize
5.6MB
MD5a43ffc16f2583ad472ab9012b0a33ecb
SHA103f7b4324e1f907098c30ce700d0ee44eaab5d39
SHA256ddc910f16bd6fc14f9e6ee12d127afcd0b9105d144da7281c86062b686414052
SHA512a127c5cdfcaf7c72255381897805765139dd0e384e2a3b4fe298af716e5d9a15f6bfcaf792ddde2bb66968bfe2ea70fc03f4a341ea5e6abaa62f1ba29880d132
-
Filesize
704KB
MD540f4c62bb617cf361c7b7798d9acba14
SHA102a46517feed995c28e7a063aa57bed7ba56ba00
SHA256419a8ba30e7bb3dc1aa175ffa136cb85ccd7b1c30268788fb6ff1dec829f609c
SHA5126bcd867fd260d6a3742bf74d29070b60d07307e2d2053ee294a14cb7015a32ad0dc7279a52306b0110be35fb070b3da7b88ad464c139ff48a8844ba0ce193ec9
-
Filesize
1.1MB
MD5304107a6b7ea87544c02a9f0178c2083
SHA19468a5df2dbee262e10ae9906a42f82c13927416
SHA2565bda567df5b1815b0406e63aa1f8f19e1a6a2002b3e3a321c0c971e1acfda899
SHA512a50f64d8acea0c987c09498b91c1d9c547f62a770957063c3122e71bec0ab49bd871721dea42c5849d16743f47cf2f02a8ab291045284725f133d9e6f21b4a14
-
Filesize
1.0MB
MD5233316fd807d8d504b95487bb0f6a754
SHA1fc7c2070029b01aea86105ad77b642142a81f8e2
SHA256edc04aa42f944b05006bbf98a7dffdfba390b1c279e6de01b3e19c5351ca3fef
SHA512a106213859eadae80126c2867b2052fcef41e2a13a5e63c43f67f951f96ae5590b3e359ee89aca1bc17a38545191a646f4fdd8e1be4231d39156b29e91a53bcb
-
Filesize
16.1MB
MD549e6a460c82c417b3dee754ba2fa741f
SHA1e38299e8ea32b792c8bd4ad4785a97c302a36fab
SHA256c931096e403e6a6fd991214f00dfa7e09f0a949746c7f5e0ca6ef57c302c25ce
SHA5123aba48895e2310ff65eea29ae4e3c0ddfb7c3608a976fe5348c667264cf67854a3c5834a501ce2f7e5e64d744d6bab04c44244f7cc7ffd1fec046dd19e5e096f
-
Filesize
1.8MB
MD565c3dce4c8883db9d9cca70f2cbfeaf6
SHA1ae7a399c7e0507348f2bef5cf0f28179f98aafaf
SHA2568403ff2f5667a1c1042e77376c080259a4816dbf8bf99adc95c2740aa122d67d
SHA512c244822b7daae7040fe51712ee5a37ae76ee86808dc4f281125a0441efdfeec92679a7f86c9406c484d30d90caa739ee7af52b77382e504ea722bf9a44fe55ff
-
Filesize
1.8MB
MD533e5c03c9744912f3b5bcf2941ae5f1f
SHA1a37afcccb8aa2c14822f526534b9105d20df7d7a
SHA256fc9917cd6fd47708b5256c391eafa9c47504dd40813bb12ae392cfca0e222605
SHA512584466b4c7bf2a476f44627a3809c8a15c995b90989069ca912a14499f8f89c788dba1cf05a6815500edfa848e9e9f6b83a7d386458ba7c38c9c470b3ab662e2
-
Filesize
44KB
MD54ddf6315afe927d1bee5a9df86909606
SHA16d6549aff201747476487663e4b010ce2b5d952b
SHA256c838777ea69f0fff34b1c72aa01eb977381ddf112204c120bfacdcea04306a0f
SHA512fbf4847afe48cde7b3f3a9e657d987f78374ded060520de83943ed87383151f11ba81e4779b1a3897baa41e88bebee79b6be8045c017b181ea648ef3f2a367c3
-
Filesize
44KB
MD5222aa443786c4ca128988c2977085d85
SHA11b18df6a5ff6923c6bc5315b4eda88742034ec31
SHA2566568e9a1511f7f3af6f0edcd0221beb0bd202da24cb8b989ea662c91f46c4f91
SHA5122249bc786a9a1422d2077c50912a7acc168d4f6f932def0df77fb2d0f9a92ee431605337f898e2d051579fb1f5f844537598f540949f978f7018a976fdd37167
-
Filesize
40KB
MD55f56157434ccf3d24773d92cb55aef3d
SHA11c922f3dad07900b3314567e05569a5b226e069e
SHA256daa9089920a8ae442b26adea3d23fb0c8221c5a62481233d037e4e4c4aaee35e
SHA512f13cfef3a5a58772c004dc73dae35fa6c3fc56470d68e9db615160ee2a48eea3cf275f858993d7cc2d51aee463a8843be9478af23fd32c84c22fcd63a73c747a
-
Filesize
44KB
MD568442a19032e058647e2ca150a81a147
SHA1e3da4f15042d4225a807d1c8c51718675b5c2fab
SHA2564cd3cbfc7f8b7c3a48912a717092d3ece3e075b757981f00dd1a0bc494a66690
SHA5121f0f80682fb7534f6a1e832df3e47312f54b7c21e6489f98fe256c8e786575578c83f6d41ce62fd4e0e711dd66d84e594cac3b2ac7dbb97e1af329759144b81b
-
Filesize
44KB
MD50835605363499016bc73c0774d958207
SHA11e119a360f6c8cfeca3501ffb801d0657cc04dcf
SHA256b3d49defed8c158e74c9a9d0e4ed706ffc19c311b9f5e2fd0f2cf25641e0476f
SHA5121c3711e08dc1db07c3c427b646f9b3ecc666c3ba1bb0e0a536d9d401591578b474f9a2a6e414a941200253461d154843d9d439d6c5a19e12aa2acfeb1b30d5b9
-
Filesize
14.2MB
MD55021a34398924f97d87b373051ebd776
SHA165d6a43c806a45b9798a3e1ef0bf9bb7a37f92fc
SHA256ddd2d115f37e32a4d03b35fd0cf18661867762a65fe775ce2cebcfe64738e55e
SHA512806ef129466d48bdb5f4f8f862a4001fcbaefa43c461172426ea1be88fa7f4339b39ac31b63a8b540717db2fbd1e872fab9ebf81e0d78d9e17eeeefa7e52709e
-
Filesize
2.1MB
MD553095b44ce3615b1b10acbc6bcdaefdb
SHA1822567a6a033bfb2c81de5eb99e0200618ce47e2
SHA25669d7b84d8d51d138e5f2c95185d5db313093690748d2a28a2900182b320c6cd2
SHA512b99acb3ab196c97b924dc26ab651671cd8a118af69987935588cca1f3969b394160e740a830f355ca6463fec40056c4fc61f83e943779669298adab760323d8b
-
Filesize
2.1MB
MD53fcd6ae0870ccae3d3ba1656bc592268
SHA190397256a9ae6b77fdcb7c8605e865e8164d51a8
SHA25617fb6dca0e4f8f276a72ec0c027e6b1bfbb3cfb9ad37071fe516b62d30735785
SHA512be33c8e8c08cf554bbf62b88cb8ba4910b1c4f0d54d6a7fea27a647a13a2f1353a5353e7cfedb4f08342bc364712518e56c61bb1ff820360d3fcadac2984d46d
-
Filesize
45KB
MD5ab412c05d9578fa166b0d7c8c43e7e7a
SHA1177f4a86912bb2d9ee121a827b7c60953836dcda
SHA2564f221bc14c8a92fe16b1113ffa652e4a559183e88a84ba493ed644dfdf466da3
SHA512195ce6f6588d1e5eea295cc02f537895fb0d0206f5be9832fa2d9df475bf54079aa9dfe93ad7d42e03064439a70cc98dbf5946c9e46d6181cabf12560648fd9b
-
Filesize
1.8MB
MD50084c890ce12b008de757d0a119b152e
SHA16508eccd85bc867ad2a492df46e730c8a265b639
SHA256171aa0c764dc3d8dfdc9c728b18dc9787d44472058ebafb72c57cf8f866b5917
SHA512ec1aaf4e66c3b5b7accff6abab08c6f9a428e634ded8c9fa389e911f4ae1a1b522dfeda1aa1db86c1b1107e65fa5aa80c39861c18cf2b5fd65e9beab1a0a0bff
-
Filesize
44KB
MD5273393f6584f95a54c5978af58857bf0
SHA1e66dae27ce4e69c0aad90bdf00dd6a6a5f526b08
SHA2563891baf00d3eda0d9d3a019952a0aced4e688657ff24310db3022935f466f2cf
SHA51292236504575c54d2f4ad5e7dcabf45fe0037e0f623dacdee10a46260e4706cc86ad6d0f3b6a076cc512493e29bbfbf51575b7dbe2426f1796f3f562ba2d4e3f7
-
Filesize
40KB
MD5fd55896f81af455641af0732cdf72eb5
SHA146c7aa4661cadd8ab618a1d7a45481e7c2f191fb
SHA256f20ee5648df8014ae5053e1b289af458a814776205645f0a16dc2c296cdec32d
SHA512b9c835f35f92099246d8661e8f1c2338be1d97a98be981f86698c8611ea77eae033d3e93cf42ae2cba1cb9ddd4e8cda8418383f292dacd5b6d97ea7f41d3d908
-
Filesize
682KB
MD55a74d6e1e8d6f6d23e17931c87a71ce6
SHA1be9025cd82c24e350de45401663c6592f30ecc68
SHA256c4a3bc4ca32b32b1c980c7b3750dcc5c104a652bff8c1b0ca5c93ac57a7c1c2f
SHA51222698ab802ceb08b997770e9bbae65c5d375c9e95dd613d50725ebe29ff2a1c501a6ad834e4bf201bc865972976ae2f0fd02aef1be68463fb9b4b7b618f07da2
-
Filesize
1.7MB
MD56915c5c4f687b5f53b17fe914e2ee257
SHA1d75c3bd4f0d5ac1cf54d6d9b2f5f086859ed1f34
SHA25655fb376e862b273240faee4b1064fb0bdde33056a5ce7b9766e1c3a92a0116ce
SHA512ba2219d3266a0825e30ba6cb66f87cb0d9154fe306e5bdcab59a9683f4b961395acfb5ed19cddd74f99c6330b33db4b9de776e17dc0bbc84a4078bdf9ede561c
-
Filesize
12.6MB
MD5701a38ea8de764af14c49577786ca142
SHA19e84d471857dd39fa6c501cf39a3efddb58006b9
SHA256fb0cdcd8ea7889afa9832c2afe3029d5435504977da33f03046c6549a5f19a8d
SHA51214aab167a6bddb56adf09b285d48318626780bac0de121284359c25acf66120a9ea467e7982899fa320c1d533e3fb5f362687b9027ed609b1a71874bda0fd890
-
Filesize
688KB
MD5cd7b54560d6844dc906e27aee07c50c2
SHA18d560f842f5bdb8ec203e39fe0d3e24c9a3f765d
SHA2566214ad6f4bbea4ee78169ea9a94203abdc11ee30e91c322225e029d030efca36
SHA51288a84e76aada6df18e39dad419b739453666c4ebcfc5e7fe336b33140031a53e7b0d5efd753a3dd5aecd031d4d1be86d0401ca1a58c117de9404b2bd04af1a31
-
Filesize
44KB
MD571afc0c81a872466700e9d2319725859
SHA16a99ea91b2b8818b935710fa1c27de33a686b939
SHA25686f0354f7055dd1387ccc1fa34bf566d88c68e0dae13efe7bd34e515322c974d
SHA5126c59da9fb3b5045855885aadf26a76ea882209b3b3e744d4d1cc3998d15c55443aa2b64e9095ab5a0cd2c951928dad9eccf30ec1dadd3a9d0b4dc338d0fbc0cd
-
Filesize
693KB
MD5200bb3932691e3206d51f91b0bf77af2
SHA191094dd7d207944f290ad9f0514090647d5eb749
SHA25678ddbbc1570543b6f05bbd5f44b1c76f0fa31a6671b1c63a4bee19dc3145ae0b
SHA5123bece683df435b676167618496fdbeef05f6406dcda64800b49915e0482ef142bc26498893d4bad95836290659bfb8b313824ff0feff737ae9758fe2ebcc90f2
-
Filesize
43KB
MD5a5539107288af60154d20dce1cb6db88
SHA1224d2b6999b4c2792c3d2764d914e173fd40bcc8
SHA256c04f9fbc17986c30800e7857a9db4c1c5475ed48be93a2ad408f0716513e0138
SHA5124d80fe4310d5a04c52a1d622337551fd3bb04f47f4fd6f3ad67d42e04d2070dd86819bba867ec297bc8ca24ec5998476d2b747f2f521800aead44198e9db0d3d
-
Filesize
676KB
MD5e3f34b7c454c4157fbe79d6762a0dfd4
SHA17c2a013114c6e47e3b3a659bad564f0956b2d9cf
SHA256f70f37eaa3483476f4a39d1ce1f2b99b8c40093104fa029f0b2761598f5e43c0
SHA512e5993afba185542abbe45a76293e24329c3c8db4c5abe0472ce3d0fe85477ab7b048550c6ac8900dadbfdda71cae0ee4761f2f9c4ce2fdf4515a0f85c9bde716
-
Filesize
46KB
MD59af277f0040e398c78cebdbc0b4fa7a8
SHA1ca6a4d293113a71cabc7115a6318d479df812108
SHA256d777c2fd1e4c30993037816f646832ae9c4c5f4deb68eeee6bf5bbf0e82451f8
SHA512e03d0c3f08777d7e6a1fba1892d983b37a65ec348b89bcfaacbfdab60c4d0637a3bb030bd780f2eb320738dd7fc915f434e7032d1d840700ae653c125ded92d6
-
Filesize
2.3MB
MD539737f9f20f1c237e98d39e646398fcd
SHA1e7bda245b337e6cdedc1e687fbc63c8ce496ff8f
SHA25658ff052bcfbd51b49f34e43ae1c8c6ead93a30d5643342f2417fd97914d8d30b
SHA51249a6fd791c2e7dd928c3d63266efd8f479e492e16427f7d6864ce7923deb7f4eb164864c375f13d7b30b43da0377e5230c22007a10ed0636506abcc3b3959cfe
-
Filesize
1.8MB
MD558b574fd823454d14d94c0c740a32405
SHA17dd4d903363cb63dfb55eb2c5e0db3532afd5f9a
SHA25604dfa173c927711fbfac220c9ab6745bfacc19fcd062be3e1c48cf2e2fc46312
SHA512734dbd7386f3cca0fab5deb48a2c17b0478283bf1cc57cfc1bda270b0d1b8a6f49b162cf28ee25baf1a4bd2555fce83ffc0c1d1f0daf3f697aa9eb8f78006ae1
-
Filesize
4.4MB
MD5e3b29825174aef62cfc81983d6d59984
SHA1a12b34f1f7d14f3360d6d5ed082105f5fc05c5ec
SHA2560517ff9b417946e22a04e148d11808c077cc03ab0475f4756f9132e640c068c8
SHA5129cbb4e291b394eac2ef800578e211cdf2022119f74d52fa3ed6cd5e586f443f9fe81819b4f4d6a518fd2c94f49ea23e77a02ec157e27deff4b52d7cc9e8dcbc8
-
Filesize
3.9MB
MD52404a7301b8831d0e5ea3bf46e28e73b
SHA189ebf5e4070c94a4069405a0e9d879b06bdf401e
SHA256128496e01590237c8eb54318992c173aa55b645cd6c617e22ed13f8f89fc1d96
SHA5126af74a6c5509cbe88e854d70404e00d1fba41ab3737b2253c31494244baebc9473d6209c4ad183a1b8b5997e6a3dce8d3970afc50bcd8d0def68cf1af0afacc1
-
Filesize
146KB
MD59cb97db6cf98af4d84583b7259e071e1
SHA15fa47c2bc778d0ed374e87a5f960cf8eefeaf4d4
SHA256b60a5ebfa11616573036ff3b73e7f83e6e62d00cd6fe51ce6e08e6e9e7c1036a
SHA51271775184ff429b62ebb16f5ee8f8021f239caf275be3d1920f50fd5396966a063afdb364c37900f012215e72ac56a8bbb56ebb39bb09e4472002f13b95701324
-
Filesize
1.9MB
MD5de7991e02d6a02343d5e103d4a540366
SHA139dfaee05755b798bb51cf9a8e10eb2c39b5bb76
SHA25671772eb387c2373d76d7a5aa4a424519356937aca0313d015b6ace1ab74abe06
SHA5128ddd5cff5abc73c4559571eb0a4e86eef2c525c510986f3a2f9fedfcd85f2fb21da8cb7fea62780918534e9803acbead8daf6d949f9bc6b6932fed1c244c79de
-
Filesize
2.8MB
MD53aa10b1b36daa8ee17ffb941d8089ce7
SHA12fa56b18693c1d4cc70e83a3f55cc5e6f1988085
SHA256193e6865f735ded2db770f585be966ecb60561d7dbaf88f1824c4486014daac0
SHA512aaa85b23e7d2aab680388bfd562a05529da3d30dba46fc2ec6c749d5398e66c5c61a5512cdfad0a8dcac902644d23652960cd61cc712ce95bc01cf27c25a8441
-
Filesize
42KB
MD557da965c9ecae0496ed97547e78649fc
SHA177f8fb5b5babac9412562483e6664e580f96df71
SHA256f2ad674694336a5a6633e84c7b712fac29896b8291c564b2d714d9ce0e163066
SHA5124acc5e9df865d528f5f9267c860ea7534cf64c93c0816b44b51b522b4e7d8e8efee14a899e142b191d361723eebd1de439e68bad10a2a5ea42983734b53b0c35
-
Filesize
44KB
MD5a04a2d492ea769c8271e8d0a9fbf735c
SHA152a6416ccfa78da75912c010aa44bde675f24c81
SHA25668c9968cb0bd12d7d6d2cd5c459d327bfc35b7e98cc78edad1ae241895afa43b
SHA5122a9ad74107d2058392f126dea4dc1b169657ece12254ad62e2bb987542fb2c6ead905634504abcba6e9d7556327ad7900454fb05cf383a7724d1d54598f9e2ee
-
Filesize
548KB
MD513a74d916275f3fc3615817db45e12ed
SHA1d87bb5ba5b574506084e71ba6b0ced1a6fc0fbdd
SHA25638bf715fe22bf5340924261570b4abc244c81a0c9429accf9f082cc95a87f721
SHA512a149cb9053889b5c548921f9b70f6252576e2eac05c547d2aa02d7d5f9fce0b8d1cc57d5f256c56d37100b5f78e7e91448808c46aae462e7cfa041ea989e0c8e
-
Filesize
681KB
MD5c7506977952fe36eaf8544d30d90035c
SHA14f20c1a4098b62d8f29147c1d167074dea409240
SHA256a993682d6a30de5ffc3fed630a1dc3c1a485494da91ca74b509f048bb73ccd57
SHA5125740e397ce66332905de2453c543b67187e847acc6b2d3326b62b5fea3cd84e7291647b5cc2641e593feba0d1831ea9fed71bcb47d53e520e1a9f548c746ceb3
-
Filesize
48KB
MD54ad52bdee5d01a25447ff6a45aec6bc7
SHA155f091a9b607aefcd804fa76f5990eb6da65e01f
SHA2564ce07d8017b1c84f3c140f822642fc9f8a2930970dc47715ce02f03df2fe5411
SHA51276e9f32f091db45e4fad5a399003fa68b6badbc85497ff5ee817220ac731be80c48e63aa24164cca1f8f35d32555dba5fb752967dc1e184f5753e9e19f4a4c68
-
Filesize
679KB
MD5a67ae1c14ec80532e3aedc248fc4623d
SHA1934aed1faf8b9c929456590c3a29f30e14b6a5ef
SHA256f5c58cb95c886080cada8bed4c308b6f803c227990444eced6e05afc1126ba09
SHA512db33c8cd6e057a8808c25f263c47fc1e5daeea0018a714cee4b0378f6cd87e53fbf9181a43bc3468297062128f406d0e073195fbd3bec6f1745f18832389ab02
-
Filesize
44KB
MD5370cef1cc15f0edb664543f4c0320b16
SHA1bf8519a578a4b72633220074bb8312546b5d1b4c
SHA256b69a537c9499399f2562a0ba86b8b8340c0f137c38024c93a6e73f0f3f172505
SHA512932c42e8d3aef5e9e2b1fa55e81dc95c439fc63b548ca066daad80549c415de76f64fc770fa90fbbd17c5fbf53b6b6e5737d654b9312f095dc936b8e6034759a
-
Filesize
48KB
MD5dbb7abffbc32d18d9745479ae00b08ad
SHA154e1c46d87dc232394a937fff9451a09055e1faf
SHA256fd74ac57b68bffc54e9d780fe860954f36d65162d166ed65f164da1ba7c60d98
SHA51293546361aa6314f0db2939ce85bca414a0dd91514a5d80e2f8342612dc27beea2fe4f15da877da545cf0ad1f78eff33efae52ef6d2c18bb6a6c9aee77f7eebd6
-
Filesize
41KB
MD5e010b49216faf3e5544a28ea76a97526
SHA1ea3d0f6d2806a90c9e7e3aca7a59442421792796
SHA25608ecb8c3e4ec1d338ca8d6fb5a159fa1b905aaff047420d63b267531c1a0e5f5
SHA512babd25b1b7d61a6f1399ebe7658f9c899330f76886673cf24cbfbf09b83d1b0e56e608faae5d142e2d47f8f42356e4d7589384891f6ddac2071b125b6e7fb7b6
-
Filesize
40KB
MD535624f9a22d343d1f56a9168b8dc0d9e
SHA13a59e11f4edc4f6b437ef20f58adbbb72be74969
SHA256a10eba329a1aca91524090ac3c81798c17f71ff17a3eb85dad0498945bee0430
SHA512a4ed53b16760c20510fc5430c4fe1df64d209f9c9e809cb5aa7521a3baa2d0e1b1bb5b409a0510b4820ae7e12e5a5e1ba3756a13a3bdb6b2a574458ec541c8c8