Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 12:54
Static task
static1
Behavioral task
behavioral1
Sample
3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe
-
Size
167KB
-
MD5
3bfa3d83c3f20dc4f54fc325832f3020
-
SHA1
22bbcb15f27130599ce5fcfb75a63353e75d690f
-
SHA256
68c3cda2c15cbe2cbbd84e254c6ec00c6c7bb7a0a5d66c3f0498d9bfcd1c465f
-
SHA512
3d327220cf5603beec056d55618274375712ff6ec846998c02d2091121c21ab0a877adfe31b4f9d87422ef6346cde7018d950dc446effce31574f7e3aa5b8aa8
-
SSDEEP
384:GBt7Br5xjL9AgA71FbhvoBlLLTBSBFBt7Br5xjL9AgA71FbhvoBlLLTBSBLE7Es:W7BlpppARFbhF7BlpppARFbhQ
Malware Config
Signatures
-
Renames multiple (4134) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
Processes:
_Desktop.ini.exeZombie.exepid process 3064 _Desktop.ini.exe 2860 Zombie.exe -
Loads dropped DLL 4 IoCs
Processes:
3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exepid process 1728 3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe 1728 3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe 1728 3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe 1728 3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe -
Drops file in System32 directory 2 IoCs
Processes:
3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exedescription ioc process File created C:\Windows\SysWOW64\Zombie.exe 3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
Processes:
_Desktop.ini.exeZombie.exedescription ioc process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml.exe.tmp _Desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar.tmp _Desktop.ini.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp _Desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries.tmp _Desktop.ini.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp _Desktop.ini.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll.tmp _Desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml.exe.tmp _Desktop.ini.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll.tmp _Desktop.ini.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_disabled.png.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\localizedStrings.js.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar.tmp Zombie.exe File created C:\Program Files\Windows Media Player\fr-FR\WMPDMCCore.dll.mui.tmp Zombie.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp _Desktop.ini.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\liboldmovie_plugin.dll.tmp _Desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar.exe.tmp _Desktop.ini.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_read_plugin.dll.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\39.png.tmp _Desktop.ini.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar.tmp _Desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_nv12_plugin.dll.tmp _Desktop.ini.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp _Desktop.ini.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner.png.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll.tmp Zombie.exe File created C:\Program Files\Mozilla Firefox\lgpllibs.dll.tmp _Desktop.ini.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.tmp _Desktop.ini.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp _Desktop.ini.exe File created C:\Program Files\Microsoft Games\Chess\fr-FR\Chess.exe.mui.tmp _Desktop.ini.exe File created C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui.tmp Zombie.exe File created C:\Program Files\Windows NT\Accessories\ja-JP\wordpad.exe.mui.tmp _Desktop.ini.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_docked.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar.tmp _Desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar.tmp _Desktop.ini.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll.tmp _Desktop.ini.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_m.png.tmp _Desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar.exe.tmp _Desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-2.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.tmp Zombie.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\libaudioscrobbler_plugin.dll.tmp _Desktop.ini.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\flyout.html.tmp _Desktop.ini.exe File created C:\Program Files\DVD Maker\OmdProject.dll.tmp Zombie.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.exe.tmp _Desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\vlc.mo.tmp _Desktop.ini.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_duplicate_plugin.dll.tmp _Desktop.ini.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\picturePuzzle.html.tmp _Desktop.ini.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\logsession.dll.tmp _Desktop.ini.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-lib-uihandler.xml_hidden.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\EET.tmp _Desktop.ini.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.tmp _Desktop.ini.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\32.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css.tmp Zombie.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exedescription pid process target process PID 1728 wrote to memory of 3064 1728 3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe _Desktop.ini.exe PID 1728 wrote to memory of 3064 1728 3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe _Desktop.ini.exe PID 1728 wrote to memory of 3064 1728 3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe _Desktop.ini.exe PID 1728 wrote to memory of 3064 1728 3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe _Desktop.ini.exe PID 1728 wrote to memory of 2860 1728 3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe Zombie.exe PID 1728 wrote to memory of 2860 1728 3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe Zombie.exe PID 1728 wrote to memory of 2860 1728 3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe Zombie.exe PID 1728 wrote to memory of 2860 1728 3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe Zombie.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bfa3d83c3f20dc4f54fc325832f3020_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe"_Desktop.ini.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3064 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2860
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
167KB
MD5da26ccba4948e458576c991e27ecc65e
SHA1b6d76f7f8545c03b1a58e8aa95d64cc0ee8130ec
SHA256e93872f276d9ae46d160b4903432d79589186d382608eb3ac48b2f7f5a577a05
SHA512825086a3ae12c0826385dbf47c3a82a813894822c201ce9a815a244621a08191669916b75a2593065073707f404735f250e8222b9e096eb105646da66403f6e7
-
Filesize
84KB
MD5c696fce6cf61e3a18cdd8d4a0d3242be
SHA1b1c3bffa852695a11c3594917d1edc06332d83e3
SHA256d6eeec91be7bc997a95a2e402631bf703c0a1e7a2fcd98419ce93a1b32d008db
SHA5125146cbd2cdad41cbae01732fda0097293a59bd3cd5801fde58bb227d08982c734d3189dba08d22a0d5d40493f7f46b558d3fd50c8fa3b1d9cab699b43fbd1daa
-
Filesize
5.6MB
MD5f31d8500cb1129b1906129be97e1beb4
SHA1bdd14c3ca67f14d64ec7043f3d9936b9917f5c69
SHA2560e45e4b7536ba853b0ad03cf03dd0472033445cb9d489549beefbab0f2bcee98
SHA512ff6cfa9d5e5ff9e301cca0801b306e787561076ae9573ca0a1362614d8631603d1a0a704a3a9bf34a6d2586cc7e255eae311be89908edb5ea17efd249daad72f
-
Filesize
3.0MB
MD5c5d5bdfbc98594b034e6f235a5fb6f57
SHA19edb84821f3326f979e7385e8e9fdbf789134f81
SHA256f91eeb37c08c713fd29306fb3633fc1d44e238d6556fb0dfd52b264570650472
SHA5121a235fb133a7993e4cf4d5e6499da179a7e05750808c0a98e7014dc61490e1df37331327b1dc08f6f861ed4f7855eadc26c60a2f4772554f6887bf9ed18666af
-
Filesize
6.7MB
MD54f5199fd6047f04de751c249f664104a
SHA118218e7ea8b4e98e2c9084004b4a81d20f5734ad
SHA256c023e256a6e925ae68e30facb8908aad8c724a5d46dc1519eecb21f305bcb4c4
SHA5120653853339e7c1f8b06fe6e96c8d49bb8c0fac2661bf598c17dcda9e9af5ae05cbc0e1b255dba4e25bf55c0e98a3c5405918d196163b40cc67fc6b5940509258
-
Filesize
230KB
MD58f55c09cdea7a85d5bde72808c1618e3
SHA1ab74fb165c6a6a0856bc07ce9049f32d29b01a5d
SHA256a49c5d2bdbc3d009d1961ae5609eb16cbc4ae5da25efb82b80c226cf872a692d
SHA5125d763d25b0fb5ef745a09683afc35d3dd41315c934e18c6057a7468777fadba1e1116fe0d685dec1ffc0e9609f65c5adc2b678d993849f55c8cd7acee541d80b
-
Filesize
5.6MB
MD5312977aef2ccf778856641ffc88eb25f
SHA185394c32dabe79bff8f06ccf7c437f7be6cf7c66
SHA2565ef761cd672a6843a55eafb07cd2a8e73e00093e8bea582c9bbb8139a09c1d6b
SHA51293a1b1cc4f17fc444c5a66d9b60e9fc419a95f342d8833ab7eb189e0d31e819bb0ee9d4654c35e0e5cc2fa5e0ce3eb05696fec397d63f071b6c5d8509765da08
-
Filesize
1.1MB
MD543beb0bd641725bf4b8426ea6e608414
SHA13a63105411b8b6bb4303d8b35f1be93f6f5e1de6
SHA256c1a8877b8806617ac1b810a406962105aed505d77231f3387180b68b19f37782
SHA512a172775e63abc261d28b3ea9cc63a3df252039333f20678f8816887efb92d562f12c66b9e22904ceb502a2c00936638100c6bdaaefdb5bfa673596dd1d6852f3
-
Filesize
16.2MB
MD55079be4324e4c429b2378acef1386107
SHA1e24ac0b13a0572989233a9a38b5253d5f353fbc3
SHA2560d90f429c2280cf7981fbb4c95ff4421bb5f13c1695d3d496e1b50ba54d9bbb7
SHA5121aa2293cb87733a1c83b32b38d5752edf4d1e7927122267b2ccb23982c8e3e63e78d1161451b2c10565591c060c3a9623c38e7f241ec4d13b673c6342b197196
-
Filesize
1.8MB
MD59aab4a65702a95e633d96d20a10bfc6c
SHA1b2d04d38bc719bcf614b9bf51a64e480ae5fcb48
SHA256694bba0f26e5fa5f5e01d169fb23dbfcac022eaac59e168d0231e4d1b6609e69
SHA512ee50322310212aaa25592d826f3b1d4a1ea9fa85f17c485a5851a377dc6630cdc36216f574a5ac00f4a3084171657de2c61c30a914c4e8a9cacce8894215f53e
-
Filesize
87KB
MD5fa761e15462952044b2f0f729f48887e
SHA1b04d56348a3913ba26e862b2243a042c10b3b89a
SHA2560a6df15038254381fc3ffa3afa2bab12094765de0c7ac469b2e03651dc9cbf3a
SHA512a315bc39eb384039f94ba3371111e2ad98bde972aacc0f60e57c1ce7ab0d3a8e0df530a971ca8c8ac4e47c32085b484cf53ee2b32d1bf24376b34537aab857a4
-
Filesize
87KB
MD5bc72eb9fc20153d20ac7f8f962ba6c30
SHA18a81b04d22fcc9729430c6860fc8144c6fbbd2a5
SHA256f37fe19440d115147962218205d1f196f8cce089ebc1827ad23a3b971469169c
SHA5122b7a9e0521a99dfb765091ff5b38a7fa2d889c6b145741b77a55d00cb80f270c6fc4637f1882e6307a5e47043c3451d52c03f4fe17026cb231add7188522f986
-
Filesize
3.8MB
MD53f0bd75ae47f4ff3b4377d502e09a2b7
SHA160d86e91939b6a9688d7d91cf8ffdca19a2b7470
SHA256cc80f0f94b590a05c103b7eed5adac68dc61ba8ee363bf8c35f84f6a30efd36f
SHA51263c58b0cba405b12d00400391e046261009b11c99343b2f098a3253fe020f13014dd58a582290a1b67b411d5f77f40dd09fbfdb4260f67516d0eae33b4515b2f
-
Filesize
1.8MB
MD599b0a19a8b9cc33fc977b3f01ffe03b5
SHA1183941970855e1c71179c9486e45d092f92cb85c
SHA256d47050f9923a9d9078b58f35d4e5edbbc32cf9284424af5de49f965dcb95406e
SHA5124e80896fd07ec7da22e6832440449341cc1a100e5719d0c5684876b84ed886034a08efc6658e76a7f8747f18569f9424d1d7f42ccc60fefc6b5e77ae53e30366
-
Filesize
86KB
MD5726bde1b2ff282b627f4fff2de6dd9b3
SHA1cf28eb92ff6017dcee70974f5940feb4c17caac4
SHA256622e4536ee1dd2969d188c3ba9a85e0da4f2cc41516ed664998ac2afca0a7ec7
SHA51200f6b9ae38fcb7c4bcc7c5c2cca0c2fa98fd7b4567b9a4bdc8de160317933c16f696b2c2284a9764ffe94f4b1746b445946296168c43f461baf56b84dafe792c
-
Filesize
6.8MB
MD514bffde5e3ad905605aa600eff08e87a
SHA1dbaa6060eeb9fda6e347b9776b02d1944c2f073f
SHA256badbaa3fd854616ca74ad0dc4f035585dc61fd25ab1ca8cbeaeed4b42773aa5f
SHA51212520029158ea94345e1a11c318f69d1dd43bd28f62afe1478064162294968d360bcb94031963d7a6c92db52b819d38e7b1173621441296934640358d6b9d78d
-
Filesize
88KB
MD5ee74cd8be8d8153da1138f7c2312128b
SHA1ee191c786e4a1fedc03c2f6d0ec9e9c315dc44e3
SHA256327dc49f1b106b792037f7b760286f8432c0b97e8fcf925e48647b6c49014f5e
SHA5126eff02ee2439d00f6eade48bb9238fb35dc38bb3acf89565f9e41641ba90a22bd2c5b10f1fe88a6cffb306c7aa7b7fe42109f4bc79e3112ea0f4d46190b9aac4
-
Filesize
1.8MB
MD55a0fdf2d7f98142995b9bce17812ae87
SHA1649ad9316e3367d0252829c911f7e59a5de7775e
SHA25697af9a290a1c12f2b4d4e7df8b0eeab99fc9904c1527689bc88c9e3a7b71698b
SHA5122985bb1855ddea603fc2d6a370ae1936ad5492a808f5911b01d3a86715215b41aee0492af4c19910f316f4bd87105aa7b57b468f5f0468a7c4e5383fa2b60736
-
Filesize
1.6MB
MD53b60e624a38596a3919de593b9bd9e41
SHA1b01f4c5d4e1e570844322809542c57bf9caf0825
SHA2564650caa4a90b7ce576006a342cd74405260fd91f715d3ece38666ded6e2dc1a7
SHA512df4cd33a7601ac4bb507a300f959570df9bea79e30c5280a50e2a52502231dbe5d36f353af703a94064f797a23ce8b727ea22e04757d6cf6a58f8d19126fffde
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
731KB
MD515fe105894d4433be6e0da9cd6efa5d2
SHA1288f90c74a9d3b445356f5b537c9a5758357fc67
SHA256644d054862bd99c8e70d7fb54b32654b41c96cefee5dd74198ae1ee65ce3079b
SHA5124b8a01d1199ab052cc3274a8da9e85c44b9411b4be6152ddcf869f648847fe9a9dac341a95f1fed885e0e6bbf135a6d38c424f9101e536ff7e9631f3033574dc
-
Filesize
1.6MB
MD5aea0cd75de23a39d22313f94ebb15b21
SHA1c3fe553542f6d3fc46c263f082ea7f3e74a0c555
SHA25640b521450d1bf181ef631d88be521bd6c927610130c2285d35bffd223f130c60
SHA512d612e2592ac848768928356f06672a3c5b5f9d75ad275db03b22589a31bf34f17519e06252ffdead5168d868ae021849685f24f1629fc84f5c33c40a847b2e75
-
Filesize
19.6MB
MD52924253d1a41c4129ad8c35e9cdb7d80
SHA14d4604d707ec7f1f28fbadbd3b68f436442d845a
SHA25656651b38b26e645ba370fd5d445b9692ecb90f946531614de82cb563382e9694
SHA512472bd6fb446151997ae037304e3476be8197b8f1894bea199b553ad23e84dcbf9d9b46120ceedded045c6673a86df7740144383ef96b9e6ffafa83161b228d7d
-
Filesize
719KB
MD505b8b0b74b5887fd4f800399720fa7e0
SHA156134694de75761110ec7dd7c39da05de7fe38db
SHA256370cf82bce0a068525b26fa1e7f37eba1fb9b316559d26248694112164c8c9bb
SHA512c521b087222ab07b82f680b7dbc94ce6745e96c2e38f402c88d2d3017f8fcd462f91f04b45f4ef16b7dd5f1ee96d2b992a233d744e38423ae4ab31963ce8d7a4
-
Filesize
1.5MB
MD5eb93cb0eb2e8cf45ce2dee14709dce8b
SHA10889139c8b0a3c9e9f12cc535c915097f5530cb4
SHA256e79ed539e474c79def2c9a550d2295c6b84f3621ffc208488be0c5e1a7b94e20
SHA512c28786fec250b225ae31740e40201652b84481470c8dac0e7f6a841c20f1c3c3b2d0661edd98a899655d7c88e4bc7646e08fc22f5c96898de1661cc2a3c01356
-
Filesize
2.4MB
MD52e4bc07fcc1bb56f4fe9f67ba669cb25
SHA11fde7efb0460dd0cbf65d8a579812322417fe169
SHA256dff63b0a3f138db5c437837c28cebe114feb4345788f42785bad1b5a13810a8e
SHA5127f44630d389bcb4291ee9f61326dc0ff4e313ce12352fe405ccc7ab2a16a35d08fa0240f6e870496bea42e0d30766fe5f2a2d522c62592440ed7e92cc7c9f196
-
Filesize
1.8MB
MD57599d7021409531dc57d2bb9b1f9faba
SHA150ee3b878a8bf7dad8445df78797b837b3e32d41
SHA256d354fe18d083017bfe03112817ad80cb8246176a21af9ac51aef04679ac30675
SHA5127dba324ac81d885e94210858c4c4c48933dac143f317d6dcbb057895f3f13f08fd814bda2be236ad432ba026a110c46bd1d29f4cc96f09ec8a37b45b6cef5da4
-
Filesize
932KB
MD506844ecbe21a0aca610d0a532a13e135
SHA1b27eac8d4d595b1f4afe19dd6573fdc1b62f9d20
SHA25650df6956bdf24f0c98c7b81ba7a46f17334a028b0f313d9d48ac06679b67b8fc
SHA51259afea0417c5f0f58103de1f22ec7bfaaf723be25c4fa7fc024e6be7e04d30b0c4ebf000a4ebd8727764efef9e68749531cd73c6f1ed5fadedbfde008a96cec1
-
Filesize
2.4MB
MD5a547c1759fcd7cb62339c088685fa36c
SHA13038c0e15643e23ba1516424632cbe6bed4fb037
SHA256786fb344024113a21ada2c37f60ffdb93ea063701ca5fda028f3223a90409951
SHA512727f73043aabf8ebb016db5d71a875aede8def3b75b0a3714d3e11582e80d4986a06affc59853b80ecf30373664261924005b9ace8d4967cdd8f62c2e00ad4d0
-
Filesize
188KB
MD5bd7138107cbef325920e24dd0ba52a4f
SHA1ccbd670ed3b33626a400937fadb482cfa7aeb192
SHA256ac8862317850d047cd7beb94c58618e8c72fa75b277a1c44cbf4d32ff42c802c
SHA5128dc13f203596a51c820667cc82cff29396c1cf24a4eef32199e54a3d1ade31ad6001b3339268450d749b7188a712f7e79bf8e10604c47e6a67285c91ad5b0af2
-
Filesize
87KB
MD509a7d3ce2521b374a653d2d35e01a527
SHA1a09329268e958b1b094200f9d8bdd80fc64d8ce0
SHA256179bb65b000579e0a02f01087d43a20780ef802208714ec37b6495ed28db7166
SHA5124c7f72ba451acf5935cc1b8b9b1ef7f570e7bcb6503e8f556d5249feb2e44baba2f354d5d2f4c3a8d31c35b21464b9567e798f0e33da862597b3e730248b46f6
-
Filesize
13.7MB
MD56d4c6daa77eed1314ded132b2ed6ebce
SHA1435120ba84067ed522cfc3a069da3dfb823dce2a
SHA2562826aa03c6d8385de2463575896095aaebda299cccc4e7340537a76420731685
SHA5120a1768fb7db63b8fca67339e36d9ff6298038391ac490e13e149fce10eb13e5019b98cab8594ed300605309725f7fd2ba602074c3873798b7572c8b2fecc00c0
-
Filesize
2.8MB
MD503c901a726360a99274192e5c4f36609
SHA1e3fb6cb7df62038fa50c76d77a90e7a5e07b9ba4
SHA25692795e3ad821b080068660006745ede0e9fb14fad5efb25b43f85b6303bad26c
SHA51269954ec9a821aa4520c6c7d89bfe7758c5f48b623c288ce25d288df5ea8c30e5487665f39b4bdcf75ca9150a3bbb119a8aa409cf14c366493ff3973295b5e8d0
-
Filesize
719KB
MD594e76813d7a0fbbba6a62e7393208186
SHA1450a210648870bfb770687907b1484accc4352b2
SHA256fcc320541e103c31704cd458d4415178ff0708cd82ded2134a532fe50ca7accc
SHA51241e0f84e0b6b18e22b8f92f0001f7e5b846a0e6295d9e52e0b5e53e376bf414b425c866f99906a7ebed4e834856f0caca2e3bceb72f0fe3062a409ac5d60e68f
-
Filesize
93KB
MD592235c369ac9884d6bdbde1eddf77e6b
SHA19e37c9302554a5962685d689b8b321b0a59a2415
SHA2564c2816a2bb4a68bf522163da8458efec8bc971bfbf0a410b864f40948eb626ed
SHA512536fd32dbaa6dac14d2ecd0133e7bf48794cd833f45f5a10fbf34ce0a20469fed8dc037dcc91aa25b447af3044132942c33182ace2654164e07ef5ee260da0ad
-
Filesize
91KB
MD5ddd259ae61175a6a3ac81fe5c14c57aa
SHA1a696549adcdbbfc31ada01bbb64d4ccfc132793d
SHA256c078bc674365473b080cb30396cfbc0860caf7b060b4ed0e74366e1bce210af1
SHA512560cc1a09fc128a61c659fb194223c6ac7fc56cde41bb7401cb48a865dcbe40b161a804f2f36e460105fd5c2a573f0d443553bb2d266e573e4a9ecd21e1b47fd
-
Filesize
92KB
MD5a2e81e583a734cd4c2e92f1a68b9d197
SHA171088dd855998e48bda20fac5fe4eda23c77f7d1
SHA25604725f68559dc0df675e393af870670b6b926c82888feba3346c8a6a8541a983
SHA51233f40b7e3cd6560b354e8462f615bf641115281b13342285c09d33dccabd555ff2f56b4c03abc6e6f92e8359c6a3c079fde2857b1f0ef3c38315d96f39845348
-
Filesize
598KB
MD51b7ca8022f62f5be449c997f492a93dc
SHA1b3ae6de63202338af28281b85a5243ead57b2f9d
SHA2566fb87539edfa2bdd6e0ed6f38439bc651fb2315232fe0c06aeb68933548b66cd
SHA512d0d776835a406c79c2ca14fa57dc29c65fdeb855a13afb8c3c257bc0fc64d547d3a22e870899f44ffe590814c6e1095c4841b7c624a43074492c0830294b872e
-
Filesize
244KB
MD588bbbf722f46c72c1bbb2ca83fae02e8
SHA136181027e4b8bce80c5d377f7297cb7498be4f67
SHA256e9959fff99d2d3a4424be54da0a4ea55086a64b5e80658011bd881804ae61c28
SHA5120c190f976304e1fdc36860b023e6a83c3d95b13a62b1c15695b384c8294e6025ea43c53fff5d7b018940f24db9fe717e24a7e503ac8735382c018f870f479846
-
Filesize
110KB
MD53a6a38fc24297e8695b3e3d18becf1f5
SHA147b2336b96d9a5a483069a46dfa19ab8aac0978e
SHA256c3d5576006f49a69e9eaca768bce78ca48c2ae979f005425dde3f9bea6e515e3
SHA512c3c30b6a84642c80ab700572c9724cb431755eaf0c9bd090a838de12fe80027e6f84de34c2f1358d056e2778baa65ca615f8965401477b236d06da50af3792f5
-
Filesize
88KB
MD5bb19949792e98ecf79808e46afbde9eb
SHA1b41cdc7b866b4b67253509554ee02d369953d079
SHA256f2b96beb14c4ce4a3ca0565893207a5c5db866669e5ebc067c084946e7662bef
SHA512ee9f1ec134ef25dd384d70bdb5c8c7a97d126a6f6a086b510f2f80a6f16e001e8bc0804e263019fb6e2ef1a20d37bc5bee104bc29c4c5f84f47b271edbb36482
-
Filesize
1.2MB
MD5ec2fb540f57354c566d4f4a6582915b1
SHA12184e9efb5f1823f26df6a4b91bfc3233ed5af0c
SHA256473e608983d1e3327eb4c70c2eb7ba54ac9128277a8541f20234768a9a0e8b96
SHA5126a32d4264471a3c4071a8e6ba1c19d0abf383ac6b5827505263c6d6ab0d1a512bb3563fc2c3cba6a6c8e8424cd1e189af153e31fa23b35413459c343dd1dbe55
-
Filesize
88KB
MD5e0e55a542afb73028a2e110de0f37dc5
SHA193f42bbc2cac9671541b5bd7ae59e59883da90da
SHA256f86c12ed54d3a428d98ec44199a77925e0fdcfe106689b6513b69bec24a221fe
SHA512e4add0401f47fb38b1491d69b858aa71bf262575016e1f705903813dcf1d83f5488dde7cdc4336d6d3639d4156552bf9f5e5a527e74507090976526282145a03
-
Filesize
719KB
MD529e1db88a0d5f793c32324128c0a1299
SHA13fa89e5937314d22bcd6ac9da415d720204790b8
SHA256b88ec0101239003abd4e36bcfada09b1ef72e501497cddc3029b3621cdf51127
SHA512ecd6e2ebc967a4dda88f647c628a36dbf76ebcce17ab78e9033676d8c65bd631c114d6841f2950f5f77f473e27c65748cf834a5bf5a982581ef03cf4bb8101bb
-
Filesize
88KB
MD5223077f93d279036882d1dfd12e85998
SHA1915cfc737fbb05c9fc664379a110d1ba330fd0a5
SHA256d2007b6cd3fabb84bafd64f47b338e5a756df201cfb92489271a3925948b5284
SHA5123c2e073fd35e56d8130d10e2bd7044ed4e3fab3d44b3a42909580dae76f9571a3b41d73945e672b2a1091409a375b8a39684b3afebfe14f29d156d368fba3a50
-
Filesize
92KB
MD511c2a559de51a7c7d8d15d12cc8090b8
SHA1b888cf2b16bacd74f61cf231f16df26420e07541
SHA256316400b041db36d2676faacee5bf2a7c261e8d02379257e29d9355f8d83e87c8
SHA5126c51f20d80b50b695ef923d0f4c117361f8f4987b95c10057089ee1123f74a1077b36ffd1d9067bba97e1158b405d11a957fd2e7394c869861236c35ff65840c
-
Filesize
88KB
MD59ef934ac3d04e11b9575e986e41885da
SHA1e186a8f3c818766322590132974670e06eb3e748
SHA256b361413763539c1760f9fa1f9d776954eea2995fcb4db764309c2380fb19fbc6
SHA512ec51ef6804efff0c27e70cf24171238930728646ebc077e4b214335770d0f3259e04b4e0f252359514c24662d07b58219484803615647ab529cc3d6cd092be63
-
Filesize
86KB
MD5ac5f933a8cd3734f9795a492f032764d
SHA1da90cf9532ff3e5016fc03aa81be690edd9c701e
SHA2560371bbe152115dee35f1e80c2a73ab0edc1517ec1d9eadf89034b2a7cafec084
SHA512e3d677479300e0d943931db01b5295d9795fcbea849cb47329ff3780948fc3fd479d3bc81c8246930fbc2a6dacef420c0f742090d0b49fc315fc91e584de765a
-
Filesize
666KB
MD5d0f27aadaa1caa1bef7d371f4414d2e4
SHA1c142c9389a742fec8b288707aee44d78060ba133
SHA25678bf1f8f7856641c687a85fb9d949e7700c69bcf745f2d21ccdd715751aef5b5
SHA512bd5c09171779680ce15de9937cf2bef099bc876b8e4f5516a68bef58ca28126ae51383230c104751961123653e5f0bad2b104a8e5911878c767a06c2cc932cd2
-
Filesize
88KB
MD591246a597f32bf7474897d14df0cb785
SHA17da12e7480e82a97bd24f73bd829544011443101
SHA2560fe0c41ae5c4cb8b81806d7cec7a4fa99eb9d5aba7f8eb222f09c48ceb5923fc
SHA512584296ede89bb075225e9fee4364313a5301a70b7981ab7739b9e77f9e349faa1073d27c62f3f58cf25a389689cdc2868b6ba96293c82db5b1740b2ed23e544b
-
Filesize
85KB
MD5ed1e7e35c4f43acf86901233c01e1173
SHA10596b4ab3d558ba19fa093d7920ebdbec3a4fe85
SHA256866f2b4abe0a60bbd8ba9358171c9c4c9a44939468a0391e55c6db9dd2e4cf6b
SHA51243783cac3bdbf09c7851b1e7e931949adf8fb4664b56a64d640fe64c95e8ee733bf19b41afeab278c54aa7c3c181d8f34daa73a08e3b667dd24163fcb8486997
-
Filesize
89KB
MD5e0f2d51eba6ab7bee5498ff348471465
SHA165d951148364d02075d6aa6b6201a02420e0e058
SHA2566ee1dc1fd0bdcb185923a5976a5093823c05f192a6d0faa06a4014b20d4f0f32
SHA51282d8f7d42e82e47607e789eadfb301bb461b9ac010b3eb147a06dc50719c1e6a378bb8e7b26a178a62bfd5723dc9ab40b39102c533aa382f5d7505899513c149
-
Filesize
84KB
MD51aca7c9ea2aa00d865c74d418cd8713c
SHA115f75e30447bfc9b0928c91c328e90b817404b6a
SHA2568c0427c5c977e6f377b92f8b7ae73f0b3e70eb0b21bd17aca6f5db8164cbfa28
SHA512c5c62d0f13db73bef7e9a650aef9ac9b5bcb4cbaa58bb8d15b04ad8563d1ea6c9881ef06e31b72f39dc3e85207721b7862f4eb8cdb4aaa53c2c14a39d79b091c
-
Filesize
83KB
MD5a27b842097da8fe8d4237a6bc88cde16
SHA1e086d437d569538638b494d03d10f37fb4bc96f8
SHA25617fe786f798fb1a7502748d16988136fdec18f622d908379cd1f7366e7261724
SHA51203341ec801b4ef229ce6c9ee650f87cc8ba77ae1f2d7c51dd406fdfe4984a1ca56bfbb16f21868e8a67a10420d5e1f7dd7687398b1581962ceb23f7174f87a22