Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 05:49
Behavioral task
behavioral1
Sample
da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe
-
Size
119KB
-
MD5
da7cbeb39696e8e886c0de105d2c3b00
-
SHA1
8736f767ba24f9e71837dcc9b8ef3ad68d4c929e
-
SHA256
d7c4f75ca3c52472e726df7e1a1fd2914e437cbceb485e1784931da5a3919076
-
SHA512
15c6cc8de182f6ff6a134095fc2eca32e865225232dfe1fda9b8872ac9ff5a431c6032133f15df60f53a86738787ac3545fc360dca7fdf0568372dd1c664be7d
-
SSDEEP
3072:KQSohsUsxe+erZs1o8k1o8DQSohsUsxe+erZs1o8k1o8Z:KQSohsUsxe+ebQSohsUsxe+eR
Malware Config
Signatures
-
Renames multiple (4514) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
Processes:
_AutoItX Help File.lnk.exeZombie.exepid process 3048 _AutoItX Help File.lnk.exe 2500 Zombie.exe -
Loads dropped DLL 4 IoCs
Processes:
da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exepid process 2124 da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe 2124 da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe 2124 da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe 2124 da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/2124-0-0x0000000000400000-0x000000000040A000-memory.dmp upx \Users\Admin\AppData\Local\Temp\_AutoItX Help File.lnk.exe upx \Windows\SysWOW64\Zombie.exe upx behavioral1/memory/3048-15-0x0000000000400000-0x000000000040A000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-2812790648-3157963462-487717889-1000\desktop.ini.exe upx C:\$Recycle.Bin\S-1-5-21-2812790648-3157963462-487717889-1000\desktop.ini.exe.tmp upx behavioral1/memory/2500-33-0x0000000000400000-0x000000000040A000-memory.dmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Setup.xml.tmp upx C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.tmp upx C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.tmp upx C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.tmp upx C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.tmp upx C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.tmp upx C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.tmp upx C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi.tmp upx C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.exe upx C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.tmp upx C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.tmp upx C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi.tmp upx C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi.tmp upx C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi.tmp upx C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml.tmp upx C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.tmp upx C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.tmp upx C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.tmp upx C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.tmp upx C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi.tmp upx C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab.tmp upx C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.tmp upx C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.xml.tmp upx C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Setup.xml.tmp upx C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll.tmp upx C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll.tmp upx C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml.tmp upx C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll.tmp upx C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest.tmp upx C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Microsoft.VC90.CRT.manifest.tmp upx C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab.tmp upx C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi.tmp upx C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll.tmp upx C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm.tmp upx C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml.tmp upx C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.msi.tmp upx C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.msi.tmp upx -
Drops file in System32 directory 2 IoCs
Processes:
da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exedescription ioc process File created C:\Windows\SysWOW64\Zombie.exe da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Zombie.exe_AutoItX Help File.lnk.exedescription ioc process File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp Zombie.exe File created C:\Program Files\Microsoft Games\Minesweeper\fr-FR\Minesweeper.exe.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif.exe.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_QuickLaunch.png.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan.tmp Zombie.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\SpiderSolitaire.exe.mui.tmp _AutoItX Help File.lnk.exe File opened for modification C:\Program Files\Mozilla Firefox\ucrtbase.dll.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\RSSFeeds.js.tmp _AutoItX Help File.lnk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libsap_plugin.dll.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\St_Johns.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IO.Log.Resources.dll.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp _AutoItX Help File.lnk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml.exe.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libgoom_plugin.dll.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml.tmp Zombie.exe File created C:\Program Files\Windows Journal\ja-JP\PDIALOG.exe.mui.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\amd64\jvm.cfg.exe.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe.tmp Zombie.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Pontianak.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\vlc.mo.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\blank.png.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_over.png.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\Manaus.exe.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Microsoft Games\Minesweeper\it-IT\Minesweeper.exe.mui.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Client.resources.dll.tmp Zombie.exe File created C:\Program Files\Windows Mail\en-US\WinMail.exe.mui.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\gadget.xml.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_h.png.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp _AutoItX Help File.lnk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-ui.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac.exe.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.exe.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_ja_4.4.0.v20140623020002.jar.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml.exe.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Java\jre7\bin\jp2ssv.dll.tmp Zombie.exe File created C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh.exe.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata.exe.tmp _AutoItX Help File.lnk.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\init.js.tmp Zombie.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exedescription pid process target process PID 2124 wrote to memory of 3048 2124 da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe _AutoItX Help File.lnk.exe PID 2124 wrote to memory of 3048 2124 da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe _AutoItX Help File.lnk.exe PID 2124 wrote to memory of 3048 2124 da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe _AutoItX Help File.lnk.exe PID 2124 wrote to memory of 3048 2124 da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe _AutoItX Help File.lnk.exe PID 2124 wrote to memory of 2500 2124 da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe Zombie.exe PID 2124 wrote to memory of 2500 2124 da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe Zombie.exe PID 2124 wrote to memory of 2500 2124 da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe Zombie.exe PID 2124 wrote to memory of 2500 2124 da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe Zombie.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\da7cbeb39696e8e886c0de105d2c3b00_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2500
-
-
C:\Users\Admin\AppData\Local\Temp\_AutoItX Help File.lnk.exe"_AutoItX Help File.lnk.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3048
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD598ec67db8e8c03477523c4837c6d1c5a
SHA19010ace679b032ff4775a48b3dcbad669e6057cc
SHA25656a060f4b53048017b970ae2fc7abc2afe413563a36868f666849e41f8c141b6
SHA512e2686995fe75dbe3ceba6264f88588cfa8870209975baa0b97a82dab88888903a14ee3da1976d82b1c2c222c6b3f61bf417dbe99125b85db34623cfba88368ad
-
Filesize
119KB
MD5160094230da881c73d545f832afc88ed
SHA1cdc0df0b1ec0f9e201666a9f7d84357407c4b0c8
SHA256152fa1b508315fa3cd6065ebba12fce4497bdd893e9a68f448e33917f19afe3b
SHA512f67dce7da4867a7028dff405848c232efb1787e71427b521602931c091dfa45032a25c57e9cc917033f189c633ea9b6a58a41d28d80d766e53a5015413247f15
-
Filesize
8KB
MD5c91247a971e3919e0af53100a19aea97
SHA1a21754a2ef607a00071c356dde9d595b8bef94bc
SHA2569493b95b5b5ff2ff6472f7000a50587608d0b481eaa3d02ef4636c18d20c172a
SHA51292b8c6bca6916849fc30b47fe6f60d15205ce796973fbbb068671584e570c4f571f8069fce266294e6fc68b794aa2cfdc471114d7b692a997d35e83f8f7afd7e
-
Filesize
1.2MB
MD59a2941bfe5448e8f57bb40f5d317a1c6
SHA1b3b0c564aeccca0b8d34cefd5f44e1d575f57979
SHA25613c306111a4446f8c1b784d7ca9b488afa601055174bd1efb6348d4662867a53
SHA512f0f9afa6a2c1534af1095260e69c530cc3ffaacf8eaf2656c781a5b6380ba02f2c011c56909c81fd95a941d740989fcb89f1f0700da3e70d95033f87db6fff03
-
Filesize
64KB
MD503578c87262055fb71098f575d21a046
SHA12f12bcd9f70ab392c2f3c6379e61a9cae09771d8
SHA256a58d25704e37994527f46ee4530d5ac25f9ea2451c9ea0b8513c068bf056eabb
SHA5120286940642ce53fafe357f0e8cc58f01804ecf90db9839fda0702478848006962d20c490977a8a63b97c18d84c8f80bfa1cac3d816eaa8c2576c4b8f6ac3e6f7
-
Filesize
23.7MB
MD522fcfae578fc56fce75309a84b4f802d
SHA132d4b47f175fd1de5e34567f0239129944b2d9ad
SHA256b9b346d0723828eace661887ed68e34725608deb4c7ae22b2667e34d7cde1285
SHA512f06f8b58893593b24071a33976a14f3c053de67348b8b3abdb28d6f1e93fa81764676977854d02b8d70e7198e5a038db8a898b180feaed456132357f8d6e3423
-
Filesize
75KB
MD579b5327954b8ea65e8cc10a8e9c48f10
SHA19bc4a969359dfeab8f889729fdb81c7179c6d017
SHA256d68c9626df790b7a2c2cb52c2a477365ff826b83fa209a8cb97cfa9dbadad5b6
SHA51208f96c8ab547b78a98ac2fb15f0f42fd1906b9dad6c0d197c971668f4bfcb49bbc7892d7860673ae5eb3e44a69daf6535ee2c0f43aec07f9031b548f1061a85e
-
Filesize
89KB
MD5d1d1ee1e2fd3b89aab601667c3657a66
SHA1b45455350c8b768f5893d123235efcadc532bed5
SHA2564c69a97caf007061c0b25b16712e96cb076b6d7c9e4de4bd31b371b03f053eab
SHA5126a461a31a4781619d8c5fec8c3b11abb12de9003d7a0c63df6186a70a9806e969c179ceed40e2df2f26f231bfa6af8567a744820690ec775c105e3239376522d
-
Filesize
204KB
MD54a2668290eda82e275d046c1c453d0f4
SHA16363dbd60e00f472faaa1d35bd7554326c513016
SHA256fb892b46275e126eb1b7b5e390d5842853ec8cc629d9215dee57154b1d8506d2
SHA512de9f62e5890921b9525dbf94391024774f01a785e95e072a02c841020b0a80acb95632281d778750499d3762d01b16a5c93ea6bbec9d7a8259c80575179e48b5
-
Filesize
2.4MB
MD50c640575597f882cf86b92b590ff40fa
SHA156608173e89a8a62be5b1d49ee1b011f89ec8800
SHA256085f8fc66f4f48ef556b52b6b96ac2ec7b6edd57cfb10ce3c0d8903457db326b
SHA5124ec47156129402f1e1e8d87fa5c8b93e18b09b24740fa1cdf329b97ec00380e97b38502c808170c43a8d6f35b98edd8b6f9cf03e016ee52b3e1fe99a98fd5d76
-
Filesize
732KB
MD522d0ef0e139f92acf2661042a2f914d1
SHA1659e4aabe22ed7f58e07f139c3a6bc6cc37c03e7
SHA2561117aa0ecb21ab5a9380f26e3198bac6f9db92fe98ba597f75dc6cd33a9170d7
SHA512de3fb52406183d92461ce3a57968cdd64328f0439abf90e7b2a593c1f696dd8ab99c0cc70a75ad120c4f8a4ceea096f8a2d4b4522a93fd3389696531ee76fc05
-
Filesize
1.1MB
MD5a9e40112c76a134614806917ff63bd2d
SHA131e1197ac945efd366ebb3cb126da0c2a6a8546f
SHA2566656849391b81084f3d3f028e0a5c38d4bffed40926c65ffcb8fbbf9ece8318f
SHA51289861dcbab90e21a39f22d10e6a3f4459ec2a3370b5bc7594d391157fa04da5ef661bb06f6c56398c65039cd5667fe15a7ddae1f4c53fa3cc285098d58d02cf7
-
Filesize
16.2MB
MD54db09b4e2515e670c03b953002302b19
SHA17d452f878d61bd8378b469f32ef0644af2dfd6bb
SHA2568a39be1b16cfcdfedd50083811d74ca7c78f3cda5297173fb074414a33057d80
SHA512bae8f2d9862789ae7a13c8fcda56b0a998719886dbe8a592d1fbb0e29534f5392f9ead6124f174348764d2da0abb644705ca301f9ee22564dec2d55b88b52f59
-
Filesize
1.8MB
MD529f6b6b61a9a158996ad7371c392456d
SHA1c48cb54087b21e0d20229a943bcc046b4d48f9c1
SHA256d647d33f3d6f952ba6b9f43210f48acd9eee04610995661b480d077f0e8265ba
SHA512ebcbd5566b46cd49bd99d31df4d8b0d7289e1edfc2b3d1b996bba5035045d595c8eb5dc66360cb738f1df8c738931c7b48fa18925e7a6b1be65444bb4ab7e645
-
Filesize
1.6MB
MD5b74082848a523dfa3836a1622a9e760e
SHA13210fb453e23da87ede86fd9941b97796f1dcfb3
SHA2567e857ea40afd4e082fbb1af1e3bd381599cced163ec382d8e9170a20cc10e9e2
SHA5127ca177ec78d1853262c9e4d7c58235908aa8a729fd6bce58d9d51efc6c48677edbceab41126c84d41313cd6b66442d2ffaae8926d9f77b94403f61d8b26e9b5a
-
Filesize
9.6MB
MD508570828eb538532b76dc1e3d7b2c44b
SHA146e6dc83d3addaf72913f3f7b076394fe173c1b1
SHA2569847d275a1ae4cf150722f05f1e896ff375adc5d1f91d516433be33a035d71ba
SHA512828bbdefe63f078289db7578b80a3ef073a8c874e65cbaae884d20f4af730b263f9f85745eeb001276ae89fdec691415cd7550e73f8a91894f3eb610f3f6f07d
-
Filesize
1.3MB
MD5db5fd23da28c4643889e66f5871b2ec9
SHA16fc0345a54d59b9f2555e0fbdc3beb413c294a3f
SHA256721dcd600068b10ab23cd52c5fc345ea8c41613df1338b552269de8b14c5b0ca
SHA512b16e0e74505133de5c6986a15e1ec6362ad282dc750a1f03acb0a128731f581ab84a0faf149529f7ded01bcb037d0de11d534f9402fb10d1c4a9772920544217
-
Filesize
1.3MB
MD53b2290a9e52392094ae91f8031ed4f11
SHA10ee69ee7967c7c02154b5c66499ab542f592c9e7
SHA2569864efc6f9a72426e3ae72b34b9e6a77e183c7890b4f58642c173106592aa2b4
SHA512c7b0dffc80b7bbea6ac48461c7956ce59b70a7ce2f73a8725f7d51dd98e3e7f04f0f4056d7463107676ad44c69fa50fc7b1816314cb50d1139959c0a5ac1e8ff
-
Filesize
356KB
MD5b618345da1b6cdfb67d3305a211360b6
SHA161cd6da3a1693f76f7feb9195967dfe2380fd020
SHA25627c45fa2b2c01a0b399d0364e2630389246703f86fbae3abe5de01cc6cca848f
SHA512ced4b0c8900edf7b4017b69427361a1fc30bccdda70273dfbbe4a175721500c5bfb60845b32c1a68bf37e81e7ba5a475819fd1121660645e1be98f0caf462bea
-
Filesize
560KB
MD5452821bb99b697f65a6044a6bd96b290
SHA1a037ce6f6abbc0190d94c54ae7011dfa0acd139d
SHA25613660bcbadc1d143302a3a2a9a0f33e28365d4d9801d47f4d6be302732cfca43
SHA5120228b524ef017a82d4e26034809791800d10f5273ce0266062a1e338af6e5a8220be34690eb52ef9783c5f27a924c64b68a71aae163f401483a94f4c12b459cb
-
Filesize
63KB
MD5275f7ec93d5f4cee3bdc643879a4fea4
SHA13b6ad1a5d0a528ba181098e0b4c0b1f1ea369e14
SHA2566068dcde285cc485502b30fa62029435818ab21d9dd35c4f33b0cd1b866276cb
SHA51252c53097e88493a86db0f5d0ddeaed775b13362385291ba350bc8ac46f8df10c1d5f885d48a8a140ebd09479ed11bddbc3bc7fee41bffba8a0ca5c6cf5f11767
-
Filesize
1.8MB
MD5b18fc58acef823376dc5c7b91b823dea
SHA1799c87543179a008243e1af7ba33e574350d9b96
SHA256176ae0684ca5b2a0fc7f8312d7bebc966c18f47026803dc01975111ee86614dd
SHA512992a76cfc37cf76e279bed8d8335623c4be938be7012b225de62e29acfe6e04efb0e7f054c0ec14477aac9250f73530ce7edd3a95e2afe1664477e930ea0710d
-
Filesize
3.0MB
MD5a2b595312ee3dc3b76b150ad14f1bd13
SHA14864b213b00b2614bf25c496c946a2b80746b1f0
SHA256203ee60f8f4e7440d398ae7df1ee03baf090c82dc58df95cfc5f2ec8677faeff
SHA51238fa47b2483cf5f5fc3b88b9243e73c41a5498b561aab10038960032cde1bb447231f5b5280b59289909579abf04a22f34f01bfc1f6a792571b2ba4644def90b
-
Filesize
5.0MB
MD578d7a0f632a8c8bee5086c884967d0b4
SHA1b539a866a51fd90b9366ec320e5381a56c12af03
SHA2569b4974545eabe213f91917508344f0e1c63bb090e24096af3c0ed2f8df3ea877
SHA512f3ccdaab07b2fcf15ec3b56fef4e2d5fc0e3b310de3f93a78d45c559439e4acf8d549bc72512a83be03e08a41f0235a24c57fe5b1ce6364436d335bfa0cba80a
-
Filesize
713KB
MD5ff2a933210a0c4ad934c4633bb5c905a
SHA14940dff9dc62c57ae0bbe660ace0afc1261832db
SHA2562bd2344d191126e9988ad27354b22d76323061ab2f8f4a4b542e5f8c7f014c2c
SHA512af6b096b743415d9a157797573fa734b447f166e0df5a53a754fc9ab524484504476d556d9e785aa9397dfcab13687b924a70aedde7cb15826f4a068c5a433ed
-
Filesize
713KB
MD52f765d03628c4d139cdf7a2d36c1b98b
SHA1ff2fdf3d0a898b66fe40cbe0b8df82f07193bc6e
SHA2562d4f6cad291a4620ca4686982745dbca74a24595a7032ab72069907ef35dcb7b
SHA5129d1756e91bccb99230f20c38681f278b7b60575c891353da488d0eb6393623bf35f1ee853cf2b1c4bfac64fd8515ac13bd64e8cbf54be2cb113dfa69cd50d185
-
Filesize
696KB
MD5fef4b1a782e83e5156f892d8e9acabc1
SHA19e6a5bb40022a6adbe1087a7f718bfd85c538d3a
SHA2569f5576c41f878a5604a3852ef37d300f4a7a686688b3525895243003b4645469
SHA512915b6d5a7da8212010cec57263396639a1f1af163facbf8c75a8009a2b5cece3c4f6750ec7a5b82550fe1db5d28e2ee6ea66634f7757f37be3599f51268a5125
-
Filesize
61KB
MD5b228a21b4b498cc2ce6b7ff9db4cb3f3
SHA11e1647f7a6e57521d3bba606673076af79352375
SHA256fd5d47045881f558e5b8dc4c882c62e5e91be16283324be98fe217fb3bef1d10
SHA512cef0e5d0554e83450c7fe751ba614986945b6c8cd406c77fdef703056f9d40fd63aec42385183f480e39abff98b6adecf832e7a72d507ec6b135baa07655f916
-
Filesize
60KB
MD5e90618c55b033e4c8d6dea4940ab2611
SHA1ecad9d1110f484c35f3fddb3d355df160d35d133
SHA2560c9d24c15887dc271427b2318c2067a799eac5b6d79c9dec10a41f1fcdb40561
SHA51208aa4430ee3be52ac4e6a436e5fdca4b8cd41bd8277facd62d5d381ce82b170deb3ec1b7e8a19bfa135593d19d08b5803532920a106438582e9c800b2153a153
-
Filesize
15.0MB
MD5dd37d554a650d4fc0a415c0151e1c980
SHA1718eaf1f78ec73ed38934294c2bb21c3a5cdecfe
SHA256b410a9b2943b62086e6aa177f327b44bc148ba44751e6907dab0b92e39da39c9
SHA512995d6645e0ea81257447daa339b72df0fd976a512132ba22aca3f65315ca2d9fb95b31bc632932f148df11c9972fc1c4f919446b4d381b1c24e42a33404b6ec2
-
Filesize
2.4MB
MD5b7829d0dd0f980645e97f093fed7b349
SHA17cf4ccb4623d3f50905e33c878b2476cbe564041
SHA256537eb12ac38a13dfaf1cca93c994a19adc8ed89e134c21b2af9d59c7799b41f5
SHA512b45c138df5c14bf3c3bf0cb6111cdd60f6bfcdc08df233516b56cbcf8ec946ea3e4e1f563a77bf6ed6f364e6fc8ae2ec610adb6ad92e87f51aeded1e0580fc22
-
Filesize
2.4MB
MD5dce461870fdeb978eaa7a57dcdefc8fc
SHA1b696b920e27c5a0e184f4134408982e0da9ffa56
SHA256479d0eb509e3794618fcca6465419f168b30f87d2d601a392261838782f7da4c
SHA5127b29734da34cafa5319df3054c291bc606925cabb30b805ba3e4dec86f45ce1131ec7e150af85a12ff8900370fcc45f7556f66213456686472e43025591ab782
-
Filesize
1.8MB
MD5742752dcec1f69540805061d6e700a23
SHA1656d86283ddc45f0ba34e21032a606cb87afd188
SHA256e4d4db8d239325b15cbd9502904b90f02b9da208fa11a8cec605591760627e97
SHA5127d11e314c5a00b71ea3058057f8350a9e30912d53c00595a59b8c006d443755114b2eb62a12d760d31c09743070c316173a09fa1e6a9c1eacfb93512705da115
-
Filesize
1.4MB
MD5b237a7248ccc17be3e25cb27ec7e3800
SHA165ecf21d92771e70404b1ecf33436baebe7fdbdd
SHA256b9cb22bc975835080341f300df65fb6d3a073423217f1939bddefa2c40da9eb4
SHA512972b36ba90b2ad01707fa2218dffe6915717a0b293282a2d2f3903275a8bd8ab8fa8088c77fe620dd814e13efc284b1e7c443ea0da7b2b5fbf09de542870008d
-
Filesize
1.3MB
MD546802bc64e1497cfa463cee4fe7db25c
SHA1341251a4348e35efd98214cb1abf8b32c96701b3
SHA256ca8bcbeac2da920104e92a8af99004eebc5ba7c617d68c279a386e85ad7789bc
SHA51299481966badc7c1ad38d21cffdd17f06e4239c2d1476d4b247722d568a209f426e38263470f202da4b3d15f8eb564c27708df7394def86cca66f380c1003499c
-
Filesize
62KB
MD5e79d24ec198d853582618418aa1be60f
SHA1cab70e2f87fe020196b586ab2967241bd2f24533
SHA2566b09d42b12694309a8492f84c06fa62358d82fb85f0e9b695a69fdfa15ea45d3
SHA51215540e8b5ec7c8a51b7b738caa29d967e62ceaa6b1f171ac6389e8915f4a8749cbbc6ba00fd5aa42745ae39c0bf453b5572ca781bd405d5f4ac64df47ee7b668
-
Filesize
61KB
MD512ac83baa1a747defecbe24ec35fd428
SHA172bd4ef1554f322a2398f6a6835ebc4ffcc18256
SHA2563c66af761bf35b3680c71e032210b278e6d840ee891c438ed745763f76728510
SHA512515ae52946060f000b337e34015446790fda5dc14c6a4e92964babcfe928cedca1fb7eee04fd2f1c8ef3f07c9651df7d15f3428dc9e6be234f75381a5f933122
-
Filesize
56KB
MD5feba875bce56396277d0343c8db2a10d
SHA1713b2f03d0aa4b761418dff7c689cde3a40c6528
SHA256eb6827695b006d697e0adcc2e7c7ab9b5936c82e5beccdd46382e696345b3040
SHA51255a4a7cac11c12abda82f2e249948706e3664dce208f8a54ffbc222c656b25121480c022f646688f990231f7b7c01e984f26fe49fe4178859bd4f75514ada1c7
-
Filesize
166KB
MD5fcde0e2caee9098f9aab4d00ce1b6bdc
SHA1c412c81dd073eb439478470f62baede7216b5e96
SHA256d8937770b6ed48eefb71faeafbe4ae5c060772af522bd289c8a25b479cc5b3e5
SHA512874342e3c46e2055c514e37e8637e252c68cad29714611fce7e65c939149ee332e9f64910aedfb6624f2a196c84fa1943c708ebef4dcdda14b065a582ccbf602
-
Filesize
64KB
MD5bdd85e8d829c11a686caa2b0c77bbfe7
SHA1993e12c536804bdd26a55323bdaf3a1b3e4cec7f
SHA256cc120ce2969a7a6e1bf64f0b722d54209d6580794895dc755ca4c45803ddf323
SHA5128292bdc9c98d1a16946a9a627e5d20070c2dc829bf8eb6d8820b9548c62e8ec67e929c92c149ae1af3e86e9146df125d57eab6f3fc1f8475040ceee34bca53e1
-
Filesize
64KB
MD5dcead604a09c6b1dfbbc7c843e992113
SHA195083f725a9dd2c97b9e39a686a9a1310e1c69b3
SHA256812fce15a9b591f2f8bf006d15e194191a027a1fa3340553378205a00def2c40
SHA5129d80b66bbc05c1535997b828433326e685994567af2c7346c2ba5582e0585e64a5d417631f95f4bd50ef22fe370b85e637304761d826c409049001b83945cc0c
-
Filesize
756KB
MD5ddeb40f75a44cf57d818600d0fcfddab
SHA19a91bbffb2aaf40346d4bde1bffc6671c8c05b26
SHA256cf8eab00594de867a9eac49296397057f7854259bb7cc54270ab9ae272368001
SHA51237c385e987a67ce5df0219299c3d11a0795b070f40998df2294169642c388c4a2d6cda57e3e21032158b83514967454398610a972649fab0cc7f806e9e9146af
-
Filesize
2.8MB
MD57c1562b5096f56b0a187bb64d3e6e76d
SHA13620ef1edfe7388885d8987bf44732185fb5b1d4
SHA2562c09058bee3e7281dfd9f00b88c5f20b73280d093cdbe8f24f85bf2f2c27857d
SHA5125c7c43bfe8c10b22edc802007fb1d45b519bfb253884c42fe03089db9c4f4efe54d2ab0e3afe6a0f157490a9767cd90cef96f15ce615c9dc1be25be15331167c
-
Filesize
70KB
MD56b472034481843b07c0cc5740f17b055
SHA1f6670c7b18a69f62051bb869ae4a0b40986cdfa7
SHA2562cf181482cb520e2866e37e9d87a34b414669cea902381f2bc03e7363a088deb
SHA51272123327156e3b158b9a2789440c8453624943b4e919e99d98e415282a315a042df0e73632bbd78b47c0ae1921fbc3669e4d96ac276bab149fe2d9d018c76504
-
Filesize
60KB
MD5ca0fc641501a19cebeb0dd6f1d18b3e7
SHA17a0bec0a765fca9bac9df948330f2fa732f820b6
SHA256b0fdda4996f72b7649dd91fb15af4cc87f247edff799b017e2940e5c8fc0c37b
SHA512a57cd93b5e4eabb21070e14c1da365bfb0af53136f20cba4e4f60d49db3c2c0a0c81e560d0927703c974068f7fccdc68c3ef0e0954056f578026a31adc28daf1
-
Filesize
572KB
MD5b4432e9d5d16036eaacae7cce58e681d
SHA1eff9959744d59961c735332e76405fcabbe66eed
SHA25631d2f3a3a40b2dd4eb87470c855598076d1fde88f7cd7a4e075b20667989516b
SHA512d13ef41274cc1f9f1afb7d371e2ad74e35464c37632ae9b064902369c1c27ccab470a3348d1a6e50b66883af52d7176f2477155b87fb308a0cc16dc3d0b5b57e
-
Filesize
512KB
MD5ebde1c963b619a741edfbb8bf7022eb4
SHA1b1e4f1ff5495abc333e9c091c4a06477545213a6
SHA256e1c76a43abfcf9a6dc21e681973129d69fa4dcf1fed87a213a7e5dd349167ac2
SHA51225b695e6e8b6ff4f8b4be3b0f73a9b3aabddd239fb58ca9b214c2674eb7f33137b136bd96b3a573a786c238426a61f7c1f4da72493db6b707d21a036ea9792d9
-
Filesize
245KB
MD591cd0574f581fda6deba55a2e1997f08
SHA13354a9cda3dc06bef3d5d2612ae2545827336b71
SHA2564ed338009bbf5c31797263ded6bba176d64b4f33c3a6ca8d3d9a9d76f2b2b848
SHA512421d72dd20ea7d65cbf5573bb40bd2f1b204770eb8cf9ee8d82642c0b7250c2bdf7b25e20400f4ff02160a73dbb1dcb4d7f1754c523cba5524b39ef93fb14420
-
Filesize
124KB
MD5d9ff11405081f8e3ee200463585ab625
SHA170e84f5a99fe4ae0958437c5448f6f71f2086a4c
SHA2567d8be32fa5a180116757a9487cf0b6c86233a4ce1805a3cfd368aab365b0c8ac
SHA512f008798a1b4e37fd09764a8599b53563978674a6e3fd31e5f72e45dd19f8999749723ff2f882d83f171b5d77781a584bfe79f8d124ee646152da5a4aebf703f4
-
Filesize
56KB
MD577f938f719ac3899a45278da8efdcf3b
SHA16d4298de616d9f42e0a6e667514bc218a83aaa9d
SHA25688f5ba228cead5bfa2545669a6538dacaaf760774fc770aa241694c060596cba
SHA512211bc5596657d3eb1fe6072f913b1d83cc3fd549c88940a9b3a5c6ccf63c0ecfc3c7e0664e2b1f32990879b83d8177aba09bdc7b99b047d2cd13c9b15381f987
-
Filesize
699KB
MD54d49f6dd459008b52acfd9b709ccdcfa
SHA1669ccc23b9834165d8d5dd0b194c1a49d46ec316
SHA256cb6dc28f50bad896c9c45bb1fb372e7ed001459ad6fb8ca57c4fbe4384bad874
SHA5126d3ae8daf799ba72802eb2f3d6ab137d655f9a647281394861e6de155884d65d5917542f45d54be1ef9bfefeb0c83b6d63cc586cb91730931048e735593a3228
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
60KB
MD5c78b1219b96c50895b1bae2cf5f27ce0
SHA100ee89128862d6f4eb08a54e9af482d35af185d6
SHA25613f0808a586288e7d31d87fc4c167a02373c6457a23703a29aab31890e7d1b55
SHA512e082bfcec94b2e28b4fbe6e68d818a408c53cb96c2e7f7a1c4e58614016738f9171c21a7aa93bc7e76d5509c7781c93e437a1716b6da4239310c998a7074ca73
-
Filesize
58KB
MD5b65467aa566657626527217adc449830
SHA19e5fb254dfa91ea678c62eaa2e5fd62dacf476d3
SHA2567f9770167a6565370acc18e0e567593da0c558fb449d43018f64ed007cd3e976
SHA51222ac350b50451f984b74a691dcb9cf2c255d5548f7617bb59b7e21641cbea4c0688f5b21ae8a0d7368dbcb643e7f21c636c88d61873221351256775fef05e3e6