Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 05:24
Static task
static1
Behavioral task
behavioral1
Sample
d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe
-
Size
152KB
-
MD5
d8e4fc526e8bd772f13dcb87f3505af0
-
SHA1
060c11a19f29516bafe9b1cbe2cd3472918bee03
-
SHA256
4f49c3f34e70b37bc5d7786e4670c1167b535cfb7a0c3752cc41825fbfa44392
-
SHA512
420be4ca6644ee9f71a825c41346f0a5240f089c08e4b501a6fbe329b4046be8ea47ff5a58ca9d42bb655c36a883cbc0c4e0bb262a7d3123bc122697a701406f
-
SSDEEP
3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyB8:PqFF2Ie+eFnqFF2Ie+eF/
Malware Config
Signatures
-
Renames multiple (3682) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
Processes:
_MpDiag.bin.exeZombie.exepid process 1884 _MpDiag.bin.exe 1072 Zombie.exe -
Loads dropped DLL 4 IoCs
Processes:
d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exepid process 2020 d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe 2020 d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe 2020 d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe 2020 d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe -
Drops file in System32 directory 2 IoCs
Processes:
d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exedescription ioc process File created C:\Windows\SysWOW64\Zombie.exe d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
Processes:
_MpDiag.bin.exeZombie.exedescription ioc process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml.tmp _MpDiag.bin.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.tmp _MpDiag.bin.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL.tmp Zombie.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif.exe.tmp _MpDiag.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Taipei.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar.tmp _MpDiag.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+7.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Port_Moresby.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_zh_4.4.0.v20140623020002.jar.tmp Zombie.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr.tmp _MpDiag.bin.exe File opened for modification C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll.tmp _MpDiag.bin.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp _MpDiag.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Ojinaga.tmp Zombie.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo.tmp _MpDiag.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp _MpDiag.bin.exe File created C:\Program Files\Java\jre7\bin\jp2iexp.dll.tmp Zombie.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\London.tmp Zombie.exe File created C:\Program Files\Mozilla Firefox\crashreporter.ini.tmp _MpDiag.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet.tmp _MpDiag.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-queries.jar.tmp _MpDiag.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\imap.jar.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar.tmp Zombie.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tmp _MpDiag.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.tmp _MpDiag.bin.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg.tmp _MpDiag.bin.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp _MpDiag.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Eucla.tmp _MpDiag.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.exe.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_h264_plugin.dll.tmp Zombie.exe File opened for modification C:\Program Files\DVD Maker\PipeTran.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Halifax.tmp _MpDiag.bin.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll.tmp _MpDiag.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_dummy_plugin.dll.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp _MpDiag.bin.exe File created C:\Program Files\DVD Maker\sonicsptransform.ax.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET.tmp _MpDiag.bin.exe File created C:\Program Files\Java\jre7\lib\security\local_policy.jar.tmp _MpDiag.bin.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp _MpDiag.bin.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png.tmp _MpDiag.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp _MpDiag.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp _MpDiag.bin.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\YST9YDT.tmp _MpDiag.bin.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\chkrzm.exe.mui.tmp _MpDiag.bin.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt.tmp Zombie.exe File opened for modification C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-9.tmp Zombie.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exedescription pid process target process PID 2020 wrote to memory of 1884 2020 d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe _MpDiag.bin.exe PID 2020 wrote to memory of 1884 2020 d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe _MpDiag.bin.exe PID 2020 wrote to memory of 1884 2020 d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe _MpDiag.bin.exe PID 2020 wrote to memory of 1884 2020 d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe _MpDiag.bin.exe PID 2020 wrote to memory of 1072 2020 d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe Zombie.exe PID 2020 wrote to memory of 1072 2020 d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe Zombie.exe PID 2020 wrote to memory of 1072 2020 d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe Zombie.exe PID 2020 wrote to memory of 1072 2020 d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe Zombie.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d8e4fc526e8bd772f13dcb87f3505af0_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\_MpDiag.bin.exe"_MpDiag.bin.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1884
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1072
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
MD56e02cb49f0f9e98c04e62ee468e728e5
SHA1b860889b32e7e177e27c360d0596287403debabc
SHA25661e5ba1da46b73f7e3d1506ac38f97202cb8a859223da30212297925bb461fc5
SHA512d992d7e3dc36b84fdadf93b6eadc17932f6e68f2d675a454baccbddc9b5c94bace7a03832bcce124a6fefed994e23d523887c0c5e561b8cce1b6ae06691bec7c
-
Filesize
76KB
MD51db0b1a54940a5fc045d6932142b1b96
SHA1037e4fdb3e9e430a950545ff561c51892f461edb
SHA256c476c5cbb4e26c8fb364f8fb1130c2af09c56697676dda0274a44fd7a43cae54
SHA512e0a260cc22512c3373ea8a78a1d4079e9b67e158b437556bba5fb7e1e769e0206577c496ef513643872894b6119e9b382f1848dd318f625d9ac97278193059d0
-
Filesize
4.2MB
MD54df933c8153472195ef5549c2e022ef1
SHA1cf31ac3675c35cb01dcce83b5e349901be50aacf
SHA256504dac8f8df08c16977226451bdcf5a2ef243af1448211e317e7f502416a38eb
SHA5129aff9628e430401e84a12acd1d0791cc7131c30a4573681db5e87413781a45ea6d03e5e447aa78dac182422f9523b04be3b7d8ce0d1e569f5603042dead46397
-
Filesize
3.0MB
MD51c62f1288045fa42f181c6d3d8e57acb
SHA1bbdedcb93abea724c1943dc5ae5d5fb00f9488c7
SHA25680588d00aa74ced4b6da05fae697383a0c2de557f6e12f5b289585d4815cbaf8
SHA5122d4f1bbbc69c23d1b758e087052682310b67e6298978093494de53dc0232231eccaf27acdd43338b1c8582da8da4e8e83fdcec207ab405b349db753892568436
-
Filesize
2.2MB
MD5e1528913b34986dad9cef13137cdf06e
SHA1d9f05c15268748af33e4e88d9275ddd7886547f6
SHA2564759c8821547fbf81035ac0abe6b2c07dce43b8f64c90cfede4ac02c26908f8e
SHA5121c59fe072b130868de236743aecae423ad6bbf09d02c429fa965772f1ef2ded44a8f5d78efeb931b28e34c490708ea2616c1cd0a9143891b5a9198bbe17b763c
-
Filesize
222KB
MD5ff8a3a0b70a3dc06d41dc9b1e4b593a2
SHA12a2aa01bc1931f26daf67962e7c23d8578957d6a
SHA256f16a110f2e6f9523370176d7297441b027116cfe04abdd991ae360fee71990a0
SHA512d548f5ca5d3de2f84f2e75414d2047d9c3a6aedb2101ea272b5f5d40eb2a777305a68be593b5f3fe72d9bfeda17b45e5e53bd38e22d9372254cf13c064aa2654
-
Filesize
1.7MB
MD52dadf4274dc4774f6af1ed220bc7039d
SHA14e189b82f4fab9e24845d3acd8d7725ccd5ad616
SHA256418931064c2f202d2d22f3e5bf22cc8dc08de31beebbb48254b07dd6440f0c62
SHA51238ec5526ee1354f595bb0be44f56ac9ac8e70f068f21d5928bc2dba33d1a8628ff2b8610acbb48755faa27df0ecd6581218bb03170273bef45cd5046f141c2ba
-
Filesize
1.1MB
MD57e9cc24959ec71e07e97d20fb911bdbf
SHA124ce819e00229ff75c56f5050ce0d1a74608ff47
SHA256d3c3307be91b225e6848b1dec86b3ef0e12fe14fe8bdd29cdcf619a24bbf16e0
SHA5128d431ee3afd02627b747ae48c78acaf4d602895d9950b9c385a9709deddc63ceaff93dec3c79ef44662e0744418aa513818766c71c03af9fc25462f4cda6836c
-
Filesize
16.2MB
MD5e4c175da0d9e37375671fceeb4e84212
SHA1f563d1ad3ddab3ec1d411e6504129aed6c8ab381
SHA25655e446bae61ec8582019ede518797ec54e38fc1a31b9e770fd964b7b1b3088f3
SHA51239a1d9d01611865b7c7758dc8030b387fe2eae812535f0a22b9d1e851d079705882d3cd94ec47a7c5c1bb18849c455f12f675f8fe938a0e77313b23bff623afd
-
Filesize
84KB
MD5dfc499cbf6360573b2e3754aa47ea3e5
SHA15f0cfe04c4405db20ec086f50c5040eefe5bd122
SHA256e6ff1d2cc24574dec4f0d1c33365358a9834b84debace24457acaa6527d0d514
SHA512d516f823eb2db13ff5da6acab205c48679c02d2f379db3252872841ede2fccc3075b2b1135dbd896b665e3a6b027afd2ec90f8d65d698a5c4207f254353df9fb
-
Filesize
79KB
MD533da759a048f91a7f11a9d3b3d1038e8
SHA145c00d2d167ff62f7926f7e8b82420376b22ddf8
SHA256308f4d76c4a0b7c9a2ef87fa2c20c63ffe1b63799de44936b283fa79db974ea8
SHA5128493682f94838c5e8a309a3824e853ddb1eada78a9f19bfb6d713509e2c18dbe00940eb14d27c9333fdaf41bbf0b2e55994c4a8da414f33911fbfb9908f0f397
-
Filesize
84KB
MD52f1a978c8b8e28ec807123e062b984b1
SHA1d308833cc6fb7042db14502c2025692eed84dd83
SHA2568a078276d670a33f1707510909c43d08c165f90bd5f8e6a26f826251dcfa4d2e
SHA5128fd0b16ec4d9261ae2cf1f42ab1103c85c3f8e3968483ab86e122b9301e1e9593d2e6bb7939e9f50cb06b493ee3edde7d5ff367eb78c7649c4aadfebd4b56395
-
Filesize
1.8MB
MD5aa5f6dc7642948d0c8a52ebea9a4558a
SHA19bc5aabb2b8f49f1217c2bbac7e4324f0c3e84ab
SHA25648adcbc3f176d07e0ba5f063cee2f2d02dd54c77534911c0e246a17e77a242b7
SHA512dd1ce9d5772a96d9bb9af69d37f5bfd79602b6b25c99fd064adf0d80f17c18ce25037240bedea04b06ce3e5c301b0f6b468b637d1af88cdfc727a3282bb6a753
-
Filesize
732KB
MD5a8ad580618ff88b9799989b6b40acd7a
SHA103d7990b980386eda2bebcd70e3d52605388cd01
SHA2566fe7cab4663fe51ffd9e71fc18702317e0053790461819342ce1ee985cceef3f
SHA5123e42b981af43c7679c5d06fb68fa6bc46a19c9e9a479d04dc612145e406096a2279e7584d95c45ce6102ac7c29cf22e203472863337c36d2d5410102e4cbee9e
-
Filesize
9.6MB
MD59737cd7fae5e8194a4cb54ee3b046da7
SHA1acc60ac08fa67c36141d3dec4c65c9c33172f3f0
SHA25664e6fc038d16568635e9bb9acccb300b8435703156a364e1b14dc522a7c43082
SHA5120ede414a471c81e96b665b051e9dbf10b4ebfb196428131dae9a5004a459330fdd233685d024d3536b5ab231fce1674da4238e599ffe4dba4fd2b4f54e85af2a
-
Filesize
1.8MB
MD5fee6f1ae175167d83417d6efd7e20f5a
SHA1d46bcd9c862bfdbf919288d8a98dfce269dc25fd
SHA256b9641fb7dc847566f670bd1599687d8ae663ce4f37032d7446285f2a46292d25
SHA512a7e2269623058bd29ce7ecccf284bc96606405ea91de9989395e5208e9d576b86d37165c9eedab182e808d71a5c1210af70eb83e92384b548c5be798b07953a1
-
Filesize
79KB
MD53ac7cbbba119f465f527f818f32d62a2
SHA164e8acb9f478c7e8a62da0f6775fdbb984fc43fe
SHA256de36fa06c37687907e757c82a11c09dd3d41c2ea0a174588791954fad6e8c712
SHA5126433cbb2032781a1e9b68a872e2420f112eb66f8b516d4d52eaa3a45429fe13128c81aceab0e4553afb125910de7fb0b66cde965b97d6cad1a080af21ced00c5
-
Filesize
2.1MB
MD5a211e62a4ed588583f836173a04a22b3
SHA1fbf9edd3144d7860da0181f58a694fb7a3b98af1
SHA25631b33b8352c4942a775009632231662fc9225ecc36a8f84934b0382fe0a62dff
SHA512fc9ec3898ecdc2455a9c70a228c65590079080e87cce2fabb4ba582fcc54d83ace3565acebccbcacae948d7b7539fe4f9f212e9f1137e8d6c2a0d002edd89fe8
-
Filesize
60KB
MD525f0beaeff2ca037123dbac52a2d783f
SHA1a9379d3d3688b652504a039faf12188a161f71e2
SHA256e0c3d1c8222292b812170aa878024dcd94c188addea7fface62957cf1f51a4c2
SHA5125bd56aaa9244b3ec3552d0c30c96eb0e74789ffceed617902d91bb928d4c20fd1e0005f42de5de9e0092e70f67e6925bb81ba81185337490f8b7142eb3239355
-
Filesize
1.6MB
MD5f6e67e74f3f9212b88e3692a07ffcf69
SHA1a1dfcd3da4fbf3dc6effd96e2819abfecaa764b6
SHA2560436fd90756d3c683142af45d92586ee0169e6e9d4485b91eb8e1a37045abe3a
SHA512f8d770bc7e7e61c07448cda78b68be284a6d56b5d148acd2159d36aaf849dc217140b3ec93fce9ea917acc8b64bc7f98fda0789d75f424ff8f0efdabaa599139
-
Filesize
1.8MB
MD58dead779d33a6701d56f35f77626ff7e
SHA18490320b4194d75a3e052a58bd1893ab69a8f22c
SHA256794dd5d610c556ec0ac44642b5e12e2cb9c1c17506196787b57fd8cfdd4dceb1
SHA5122243dae9d6761b9efa1597e6dcc4513604e3f54730f6d591b2e01cb13e26b47d118ec7252a42a8bb969921aea9930707e0d3b05830425dbacb4038e63146d50b
-
Filesize
1.6MB
MD565526dbde86984efb7e9c67084032600
SHA1596315f843ede36630b8ad14d9802fe22706b4cd
SHA2563d5a8cee039f79f39f79fcb443d50e887e09ee855b79c389ec4cbdfbdb72b16a
SHA5127d24e3de7ae038dc6e9efbe4ff98a34ad6ef6034e197735a1d9c630fcb5400ba08e41fdc0847ce7df9a3540ba6ee1b18365c4145484c8e45a557617941e8e412
-
Filesize
723KB
MD51001dceaaed71d72f5b2436430cd0788
SHA130ecf80f32e7ba9f7250c0aed73c01390b2b2f4a
SHA2566f4991767655074e17de28a846077b4127e4c3a4e3fed1103546e5608f5f9b7c
SHA512d88e53d3645826703264549b21a0a31ef0907aa249f34bbeb0027c089b5544480d389a53988c41ecd99aa30f53defffd43a6e6438dd78d1b3d90c5a3becfcf57
-
Filesize
432KB
MD5400a9daaa73df5221db5646ea946a5cb
SHA18ed53d76419268f1d326f7bd5e69b486cc9f789b
SHA25670bd77c4d6ac9668a6d264105b85a2f49b1b43dec2a4222655ae44a137c80dab
SHA5121f84b1236fe0af26aab7bc52d107c408f495c6c1de60a996f01ddea5a426c3e493ccc4cd1c87d091ac90d20c0ef9d86367fbaac9b15f3321f297636a86a5c069
-
Filesize
19.6MB
MD56d7cab5ae4ff3bdcc6496d0f73cc09e4
SHA1f0b7d0c07db32874dff42e90d1cb98d9d8467ea6
SHA256bdc2c3ee6d4661e288aaafd34d2157a7c9be679f7f64fd2fe1153f439b06e1d8
SHA5125797b2dda2394f264ad4005a3128ee67b2de2e13045baa7cd79946d447c276d6bb523bce2cde29b515ec33e32293a8a8248580339aad3e92c6d5db8163117e80
-
Filesize
140KB
MD5532df5d9fd8a755bb865395527a54067
SHA11520c8da4dfc498c46bfca2d952c36574741d168
SHA2562b4a3336de553558bf8ac830f3e4b332d133968f6e324c5c27f725a1dba66a56
SHA512a0309e75dabc059e63f525d632c7fc7071818894ec71ae096f7d1e60aaf786b7fd0950968b8d0637bf1d2186b550644d4de1fbf6c58784635685462604e9a691
-
Filesize
711KB
MD5a7cc6f6a960c54657d291190a06dbfe1
SHA14496ccb68b33b411b6bb4e6ad8fd83d64fc337ac
SHA256803046b302251e842c4f3b766fcd371043150c57e84282400e3c6ad339a161e2
SHA512d73da172b10866d4afe6a046a57f2a9bc9d9c012d7a5a412825d1748cf121ee408c3301ae0ec229b6aeade06f3e5918a17e9724a55c99c1fa088562db9ba101b
-
Filesize
77KB
MD5e3ac1cef2c1b4dea680b62431c1f2c8c
SHA1e79ce3127769ede71c43063b607e910f26ca04cb
SHA2564e38449a631f50fe7d623b2417a68a82b056595f495943a0ce8df39b6cc8663d
SHA512b31644276da9187aff7ff3e9b24bd4bd99350daa7ddd8828a67068d427b943a80804ae30be5e29b9f03c9539437a55f3f3a59fb4deee5463209bda42d25b2ba1
-
Filesize
32KB
MD5976889b9a8281f9df94e1c685b89bc26
SHA1ae693ac15bc5631550a5d86adfa5d24e9f953783
SHA256333df5d7442d4627eff9d59d69b39b6464164c72704c63daa446c25b338eaab4
SHA512cd353f29e02c77f2390b4d6db24503bcdf43ba5685212eee96954fb1dd6496587b9c52dffad7a6bb80985f1c31769372389a3e3c1b170b24670797ef6cb10654
-
Filesize
504KB
MD56074da4d907a0df7bb4128f141cab4da
SHA1ee81b32332ecb464a88a2c1dd398f4d58db61128
SHA25630ed0cab1cef97fdbaa38dca1ce6f0640c05f781352fa327897c68e61c29f5a6
SHA51258ed4625e3fc9423965fb46fd7320f94b1b4da5a58a972c16f125033cf18fb21751e77f0d43e01c4df93af9b4ff05f38ba5d783fa2781790db215fc64552ed52
-
Filesize
1.1MB
MD5d31a6a964748029c12d3b102de2e3ba5
SHA182a0e2571522aa8fd1422b8b21b01a5e4474e1a6
SHA25678c04b36dd5a770be3a4e8f318ff4ed5e4cf8da6359541f8d026920cb94bb3c3
SHA512e874a1eddeb8da13dbba3d7ced295cb5cee74715034ec60c431f3a0effe4b56b2681916512a4201ea090185946d63c76f569ce2c63d8f235ddd678577c501428
-
Filesize
1.8MB
MD58c38bda15fc1ed7a41eac2477fa8081f
SHA1b731599daa880e527c5b7a37cfa191608f0922c0
SHA256abce5157b25e7b48f35c4ffa967c664596e81bd41d08dcb9174e6c311eec90da
SHA5124a0bec5a199cd2ef4f67a0f7af2bf98979ebbc73a0260dffe177d2ec55ae5d48b34d63d427186255601d8fcdd76ac7a62babca329e5d9f0e0a691c4230490c93
-
Filesize
2.3MB
MD5e10dcd6a4d926f01b642df150fab8575
SHA141ccdb9d0de4ace9f94b0c03de6897764106d4ed
SHA25642e1d53eaa6d85270acf8dba39dda6b65ba10d47f7c97b973fdb9875b525e61a
SHA51203bf7abff3769a6a1ad89937b7f1b2618e177451f1cf5fb434edb46ef3f72e32e41a317699eab39ce90367014c698a479d6a5bfb832ad8a6350c4fad11516822
-
Filesize
16.7MB
MD5d20ede487544c889d969b1846f88ec9b
SHA1680bc580566fac15413cf9b3d0d5c61f0b41de4a
SHA256e901634b5d142e3aa70835ff597d55c803db9110e1ff0769d84e519c3afacaef
SHA512ac25384b0b1f09e3135202b9ddc510d9d8b4aa3a3bae9cc8ab920eaf1fa1639300d6c631c9545c83d5e5841f3595f34bef3b20f4ad5a9831c56aef44e3985c9d
-
Filesize
2.9MB
MD57caa9936fcbdca61f4e7424c90f3d45d
SHA13d36ef1b9758d322d67e368245fa6216cc4235d2
SHA256ae248f7281718eac1dafd4658f47e60c962c7495e7ef0863da0cd39cb6597d48
SHA512e591b4492b563e3cf82cba9c1392300a7439261f0f1199b6855798ef678000e7e82996d94239bb7a9192ee8889bc8cf05fa5a561090406cdcbcf15157442889d
-
Filesize
28KB
MD5644b0dec0cc8b03ba19a75e5aba349a1
SHA1021b7a9af3c8a206940809ff33b2e9b79ac4bf47
SHA256ba4371740949662421d21409b9549e815e6f9cc2ee1888834b4169c198727d15
SHA5127efb5afdb7b45c4f1982a6bb1beedbe38df0a9dbab13fe3df9b5cf6ea8bab4d5ccdb4e1659476ca32c3e8f338df7442af4ac39848bf497e0a2a47a9e5fa47514
-
Filesize
181KB
MD5043d8540bcee3ea5e2f6fdd53b5065f0
SHA1bd68616ec490abe425f80643bdd48f6a6c9ec2cb
SHA256df9ae2c4d3ca95e1927eb5007eabb0035027b725cf860b1c52ab43c70f82bac0
SHA5123d404bcecb53760e0cb598bab94568408f2c292fa9f0cda020e4a2b938390d0a3e4fbb24bf13758cd4f935a406b2196cef0b0ae3adf1dca093c3fa602f490a5a
-
Filesize
895KB
MD575f9f5f034ffe5179547357ab1fddbff
SHA1a8531fe8dcf103d4ca672a424122eefa4202098c
SHA256fd5bedcc4aed1dd4caca3e287cfd4b2fe1f77c529174672ca278e80024cb6e96
SHA51264c9fb3d23a5814c2252105dcf26e0516ac5055cb23e553c1f14acb5362d3fe518f8be5403dbec2ff1a5c54258ed38915475f7684abcdf6df1282448d9633737
-
Filesize
2.4MB
MD5cc891f3700cf3ebd00674671ec74d2ff
SHA198c2b3d4f9daa0f88e9a1562c9b7c467718198cc
SHA25683b5c7c7ce8c933930c27fc8976e29a3017a331a690305b43bbff6893b161fbe
SHA51250e27bc3573f0d9939ad631f00718ffc4c79f372efab03116fa78acfe5a8b5f8f7b502f0f29f2be8ecd664930bc00662ce2540293b3843cf105760308a243bd0
-
Filesize
13.7MB
MD5b0a201442ca0a5531df1e2f6431f4ef0
SHA1ccb3cbddfed7b5c48f7c51afef8b9d85e69c465c
SHA2567040307fa49b53e4ea0d19815e6daed3b0b62bc2de4afe2a89747a2bea534704
SHA5128d5cc7a04bd1eb534846d44625081c964d6a5aab5ce19280b65c7df1dc64949070e9bbcbb331e6fa11d5f413c9dffd2bd365f36de9b49f3c5cb7c51b32b02a24
-
Filesize
1.2MB
MD563962339243875516dd56281ea9665ae
SHA1c9086eb89116cab915f135ae7011d0cff81bc5b3
SHA256d6037c5a7b14844608e398fb9d72c43e96a0a24e71311b4afa61f8be18bdb639
SHA5120bb77988a35e69cfad9280aa52a3b812cb9d0976b022715638ef90ec2095861dd99f99e1d63c32ea875befb84aa7e2198cc769489d44c2030b2c5ad89d0946b8
-
Filesize
85KB
MD577fb252af2ac1985fe6280df5f38a59a
SHA1c6b75eb65fc21a2234d2e7d3c775a005c91959ba
SHA25628cbab4a7793c213fc0988c17ba62899dd147fed97346ba47563912b45e70247
SHA512986f5605bb1ecdbb74d3be13f69a10053fda37185a54311ba179ef86dce37196732acfc1b9ff055878d281e5ee7f9833c8e2f3357c9dab8dcd1f07969fd10788
-
Filesize
72KB
MD5e5458e7d328ac1978431b25d449ebc25
SHA1ac44e9358ee50dbb85fe1e15ec5b255e8613465c
SHA256296866393b58f362b6a8517618c39f3b09c1a89bb8d5453ef8bdc926c4877630
SHA512457acbe62dc0162cc3fbd7271656042481d4138431761f28c9e065ffd71fe9cdf91c9d933fc71cee27c1ed372b3e75716dc1af6acf8420be5612b1a46e505062
-
Filesize
590KB
MD5cf57a51b9ef6983cc3406eb68fdd6d4b
SHA19b6296fe93868c568b3604a3d1b7224f73443b01
SHA256bde7683492c569c5dd74a0469ab06564b0c0b48de7c057a56294c497bccaabd9
SHA51287a3a1b289b337c2846db2038c12570062ac8f15b5ab2887fe2edad1a2fe30c497471dbe413b66670db8c42d489e6abc10898aec9a2dbee2e507f519fb87bb02
-
Filesize
484KB
MD55db8a626903206ea3545b0ad2c0992a5
SHA1fbbf90241ef401b3175085bce8e4120427adf380
SHA25631e6d4a47038ecffc2349cd1e697820e8bad8f472da4c70aca5ea0acc2726822
SHA512781e450ee18ec2e778b0ddf8bbe860603db6085d6303c217859986f15eca89647272e680256b20916f614f502288d90f6572d2cd9679de05d7d778423643a4d6
-
Filesize
716KB
MD52782bbe1fbed7eca148033b801d74891
SHA1d41d8d1f5ed4380669b6d4127b98087bac3714a9
SHA2561d2e3f6659160c681c3794030bc7d51c79cd1a89f7d4c3981b2a4feb3e3fc210
SHA51256af2c6fc38c9e8c7275be4bd59e14a98f889d4ad3e9ecab2601ea69a7d4129846abb6e5f1cfb65b6d38252e35a3698185267984c2d9d1280347758a79bdaea8
-
Filesize
263KB
MD555c8be7f82a946bd1b04be38f726a385
SHA1ad57fa0275827710bba07aed858b79054d71d0a7
SHA256db1265744ea82647464950bf0af883867a169c0bc9fb8d2f0b9fbab9239e56ea
SHA512f50d24f5a26dc9c6aeb522296b19d5c759094e863f2efdbaa6e90f6479b66a1f567ecd0da838b891e4077c2041ec918f50aad98dfbbcad3887ce7a5e548c5911
-
Filesize
141KB
MD5621540d7c9434c3f26f8fd167c0cb992
SHA14821b14059809f186460dbcbc79868efea8349de
SHA256c705911ec6551f119723ea6bf512d20be96027df0a228d48f4f65e193da7e52b
SHA512ec90f942f786193acc2d40ccf5cd2468c86e1b6a8ae2017e4ffc579fad20eb99b6bc1f7276f4bb3a265ab67a6e33d645ed2547f8d59ccd130937e6bd2ece3e42
-
Filesize
80KB
MD5211c9dcfd59fd68e95fe5d8f34d952c9
SHA1a67ee6165d8b8745e6c9a2fe43f4fcaffb8f41fe
SHA256c12eeb8102f799143e2bd62698f6735da9dacf018a5e3bc92492cfca5a4323c4
SHA5126ea89e5d4de592ff1cd2115b725f10593c3ecadcc77d30526a1be9730fd378f965da507ba599ada7485fd722f3f970b577a99a0a7d7c74c3bde8eebe4a83271b
-
Filesize
1.2MB
MD512f875565d74398a3a90b1666abd4fea
SHA103adb95b5852c8850f3107f0ab3ad22048417f75
SHA256465e12e760966419435ee5c19fe775a3cfb495df31f1c6aefa6f711e9a9cf8ec
SHA5120f794cbed9f0b7e5d5cdb4a38379ef1e0f749cb48995497639eb84b6bc27d98c54949744bee0e36548364c608b46891d83ecc41e0e99250ca1c71393b37da575
-
Filesize
80KB
MD5b37313766f61e354599a05f5ddf65470
SHA18a4b24a0b41d72c99c9ac3bdac2def0553853724
SHA256b3b46fe48f7c2deda8c080bc82514787cf271b4b84a23d2706d7b4de630916f8
SHA5120bf60dbf0665141a200608bc66cc6571e7a685c6f00cd219cfdfb026a1f3a59cbfd7d51d5da7b63c96cd914f2352bb138b078a3af55c4878e70d77d97ebed62c
-
Filesize
79KB
MD554d97250303991a2f881791fd5c8cc4d
SHA19ed448ba1865f1cc14db220f77676212d512d04e
SHA256205f4a136b2c4169ae40b944efa1a9ea39c343cd160b8b467636835a06e4ef3a
SHA5127176c64aa00f4a2df12a1161b4271c8b47e1270e7d5b490830cd9fbc71314d41a06df6c78a6ffd4872c2c725c33d1f7529146cc1c404679338a6a45fc254d879
-
Filesize
84KB
MD543a4262a8fbded12b92028038d271c92
SHA11b3f93f2a02629441cd08674ca8ed78782b77f7d
SHA25653526f5b1f1750f8fe091c8c676c5883de7708e1822e51c29af1a9ea3cc409f3
SHA512c4ea1687d93c34a2f079d98d3ee424f8fbd7e0f79ef519efd324b2e67feac8dd99db1437142a2a65179859580e429babff9437367e53046ddf3486cb18d60b11
-
Filesize
77KB
MD5fdb281398da9a7afa7bc84a5dcdbead2
SHA16f9698b16d0a1991b2b0fece0e495895f8e398a1
SHA25685ff7e8e712215e93c3230255ace6304f05b71b685d9efca6fd524fca24bd872
SHA512bc2255e1919b35e4d5e3a4af54e76e412cca2f9b68c9ded5ef6dc093fb9547e80fecac86648c8c81754fe95cbbfaef0479cdf85df1d81e22fba807832a56966a
-
Filesize
1.8MB
MD5df6c0f74d592af82aa4c2f683224e0af
SHA199b433b2bec68699116944c4eca6fa328db98bce
SHA2566360d5801213a6b57210b89a0ac1910b72423b3fbabd3b65901dcaa0747df658
SHA51238b0346783b0ba985841f9a60b28518e8e1e3ae863ebb0c6ce4ac5b0e0609f5b6e8283f4f2c68ed4416f0dc5ac42f9e22d4132f6ac3df83c58de9e49cd4a59a4
-
Filesize
76KB
MD5bdfeb79deb4249845c7e957b7b830f67
SHA10507d22cafd2bee75d6da774a7b92a8116ec6a83
SHA25675a5a260c5e5d85876ae8ce787a53ab565f4621a3eb9f6e23665d39acda372a0
SHA512177d562ad677b9ede3ebc24dc53bcf349316e37fc0a408f3612693383229040d3728ce28eeccd60e9fef6bc21b9d1de90e9c99e678a0400b01e16188c0d0139b
-
Filesize
75KB
MD5537b7a147ca8bf69c520fa3564fdf805
SHA19f4df44910d078a9b5cb0168aa04fafc687638de
SHA256e7994445f41116e4f6ef6958de295d2edc25d3c27d6f4a4294abc1c346adf893
SHA5128acb49093366d2a23abdc2ed8fef78496440a1efe38efe6f7e0ce0cc3d2f8fb488780fe9fd1cf531e8c8552f797c4c49e30e58034970fd0e36bce90bb3679b7e