Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
05/10/2022, 19:46
221005-yhfc9sfdc4 104/10/2022, 14:21
221004-rpddxsbedj 804/10/2022, 14:14
221004-rj33dsbebr 804/10/2022, 09:53
221004-lwl2raagdr 104/10/2022, 07:58
221004-jt1q1sacc7 803/10/2022, 15:56
221003-tdlx2adgdr 8Analysis
-
max time kernel
1455s -
max time network
1616s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/10/2022, 07:58
Static task
static1
Behavioral task
behavioral1
Sample
BarTender Enterprise 2021 R5 11.2.166048 Multilingual.zip
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
BarTender Enterprise 2021 R5 11.2.166048 Multilingual.zip
Resource
win10v2004-20220812-en
General
-
Target
BarTender Enterprise 2021 R5 11.2.166048 Multilingual.zip
-
Size
766.3MB
-
MD5
09ea7e2bef5722cdb9ee37a7dab48ff3
-
SHA1
d4fb2231f80333b1b50e6f790d3b59eb3ff26374
-
SHA256
280a84ca1f8ece3fc5af67010041af8c1a1bfa2e34e80961e60312800d37db2c
-
SHA512
eb9d65e42bccf4b700eb51c3f2890ac80f2e61a04ff661cdc3c173ff85a1f8e7f9e1cf2de89fd3517ca0b106240791f60158a7af12a5395b49e5299b22d3bf38
-
SSDEEP
12582912:whzb6xxr5Ni69eds1tauM0I7j0LFCLw0FEl1oZ+rPAkIYw+oKj7XkFgMKiLVVKYH:whzb639Ni6agtW7ZwU6+8roYwS7dN2jr
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 760 Setup_x64.exe -
Loads dropped DLL 26 IoCs
pid Process 760 Setup_x64.exe 760 Setup_x64.exe 1476 MsiExec.exe 1476 MsiExec.exe 1336 MsiExec.exe 540 rundll32.exe 540 rundll32.exe 540 rundll32.exe 540 rundll32.exe 540 rundll32.exe 2008 MsiExec.exe 2008 MsiExec.exe 2008 MsiExec.exe 2008 MsiExec.exe 2008 MsiExec.exe 1336 MsiExec.exe 1720 rundll32.exe 1720 rundll32.exe 1720 rundll32.exe 2008 MsiExec.exe 1336 MsiExec.exe 1756 rundll32.exe 1756 rundll32.exe 1756 rundll32.exe 1336 MsiExec.exe 1748 rundll32.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: Setup_x64.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: Setup_x64.exe File opened (read-only) \??\I: Setup_x64.exe File opened (read-only) \??\L: Setup_x64.exe File opened (read-only) \??\N: Setup_x64.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: Setup_x64.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: Setup_x64.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\F: Setup_x64.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\S: Setup_x64.exe File opened (read-only) \??\V: Setup_x64.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: Setup_x64.exe File opened (read-only) \??\K: Setup_x64.exe File opened (read-only) \??\T: Setup_x64.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: Setup_x64.exe File opened (read-only) \??\M: Setup_x64.exe File opened (read-only) \??\O: Setup_x64.exe File opened (read-only) \??\R: Setup_x64.exe File opened (read-only) \??\E: Setup_x64.exe File opened (read-only) \??\Y: Setup_x64.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: Setup_x64.exe File opened (read-only) \??\U: Setup_x64.exe File opened (read-only) \??\W: Setup_x64.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: Setup_x64.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 1156 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1156 AUDIODG.EXE Token: 33 1156 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1156 AUDIODG.EXE Token: SeRestorePrivilege 1964 7zG.exe Token: 35 1964 7zG.exe Token: SeSecurityPrivilege 1964 7zG.exe Token: SeSecurityPrivilege 1964 7zG.exe Token: SeRestorePrivilege 272 msiexec.exe Token: SeTakeOwnershipPrivilege 272 msiexec.exe Token: SeSecurityPrivilege 272 msiexec.exe Token: SeCreateTokenPrivilege 760 Setup_x64.exe Token: SeAssignPrimaryTokenPrivilege 760 Setup_x64.exe Token: SeLockMemoryPrivilege 760 Setup_x64.exe Token: SeIncreaseQuotaPrivilege 760 Setup_x64.exe Token: SeMachineAccountPrivilege 760 Setup_x64.exe Token: SeTcbPrivilege 760 Setup_x64.exe Token: SeSecurityPrivilege 760 Setup_x64.exe Token: SeTakeOwnershipPrivilege 760 Setup_x64.exe Token: SeLoadDriverPrivilege 760 Setup_x64.exe Token: SeSystemProfilePrivilege 760 Setup_x64.exe Token: SeSystemtimePrivilege 760 Setup_x64.exe Token: SeProfSingleProcessPrivilege 760 Setup_x64.exe Token: SeIncBasePriorityPrivilege 760 Setup_x64.exe Token: SeCreatePagefilePrivilege 760 Setup_x64.exe Token: SeCreatePermanentPrivilege 760 Setup_x64.exe Token: SeBackupPrivilege 760 Setup_x64.exe Token: SeRestorePrivilege 760 Setup_x64.exe Token: SeShutdownPrivilege 760 Setup_x64.exe Token: SeDebugPrivilege 760 Setup_x64.exe Token: SeAuditPrivilege 760 Setup_x64.exe Token: SeSystemEnvironmentPrivilege 760 Setup_x64.exe Token: SeChangeNotifyPrivilege 760 Setup_x64.exe Token: SeRemoteShutdownPrivilege 760 Setup_x64.exe Token: SeUndockPrivilege 760 Setup_x64.exe Token: SeSyncAgentPrivilege 760 Setup_x64.exe Token: SeEnableDelegationPrivilege 760 Setup_x64.exe Token: SeManageVolumePrivilege 760 Setup_x64.exe Token: SeImpersonatePrivilege 760 Setup_x64.exe Token: SeCreateGlobalPrivilege 760 Setup_x64.exe Token: SeCreateTokenPrivilege 760 Setup_x64.exe Token: SeAssignPrimaryTokenPrivilege 760 Setup_x64.exe Token: SeLockMemoryPrivilege 760 Setup_x64.exe Token: SeIncreaseQuotaPrivilege 760 Setup_x64.exe Token: SeMachineAccountPrivilege 760 Setup_x64.exe Token: SeTcbPrivilege 760 Setup_x64.exe Token: SeSecurityPrivilege 760 Setup_x64.exe Token: SeTakeOwnershipPrivilege 760 Setup_x64.exe Token: SeLoadDriverPrivilege 760 Setup_x64.exe Token: SeSystemProfilePrivilege 760 Setup_x64.exe Token: SeSystemtimePrivilege 760 Setup_x64.exe Token: SeProfSingleProcessPrivilege 760 Setup_x64.exe Token: SeIncBasePriorityPrivilege 760 Setup_x64.exe Token: SeCreatePagefilePrivilege 760 Setup_x64.exe Token: SeCreatePermanentPrivilege 760 Setup_x64.exe Token: SeBackupPrivilege 760 Setup_x64.exe Token: SeRestorePrivilege 760 Setup_x64.exe Token: SeShutdownPrivilege 760 Setup_x64.exe Token: SeDebugPrivilege 760 Setup_x64.exe Token: SeAuditPrivilege 760 Setup_x64.exe Token: SeSystemEnvironmentPrivilege 760 Setup_x64.exe Token: SeChangeNotifyPrivilege 760 Setup_x64.exe Token: SeRemoteShutdownPrivilege 760 Setup_x64.exe Token: SeUndockPrivilege 760 Setup_x64.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1964 7zG.exe 760 Setup_x64.exe 760 Setup_x64.exe 1160 msiexec.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 272 wrote to memory of 1476 272 msiexec.exe 39 PID 272 wrote to memory of 1476 272 msiexec.exe 39 PID 272 wrote to memory of 1476 272 msiexec.exe 39 PID 272 wrote to memory of 1476 272 msiexec.exe 39 PID 272 wrote to memory of 1476 272 msiexec.exe 39 PID 272 wrote to memory of 1476 272 msiexec.exe 39 PID 272 wrote to memory of 1476 272 msiexec.exe 39 PID 760 wrote to memory of 1160 760 Setup_x64.exe 40 PID 760 wrote to memory of 1160 760 Setup_x64.exe 40 PID 760 wrote to memory of 1160 760 Setup_x64.exe 40 PID 760 wrote to memory of 1160 760 Setup_x64.exe 40 PID 760 wrote to memory of 1160 760 Setup_x64.exe 40 PID 760 wrote to memory of 1160 760 Setup_x64.exe 40 PID 760 wrote to memory of 1160 760 Setup_x64.exe 40 PID 272 wrote to memory of 1336 272 msiexec.exe 41 PID 272 wrote to memory of 1336 272 msiexec.exe 41 PID 272 wrote to memory of 1336 272 msiexec.exe 41 PID 272 wrote to memory of 1336 272 msiexec.exe 41 PID 272 wrote to memory of 1336 272 msiexec.exe 41 PID 1336 wrote to memory of 540 1336 MsiExec.exe 42 PID 1336 wrote to memory of 540 1336 MsiExec.exe 42 PID 1336 wrote to memory of 540 1336 MsiExec.exe 42 PID 272 wrote to memory of 2008 272 msiexec.exe 43 PID 272 wrote to memory of 2008 272 msiexec.exe 43 PID 272 wrote to memory of 2008 272 msiexec.exe 43 PID 272 wrote to memory of 2008 272 msiexec.exe 43 PID 272 wrote to memory of 2008 272 msiexec.exe 43 PID 272 wrote to memory of 2008 272 msiexec.exe 43 PID 272 wrote to memory of 2008 272 msiexec.exe 43 PID 1336 wrote to memory of 1720 1336 MsiExec.exe 44 PID 1336 wrote to memory of 1720 1336 MsiExec.exe 44 PID 1336 wrote to memory of 1720 1336 MsiExec.exe 44 PID 1336 wrote to memory of 1756 1336 MsiExec.exe 45 PID 1336 wrote to memory of 1756 1336 MsiExec.exe 45 PID 1336 wrote to memory of 1756 1336 MsiExec.exe 45 PID 1336 wrote to memory of 1748 1336 MsiExec.exe 46 PID 1336 wrote to memory of 1748 1336 MsiExec.exe 46 PID 1336 wrote to memory of 1748 1336 MsiExec.exe 46
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\BarTender Enterprise 2021 R5 11.2.166048 Multilingual.zip"1⤵PID:1900
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:692
-
C:\Windows\system32\verclsid.exe"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x4011⤵PID:1880
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1156
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\" -spe -an -ai#7zMap29291:164:7zEvent307561⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1964
-
C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe"C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i C:\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\BEAAB75\BarTender.msi AI_SETUPEXEPATH="C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe" SETUPEXEDIR="C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1664870922 "2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:1160
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 27C705CE439A5E158117DCA41CC08654 C2⤵
- Loads dropped DLL
PID:1476
-
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 0385B4C4A84646C07DB1A853AD384D47 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI66A1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_8087341 1 CustomActions!CustomActions.CustomActions.SilentInstallProperties3⤵
- Loads dropped DLL
PID:540
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIBAED.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_8108853 73 CustomActions!CustomActions.CustomActions.ForceUpgradeProperty3⤵
- Loads dropped DLL
PID:1720
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIC26E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_8111271 78 CustomActions!CustomActions.CustomActions.SetInstalledVersion3⤵
- Loads dropped DLL
PID:1756
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSICAF7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_8112941 83 CustomActions!CustomActions.CustomActions.InstallOptions3⤵
- Loads dropped DLL
PID:1748
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1355329F3CF3ACA15FDCD9DB2E9D9090 C2⤵
- Loads dropped DLL
PID:2008
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
194.7MB
MD5cb89850ee9cf83015f30d1df61e97b2a
SHA17ebd4b6e0636cc209ed8bc4ac1c1195459dfbab4
SHA256b8ac3b3c1a2c80ee17c6f8678d6777547477bb726ef7914fac14e2d7f331ba19
SHA512144272199c96c4eab27a3ad18e1995806d6c439dc00222a7b92979bd5343b422663e6421f68720ffae68a91a8bf1a6f207f6f62126678ee6c83c259fdfc77e24
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
834KB
MD5b0b2090c4200fb19e335598969a40f26
SHA1e31d5533f85ef03dd8eb21723df14ff71586bb60
SHA256e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd
SHA512177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
834KB
MD5b0b2090c4200fb19e335598969a40f26
SHA1e31d5533f85ef03dd8eb21723df14ff71586bb60
SHA256e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd
SHA512177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2
-
Filesize
525KB
MD51c62521f4ade74fe465aaf61049c3634
SHA1758bd079f98c5f1153213a4c78ee25f89eb64fa6
SHA256ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e
SHA5124b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
763.6MB
MD5143d94d5593d64dfd6f5ba8d15137413
SHA143af1f03e1dae86f0208369385fb0af8a487ffb9
SHA2560c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce
SHA5121a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455
-
Filesize
763.6MB
MD5143d94d5593d64dfd6f5ba8d15137413
SHA143af1f03e1dae86f0208369385fb0af8a487ffb9
SHA2560c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce
SHA5121a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455
-
Filesize
182KB
MD5fc136d5c16573d1d1a64b0a62b586235
SHA18363d0d80fb25e4ace7b77efcfe119b7675913a1
SHA2565a12236a02ba2984b62d7acfe5afb048e461fc4c76989d055ffe8965f212ebbf
SHA5120ad82e28de1a65251eb536aef9739a76baaaa28a41dae78faacb82a9d1acd83d71816051dec16b7664e16a741706803d1fc0ad914bcdca4d28cb2ac2a05ff427
-
Filesize
182KB
MD5fc136d5c16573d1d1a64b0a62b586235
SHA18363d0d80fb25e4ace7b77efcfe119b7675913a1
SHA2565a12236a02ba2984b62d7acfe5afb048e461fc4c76989d055ffe8965f212ebbf
SHA5120ad82e28de1a65251eb536aef9739a76baaaa28a41dae78faacb82a9d1acd83d71816051dec16b7664e16a741706803d1fc0ad914bcdca4d28cb2ac2a05ff427
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
834KB
MD5b0b2090c4200fb19e335598969a40f26
SHA1e31d5533f85ef03dd8eb21723df14ff71586bb60
SHA256e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd
SHA512177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
54KB
MD59793eda103b3ce9cbff0f08e7353e104
SHA1c9808ac631aafb99c1350709c904672ea4dc90f9
SHA256ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa
SHA512a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32
-
Filesize
54KB
MD59793eda103b3ce9cbff0f08e7353e104
SHA1c9808ac631aafb99c1350709c904672ea4dc90f9
SHA256ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa
SHA512a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32
-
Filesize
372KB
MD53061145ea0c0c8378e3d7e678b54eb51
SHA1432c8f861f196739291b642bb3249b5f08bd5db4
SHA2567da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d
SHA512621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae
-
Filesize
372KB
MD53061145ea0c0c8378e3d7e678b54eb51
SHA1432c8f861f196739291b642bb3249b5f08bd5db4
SHA2567da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d
SHA512621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
834KB
MD5b0b2090c4200fb19e335598969a40f26
SHA1e31d5533f85ef03dd8eb21723df14ff71586bb60
SHA256e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd
SHA512177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2
-
Filesize
525KB
MD51c62521f4ade74fe465aaf61049c3634
SHA1758bd079f98c5f1153213a4c78ee25f89eb64fa6
SHA256ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e
SHA5124b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
54KB
MD59793eda103b3ce9cbff0f08e7353e104
SHA1c9808ac631aafb99c1350709c904672ea4dc90f9
SHA256ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa
SHA512a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32
-
Filesize
54KB
MD59793eda103b3ce9cbff0f08e7353e104
SHA1c9808ac631aafb99c1350709c904672ea4dc90f9
SHA256ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa
SHA512a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
54KB
MD59793eda103b3ce9cbff0f08e7353e104
SHA1c9808ac631aafb99c1350709c904672ea4dc90f9
SHA256ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa
SHA512a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32
-
Filesize
54KB
MD59793eda103b3ce9cbff0f08e7353e104
SHA1c9808ac631aafb99c1350709c904672ea4dc90f9
SHA256ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa
SHA512a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e