Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 11:55
Behavioral task
behavioral1
Sample
5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe
-
Size
137KB
-
MD5
f0ff7b77fb018cb3e48b9eb567797fe0
-
SHA1
04684cf269b7ed44005aa28564962d5a3ec14c7c
-
SHA256
5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599
-
SHA512
fb8ddd842a6663cb1ed49c8207717fece97788223b2289c7ac2322babc99febb291adbcbd8e1f0e36d599b6e9b0af57b2f0f8c421c3641aee245fe58b97e6e59
-
SSDEEP
1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8Q8/8fCm7ZyqaFAxTWH1++PJHJXA/Osr:enaypQSosk1naypQSoskO
Malware Config
Signatures
-
Renames multiple (4478) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 2868 _07 - Videos.lnk.exe 2744 Zombie.exe -
Loads dropped DLL 4 IoCs
pid Process 2136 5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe 2136 5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe 2136 5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe 2136 5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe -
resource yara_rule behavioral1/memory/2136-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0037000000015686-12.dat upx behavioral1/memory/2868-13-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0008000000015cb8-16.dat upx behavioral1/files/0x000b000000012263-18.dat upx behavioral1/files/0x0007000000015cc7-30.dat upx behavioral1/memory/2744-33-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0003000000003d62-34.dat upx behavioral1/files/0x0003000000003d62-37.dat upx behavioral1/files/0x00020000000106a1-42.dat upx behavioral1/files/0x004a000000010492-43.dat upx behavioral1/files/0x001500000001033b-47.dat upx behavioral1/files/0x00080000000106a9-53.dat upx behavioral1/files/0x0021000000010494-57.dat upx behavioral1/files/0x00020000000106a7-65.dat upx behavioral1/files/0x00020000000103d7-72.dat upx behavioral1/files/0x00020000000103f5-82.dat upx behavioral1/files/0x00020000000103c8-87.dat upx behavioral1/files/0x000200000001060e-93.dat upx behavioral1/files/0x0002000000010610-99.dat upx behavioral1/files/0x0003000000010430-114.dat upx behavioral1/files/0x0002000000010613-120.dat upx behavioral1/files/0x000200000001044c-124.dat upx behavioral1/files/0x0002000000010448-130.dat upx behavioral1/files/0x0002000000010452-138.dat upx behavioral1/files/0x000200000001044e-146.dat upx behavioral1/files/0x0002000000010444-150.dat upx behavioral1/files/0x0002000000010454-156.dat upx behavioral1/files/0x0003000000010444-160.dat upx behavioral1/files/0x0002000000010457-174.dat upx behavioral1/files/0x000b000000010325-180.dat upx behavioral1/files/0x0002000000010400-184.dat upx behavioral1/files/0x00020000000103fb-194.dat upx behavioral1/files/0x0002000000010317-195.dat upx behavioral1/files/0x0002000000010313-202.dat upx behavioral1/files/0x0002000000010314-206.dat upx behavioral1/files/0x0002000000010319-212.dat upx behavioral1/files/0x0002000000010318-216.dat upx behavioral1/files/0x0002000000010310-220.dat upx behavioral1/files/0x000200000001030e-226.dat upx behavioral1/files/0x0002000000010312-246.dat upx behavioral1/files/0x000200000001031b-242.dat upx behavioral1/files/0x000200000001031a-239.dat upx behavioral1/files/0x000400000001031b-256.dat upx behavioral1/files/0x000200000001031d-260.dat upx behavioral1/files/0x0002000000010434-266.dat upx behavioral1/files/0x0002000000010438-278.dat upx behavioral1/files/0x0008000000010465-288.dat upx behavioral1/files/0x0003000000010469-295.dat upx behavioral1/files/0x0006000000010304-302.dat upx behavioral1/files/0x000200000001060c-310.dat upx behavioral1/files/0x002200000001087c-332.dat upx behavioral1/files/0x0006000000010738-324.dat upx behavioral1/files/0x000200000000fa01-5634.dat upx -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Zombie.exe 5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe File created C:\Windows\SysWOW64\Zombie.exe 5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\Chess\de-DE\Chess.exe.mui.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar.tmp _07 - Videos.lnk.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\liberase_plugin.dll.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\settings.css.tmp Zombie.exe File created C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-disable.png.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_down.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar.tmp _07 - Videos.lnk.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\Eirunepe.exe.tmp _07 - Videos.lnk.exe File created C:\Program Files\Microsoft Games\Hearts\HeartsMCE.lnk.exe.tmp _07 - Videos.lnk.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\bin\javaw.exe.tmp _07 - Videos.lnk.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_zh_TW.properties.tmp _07 - Videos.lnk.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-desk.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tijuana.tmp _07 - Videos.lnk.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties.tmp _07 - Videos.lnk.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-3.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga.exe.tmp _07 - Videos.lnk.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp _07 - Videos.lnk.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.DataSetExtensions.Resources.dll.tmp _07 - Videos.lnk.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp _07 - Videos.lnk.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libh26x_plugin.dll.tmp _07 - Videos.lnk.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\gadget.xml.tmp _07 - Videos.lnk.exe File created C:\Program Files\Java\jre7\lib\zi\America\Thule.exe.tmp _07 - Videos.lnk.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar.exe.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar.tmp _07 - Videos.lnk.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu.tmp Zombie.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgRes.dll.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll.tmp _07 - Videos.lnk.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\liboldrc_plugin.dll.tmp _07 - Videos.lnk.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp Zombie.exe File created C:\Program Files\Internet Explorer\DiagnosticsTap.dll.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_settings.png.tmp _07 - Videos.lnk.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\settings.js.tmp _07 - Videos.lnk.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libhqdn3d_plugin.dll.tmp _07 - Videos.lnk.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-dock.png.tmp _07 - Videos.lnk.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css.tmp _07 - Videos.lnk.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcroppadd_plugin.dll.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp _07 - Videos.lnk.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libcaf_plugin.dll.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdiracsys_plugin.dll.tmp _07 - Videos.lnk.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll.tmp _07 - Videos.lnk.exe File created C:\Program Files\Windows Sidebar\wlsrvc.dll.tmp _07 - Videos.lnk.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp _07 - Videos.lnk.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png.tmp _07 - Videos.lnk.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\PST8PDT.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Omsk.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\AST4.tmp Zombie.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2868 2136 5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe 29 PID 2136 wrote to memory of 2868 2136 5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe 29 PID 2136 wrote to memory of 2868 2136 5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe 29 PID 2136 wrote to memory of 2868 2136 5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe 29 PID 2136 wrote to memory of 2744 2136 5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe 30 PID 2136 wrote to memory of 2744 2136 5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe 30 PID 2136 wrote to memory of 2744 2136 5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe 30 PID 2136 wrote to memory of 2744 2136 5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5023481bf40a69ec42b4319ac97b852c3b62b70888928b9e49925b7f4cb43599_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\_07 - Videos.lnk.exe"_07 - Videos.lnk.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2868
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2744
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
137KB
MD598a27dbb2dc71e657b39fa8638dfa322
SHA1e67f2f3078ec25b05d0a6b7a75a79b94d0790d35
SHA25646c09e0e69cbc0a21245ef0e7afff2fb9ff7fb91db3dce66e453be5368b3c499
SHA512596f4b46c9c3619a1bce174bb21763701b981e0df8588708bdea7c5e8cb2b936ec6e409448dece4d8f586fb91338cdeea9543e483349d6925ca1572afea2671b
-
Filesize
69KB
MD538a396889ae759d9df864cabda6ee046
SHA1500a031363b8c4b5e0858b91a18b7e098ad69d5d
SHA25607f83bbcf7c2c7bed639c2deb8f18ea447a95f6144ccf26449057a024732e2c6
SHA5128f88e1ce065816ef1511a878ffb13425cac6bbcf1bdb7de8f69bd849c478c260a66795e7f5d64d8e813755ab557352664bcf1ded2788d0e0bf64481f945fba3b
-
Filesize
22.8MB
MD5d92d8e51069f2744d6c0a90ebea0348e
SHA12b540b0333309c93dc80eaf7e066261e35473723
SHA256b03789255d8d40b6d63eeb000c28d9288f569f26bd9e97d17e8d29575cb83be5
SHA51236f243734c71f30d894bb5dfcddbe55b8af13edcb165c5cf4a833b1ba0c705d125986200953a61c4e86bdfe043b599088ea8ece453be2516666859b8f6b50c34
-
Filesize
620KB
MD5e6d31d64661748dae1126989a3359aa2
SHA17127ccff8ac973aa9d0dac474d9c2ccc619c8d9b
SHA256a5aa995c4af58190316bb7157db5b0e53b3d57eb24cd27e24f50dd70f0636023
SHA512a0592ac972b5c439ef61d73bbea84af435ffa5e51968c75e91f9cb8014ba7871f032757b0b66caf5f5aed9323062b7efba9d514e28c5809021e8d508c945d2ff
-
Filesize
3.0MB
MD5160b488f0fa8acf56df7d3344d9ac580
SHA1b043cea333e78bd714a18afce0dcf943770bec3f
SHA25618c9365afb7b8f44084c6ade24e47e83328bae0362b7425caf19eb4073cc8295
SHA512f0ff7280a7caa03212d9697e5f53db318c3a27193511b6c6d1de42dcdb9224a026894827dab92114758865ef367de05af28115f37a1b6ea1669d836b925ed033
-
Filesize
23.7MB
MD562c8663b254c44ba06b218afd0c4e2e4
SHA117c446ff4cc145bd5253a966c797b12a33de7bd2
SHA256c407dc9be40f471053de837b63aa503207c49de059a9c3d8942c31eab485d10f
SHA51263b2ae56b0079f53682ea1e444fba53ba51ac2f6c096dae175685ad565997511d48d2d1805f728b8da29352b3b5143a8ed3dbede5f9b52ef4ffc4f0dcbcc3f58
-
Filesize
214KB
MD58fc3ca14dd598d0edf36d7503ead7b1f
SHA132a7a443af4c42c870815e14775b84537b7de961
SHA25669c11a23f301fa895a2b0fe47693c84ebe9b7609046935b27e66defe6a2d4d23
SHA5122017fe55ebcda809215159a4067a848b97f64ce71feba4e0745fe8b8745f534a4bfdeb5eecee1fde48fdf5dc7212700fd1f9514122a374a7657e32100550a4d9
-
Filesize
5.6MB
MD58a272cc6276bc03004e77f473a1487e4
SHA164ab3695dd3e53837a11356c57f1d1f730bdba6d
SHA2564f7e1221a5cb27f0a7b5a200b1c3020aea7f47071416047bf0ec06c46f6908e7
SHA51219b2fe2654f025bbd2aa120dd763862f5131cc01ac1b84efc79f337dcefed8c5c64b12598395dd6c9a3402097c73ff9e8de3e7df075194ffcf3b79206e1d007d
-
Filesize
768KB
MD54db4a9136946d7cdc8c3a69103074aee
SHA1c3db30ac63eaa0507f78dcddf77cb7616e863707
SHA256d3aa78fc849b66b0bdd8756fb40c5b11fad5874a91014a421a74080e80c49ce2
SHA5124d000732781186fa9a0fdf3ffb8bac82b74b3722460915cdc1c24d1428039acc6db694e4ea3b4f0b0b5f03411b3523de97439eaefbc5e70f651d73c0cf07efb4
-
Filesize
1.1MB
MD523c986dd43163885bb45d57adf020b86
SHA1ab2a990b49fcb92b2d0273e1715e5db56db91be0
SHA2561d28c680a23ec97f207ff90797ff1b7d7163ccf3b22cae521fe422fbd451708c
SHA5120b024fda72bcfbb4843028e4d57db764b2a1e93d933aa3c40cee71e19a332b477849792fad14106042d0f702f57cb1e3a479a33b5be55b7deb134bed27e0216a
-
Filesize
16.2MB
MD5ea5e7da2577c78dea08f986807c1b233
SHA1f3a69a8acf9421f9e35f4278251c35bffc4cb2ea
SHA256b519e35c5ff846bf239678341411479e93f5e9461a1df50eb1079a58619c499e
SHA51213b76a06b353d56a8ddcdcebaa085d5605819e8b82f3778da647cf144a5f48f303d6d90ecabe96744b60ee1bca818aefc39ee8cccb72a5630bcbd209782d976a
-
Filesize
1.8MB
MD5ac4bbc1edbb06e571ea52e14c30e4466
SHA122cc075a361d6532f8055616eb62a9db4d49d117
SHA256bb894ac003e8b1d33cb387e9025a85cb34fb17f581199df5b12cb0198e399ef8
SHA5120f34dcaa27205248ac4b89243e23d350b4eabac336f9cbe42a765b49886aee56c498e7739197328b9ee8e270fbdd1da257597968e5ed5d9cd08a84890c6b1a15
-
Filesize
1.8MB
MD5d1d354cb5868445d92b39c266395c6b6
SHA1b1ae7a62873b6df3b3c1dfdf8db3343483f245db
SHA2564aabb39cfbf659d2db01d94594a25b169f62167a9c71efc8a02a466c3393146d
SHA512662ffbf308184290c981ce713c1b8987cb5c5ad3e47c631a0d5b69b0beebbde7737dbc5f3ad7ce55143856b178184da12bd256e7abc07631af788a328303b976
-
Filesize
9.6MB
MD5721af864933faa3fbe9def29ff519a7e
SHA16b8e6ab7df8a20b2b77b60de70fd68e5b9b2afef
SHA2565e22936c3a0155a3f9137630eda80417f4a760aa7f453d23f3050d12f10f457f
SHA51210286955a2dad3e4b4b7d752e1d8e0d5fbe1604ec05f8b9e290b5f6990bdcb0a15956152486c68c84215b34426be38effc297e0585021d3c05f5c157b5640f84
-
Filesize
1.8MB
MD5d86ef705a7d83158d461aef7098399ed
SHA1cf4e5971bda6db48cc93ca3c40cfc1ddf0d617ec
SHA25635e2eda0fc90ba0a0af7f45db86e223c0a3d385c2ec82989eb4aca8e25dc489d
SHA512ec5cf6b8b04201d56dcf95d9d0788888b12fc02c19d996e941e4fbc0131c94d2a913dae39748df8019abc823ba185e0ce951784783712cc20a52d0ffeda4ca2a
-
Filesize
14.2MB
MD56b9694e321a7d18137002559f6250a82
SHA13603d93b2dc16c5c4bac4a566a5378b295ccbe47
SHA256166db0bcd9676f1f5802aad920e1403607c2ab95354961a5323ed8d17ca1b47d
SHA5120b46864d1696d01a88ffaddd17faefb1eb04a25fe7c536ae7818453552d9add5ae6e7e972e0685038f0414c12091784d5fbae671400757fe1541dc52d5d79ec3
-
Filesize
1.8MB
MD5d220b51eaa86c35c6efc0279b316e56b
SHA1e715261ca58f7b72c00baebe62e72b0e50d595fa
SHA2565f263f62a86d5108b9bfa625bacc6947beaf69b3ce8dd886bc31addadf338e20
SHA51250c1020bd60de746e539ab7f253b8080771d9a5f9a8640b620fdf0d3547fa9dc410878980db6491fd60fe3f55247b398d9b3d201262c97ae2f7949e0c147bcfb
-
Filesize
10.5MB
MD5b93d6172e4880dbab310016095ab2a7a
SHA1c13dad573f095ff063abfab866aed4e55b5bd04b
SHA256e8ab7836966962674ac86b6ab056507863994b3bc0586c13e72ca8462ef8b41b
SHA51258d6cabb4eb6fd992dedc8d5e8daee1f4779fe9c27a97b7614ec96f27f57e3b758d13901f01491008c90c80082707592546841a415b10dc89616367b48d87c1f
-
Filesize
710KB
MD5e8a0d3f0892074d3956db01ffc6423b7
SHA1736bd47f31aa3af5c9a1a48163b51ab15e857ea1
SHA256638bdf8feb47c8df18bdd4da1176008e6c194399793d57d6c386019a93cee768
SHA5126e30beea9fe207ad7220b1373c66105768ab2a526aa51c037882cdaccf30649ef50ac7c392499ef96752393205920e342f6efcaaa5332f45ca063916c54dc60a
-
Filesize
12.6MB
MD54db83ccd87fca5e1e976034a6ee3636b
SHA16cbdb1631a9ce1d637d8aceef9bcca518e48428a
SHA2560b0a6148f0aeda82ac0ed8797ce416c09f7e082eacdf20eedb034146c2a74199
SHA51223d6efaceddf3fcbfd37dcffccbde63c2ec8f20025af542686eb7ee5d19c8c9aa392b3bcfc654ba306836a1f10d449224058f0cdb75ad51d95c169d21dc6d54a
-
Filesize
19.6MB
MD5ab7282bbffa89e505613f971dc42776b
SHA14c6702f040f54001b9afbdce2e6a56818eecba6c
SHA25679be4fa436a0d14c57fc90580d61fe5ed11e150bcfb90d15ffafe1dddf126c23
SHA5124424934fbbcc9864d9ea937835f7d47accab912c8cf4ae142f6db1e9d4800f1c6cde9250ce5c7a8ddfa4299040964f652c5ac909f33c1c5a038d33aaaec855df
-
Filesize
703KB
MD5f49aa2fcd0176cd83ce448391d1fb81f
SHA19478594e8d138d2bbc967f3210c3bfdf08527751
SHA256a99a956618b9604bf06b2ccf080e2638cc1851f23306b5852a47add4b12b6b9c
SHA512c07a062c2d42a6530b484611fcacbfff6018b2219497aecbd8b5d1451cb7eb2d7c1d3b2a550b7118ba2040c1388868c0ef0724ce032131da8eee4d254d883edd
-
Filesize
69KB
MD50552ac5e5fd9a0d6e746cd06f261ff65
SHA1374ade458f0b3ff2321dd0eb6528ea26f6a870ea
SHA2566f680209090b9af31145107f0c58040471a7d32c73867a7d167247d506f43e36
SHA51234e6b750e34e36b291162f07caa6255564a03c5d0d28cb2b346679d009874ec3ff3f3be3f47b743511de25d25be713f70a05a356b8f26d47eeb3db54f3d1aac6
-
Filesize
15.0MB
MD5ab23e2cf664403e03cc73c930d051a52
SHA16793fdac254cd8774dc53de1eb06df4b280815c8
SHA256de841cd9ec4ae9f5ca06b38bf1665dd04633462622f987fe9e5e38cb82406949
SHA5125450182ec458865420819b0baba37f40b7b24c22c89be13e504e24f37502b6b0650a18543a55a3aba83a537247d79540ab4f0c83ffadb49bd931daa59935f4c7
-
Filesize
2.4MB
MD5b6940f36c90d59dfe860d3a959d88091
SHA135d847e5c195bc76cd1f1c6489ca19e07280dd5a
SHA256d57f330ef6c9c3334455af44b6e522a1cc8df4f4fed29c85e94083a7641e13de
SHA51218b52c50b2c7b86e5fd4bbf3efacc690e3deda90fabcbaf3afc18e6623fb69f6dacc918312c5e6ea575c2319278b8e24a05ed36f34ae32c5a7b6915ae9ac259c
-
Filesize
1.8MB
MD5bc8678a1779669c67b48d3328fd7010b
SHA184d9afa1f9db1a1d8fc3967ce6b8ccc5c91670f7
SHA2560a93430639819f65d1aa69caabf55cded07c55efb751c08b4e57cb7cf82c7411
SHA5129534dac20a8ce842769bcca6e0d58e1462bb359dfaead5e344636ba1a844099487de19761f298be2cb9461185deb0539b4ab5dfe4df764b84c7eb93308ad0278
-
Filesize
16.7MB
MD5796f5e4a904ba8091b508ce0d9b19bc4
SHA10249a7b0c58b9f8efe51294dde04f479c7a25d94
SHA256d8c0a90bc53448d6940898342dd785eded8d8f6cfbe2bbeb00edea1499b19291
SHA5125a8da566933eb072791d14e2a19a464bb5328dd21649b99fdcd9ee7530c56eea60cc4c7c56bdf422a2baae712950fd32a832639edb123197bceeeab294b653d7
-
Filesize
4.0MB
MD5447c7da89b2bdb0dcdcf609bf9da7ddb
SHA120042e2b8c38a9292a113058ce9b3ad4bbfa81d6
SHA256bb25cd37e89107799e7f294170d582c69880d1b35de2463b6c684c9219a3c371
SHA5129068ea868af7db1bbdb3aeb267d4f9f057fd527ce2dfd1c24669e6ef7d6a0aa3fbb97de3335834771a4aaa66c139c39f839c656139a645a4e141d2ea6892957c
-
Filesize
1.8MB
MD5a0aee422feca546d0135b26042afd898
SHA1113b9b01f4f9550fc04ca3d08a26e7c66ac938d2
SHA256b10f3fbcf6262cd65b12cb50c72b0a02b46f5c806feb16d0e3cd31d654f0f965
SHA5122f29e139ce9783f45bc87c0414d94d6361068017b562a481472a831b6ef30b1951bde133567798f2f6d50b914b03910701a63a6eb9cf614328825fdd2d34054b
-
Filesize
173KB
MD58c7c6ad26f7ca851203651c487853a9f
SHA16fff77f0c19c2e1d04a58fff2e267aabe884d97b
SHA2564c5d9f8b5ea2b960c6a56ac79127e9d45340fe17bedd35ad79831b6b8a521d5d
SHA512df5aebe2e1014452e80f3b309d0c9c2282d6efe8986b040b064392ffed4e4b96fc7ab8ab9c1f2a60276b6ee14a2391c888a5d8c32e0621bbe1f51b5e6d032b3a
-
Filesize
13.7MB
MD5ed5d456166e08b70b9a4f8f53a77f0d5
SHA12e610a66a568f45edff015a3f8ecb2cdc7732693
SHA2560893f12c4b72dbc7eb9d9dd3a7934e12f24b9ac72e691adafb6a2418ef9933b2
SHA512eb86e34de41a80cf9e2b5ceeb3ef98a30286d8d282ff1a503832ac5d37d0a6d746c752c474283868cd032cda929fb6c5f1750cac7d968c7afb930aad06180086
-
Filesize
2.8MB
MD546a6c8ae2e0fa52ada0eb2f1ee063455
SHA1d8f7bb97c444a9c05d3a76f64b5c02a88251fdc1
SHA2567f024c6972b5a223630c4522bd6a1904f44d2e18433b7d898e99c491d7b1eef0
SHA51231c03db35d7ba6b4846f626d515de2612c7de9f74b4b782b140b6b1b4e42283a5013bc8b1c77ed2a848f5786bfbafcb3f16448ce38afa170354a3bf83f0b89ce
-
Filesize
703KB
MD55c0837a8cb6613b66bc571e8c92114ee
SHA19aa09a2d93baeab4797cefacff48e42190d56411
SHA256ca2bc7c5650b96232f44da809c169972b19da4c70c29583529071dfa75d6873a
SHA5120c1aaddf57604b4d48aa2c96c28fbe243aa16921eeb13c16610ac5d622224d1be24c5a1951ebc54b35ead2e6f6176a79a1e52da7026d212d2fd97d37ade2c908
-
Filesize
78KB
MD57ca57d1f90ab7acff1c8f853dc9106e9
SHA1fbd1d5e1898a032248e2fd0f0a3880fa2db49545
SHA25667229f879aafba98856bfba9200cc13ef704627454c021904b50dced0c8fe597
SHA5126209b5c934e47fabf6ad391ee53fcc410b72e7b732126b32ff4173c086f0ef46f8c1dbeee6f2f58aad2fe07d66903e2718d97a5b5854f9af0b52e0d33bc6c401
-
Filesize
651KB
MD55a49acd88afcba0e217af733b1583099
SHA1d566345d317877d03fd2e19cb27aa94b95bb34dc
SHA25612e448d84da922f5294516a31a0215c20b96316882836ac9ba3ce4be272a8e8e
SHA512a902e26443b12574940b02c92776e8e3fd0d6e4609caee1570eee778c019a7c06276084df6e3d02eecab1040b2f7c2698a9e84f74966e2dba24021d2fb7479f9
-
Filesize
582KB
MD58679732ad4065415821054b27f702f16
SHA1b014de0123e558f0d2640d97cf699782393deb45
SHA256b5e04614142e6fab8cd6613766575cb3b63431305513a6353cd13b7ef93e9983
SHA512d4e70272afc15f12d5c08f776817bb0cd5f0ac68c542cb34c872e5795290603018b50a8da385fae458050545a66b93e9afb86f56e6ef4afc000754e8fce2ac55
-
Filesize
576KB
MD5ad9d2f432de46b7ae190926f74dc34d1
SHA19d4ff6ccda7eeeca342cf297e7ea907c1535aac1
SHA256a1da3c7ade1b8cb18385fe4d89c7ed3b842fd71ad725578d437d2465164ce458
SHA512bb24a55a8036b65d9bd9edc2982869e1bf136b302da7297ee55f3baf41bac5c2634044af9e4420ef526d1d5e1e83198d2c08826bab8683206efb00e61e8cd94d
-
Filesize
709KB
MD574e91bfe0318fe0adc4c4c0fa3a00704
SHA16dd34a29356141f4f7ad56f34d6b3177f8f82876
SHA2564955e9143920711370c6ce8fbe72fdf8282f4902393e28d341d9c4835da61414
SHA512e7befc70cce3e237816ea2069cd320bc92b1ea0b6ce7c0e39f8ef8dc705552990a3920a3b4bd4e68bc54ece1671365eb880faf18c8b9b6ba4c13da927a885c00
-
Filesize
134KB
MD57804f6f51c433af8aa82f294bf07d67a
SHA120e2d84b33a087743b42c39aa8b92f322e821111
SHA25674e23105252763346814c99c5eb988cd7d8e007fb63ac5caa93ab1fe2b1ba859
SHA5123a4bfd9d71f838efc460f21aa8cc79749feea6ddf79c20c75517120c0d63262ce2bc2e747531923ad738378f30768b3b6996bef27a207bd78edb0543a926c4dc
-
Filesize
1.2MB
MD5fe902005ed90ec47eddb4570a1ff9a26
SHA1f8c3614069d51665cfb34d573d0dcf0bb8a645b1
SHA256eaff12ba081d72f28774895d4ed24d22e07797768475f49bd9b7a6d1265235cf
SHA5127f0a47393c23b3eefc59ad90207427a93406957c33191db24c55349fb83b9b825a78edd149790178905c020cea1fc9afb8fae026394b2008c2cd1f59cc7c12d5
-
Filesize
707KB
MD56c1a150fde3b4533ecf83db29d3f5a2d
SHA13f646b276e6d8cdd55072e53caa9aa503e6a2544
SHA256e6f8de32fe872c298660a01efdf438f16f12754d13e8c640062a3c59355886c4
SHA512b8293369528135ed8bb512ea9625acac23ea0acd6c9cd14c806bfbb15340a75de8777f07ba614f4972b9b968113aa0653cdbfea24a6a017d1fabee552aee243f
-
Filesize
69KB
MD596c26a967bb6de3c6c7efa252f92aea3
SHA1e0d3295a059069a35e701a3d55eb6e8399099dbd
SHA2568a8cc4bfa625d4555f15e7b788a4e79b9cdfd5745654fbdac34da58d79381b10
SHA5126301fc1cb1060efe1864e215aaf68f001e3e908d963966c6d30517468a7dff101c2ed97cd52f106e832166908fa2bddeb872e28ccc8c01f183ab87490c80947b
-
Filesize
26.8MB
MD59aa08e3b48343353ff9c1bba4af5c53a
SHA1d2c93d539b82aa46692fd964d98f8d7950c081a8
SHA256bf0d431a08d5a8122b3df5c5dcdd9f6aac19ecd1ffd1ed1829755263d4224594
SHA512a9f13477943850c9b319cb4ad55459a431dbbf49dd0fbf4160ab777daa7d4f294a2130132c0d328aaf38594237c674e5244915f6d7e9fc88a463304724ea29d8
-
Filesize
1.8MB
MD53ff6afba8eff6ea7b2eb70c0cacaa646
SHA136a3f8db2637ca7f3d46aa2934edb150e432f285
SHA2560ad29c242d554f3b9129e24d906571bdc38f811078a4e6ec9c62c6ad8181c3ff
SHA512411b0c8950125a38a0748082da295684ccebdd781d98ae9d75d3862a49c3f0eb56379e8c5db7fa641e787d59edbb59026a9ea99c49523ebd2f3fe398bb2cec2a
-
Filesize
703KB
MD588f149adaf432451f0a582e31e46df06
SHA17591e57ad11fda30d9bbb7b22608840e2bc16577
SHA25683093b209662dfd887b8a023882b0643a99c8636d2768f1230fc2e05b10bebd7
SHA51227ddb767cbbadcf1bf07daf561842d7c94fe32dec06f103be7da4467b46ec5df7bda71c173e6e65d6bcaa1817824652ee3c6b147d258c439ebf71b42d781a6fa
-
Filesize
180KB
MD509dd442c5cda47f7437a8e3acc7d5e82
SHA10c2818a2a175812e7462214dd27b6d694b6d1fe8
SHA2567a5be7ab3131eeb223dea7cef4482ccc6d744a212d753883f5188725a6c7e8da
SHA51244256231868debd0f8fc6128db8e7878291496e17a5a01e50a58327695d6280a32b03422e2a8469542aed58c680547c373631e1276e668761a99218a9289097a
-
Filesize
1.8MB
MD5a00ae1aace823c0e1c283273677c087e
SHA1aca855a0a1ab617e079d1e13eb05fb723504e73c
SHA256f41df794c1abc70f1884b9e3d7625e1bedd98df73dbccb34082d01f88c0c157d
SHA5126943cc97c3de024255b8d5786f5d8e0d186c55e9ac050cc933ff66c0fe4fb122fdaec05e50f330816f67fe303bdd937b793876579280b6361e5bb78855274f2c
-
Filesize
612KB
MD57ef08c4be54b48378e1b5a02df416643
SHA13c2c8c8e05ed0dffc4f88f18f0c1960efa9cabb4
SHA256bb3a7a63c1ee2c6d61192caea302ac352877597d5639f0e0be3aa5bd8c67fc97
SHA512651151b9c7e4afcef79dcd1995d4547ee7ee29eb85bbbfc76b2e78cca67b45f46805f7129e4c1a13bed086e683fb6c4f83fc9dc47cc5d42047f2ee511d068201
-
Filesize
752KB
MD5a67b4d9e1c0828b49d1607869c3898be
SHA189a2ea97e3b1c032fff4f0bb07deebc85209588d
SHA256235ab78d1c6df6ac4f7f6456a09f1a981774a2af24aad59fbe802dd136f26c9d
SHA512213a0003b4b6a71e7f8303644eadae605fc28c5ee68ca911f6d952fce1ffba47204e3732ce6014fb7ebf7e488453b4d10898c8e590af14ef89622b18ee971c63
-
Filesize
78KB
MD5559c296a0d2fc174c02b98c02d1a415f
SHA1990add69343019370fa6597178c29f53879e10e0
SHA25648c5da4953adc5d99330dad86ff59ca28fe448a2eeae95adb452a504e228756c
SHA512b9f58de21439e7b3737c83a3f0181e950e25aa65a8b92d3d7b777cdaba23a0c3e2bbdbf4054a92475500d4d0e6534dee93b75e2248793755880ce2c3bb820645
-
Filesize
75KB
MD54b0f0d23750d584351a7ea28b8249d9d
SHA1edf7d13d23d11175cafe265bf299c26d21e51664
SHA256ca5ec9e2f3f8b57fd3d0c29bf3eea9ee1de1536ae10ca5aef038c9584039bf62
SHA512c5ce2beff7684ddedf0d907ee79a1124d6a9b6da7333a730692b86976c189806ced0a91a11de2882fca4229591313fccf215dcb74d58741490ede86f75ac0f4c
-
Filesize
68KB
MD5a3b05f5d30afadb5b963069c965551fe
SHA13e809baf5440eaf7da8e924c293474afe641eac9
SHA256f869c400b541e22878ade201345b184ff758883210c05ba4ab7ec572038843f7
SHA5128a3ce58a8813b560fd7e5d6ae2ed643a65eeb8338a3a98f4a00bacf14ca461de574a7b34a02ba457a857890603cff884975fe5fd8baf2d8571c9b9246a555803
-
Filesize
68KB
MD53eccf107a0488f273ce91ba3d7796f5e
SHA18b19d2b69602b74309c0d0c4e5eca4c218210c41
SHA2569efd5340ff3e45d6da88b001471416c5ec564b39a3a00a9152f5b00c6cd61727
SHA512786c3832a1cc674f5833118026c6946b2cb447e921dd328d4c31386d69fe50edf1592e6c7d9f6cc247c1bf553a29ad5d23bbd765cd66c326ce1e1044d332952b
-
Filesize
68KB
MD591f391ac2a22651f5693c86bf4b88f73
SHA1c1b8e78c2588b80ae8e659463a723c0ec89850fc
SHA256974a49889c81eaccc38290a2f90fd158ddcce6a29dfff066fba90a3027354eaf
SHA512a8979e6b9b7642c5c6f4b9b92de3fd5854362af9ed5bbc7980cd61c8c18d0d8a17be34c81605bc7717526c78c7763541b66fe5a5b5b5a9c2ce2fc9a36ba106cb