Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
05/10/2022, 19:46
221005-yhfc9sfdc4 104/10/2022, 14:21
221004-rpddxsbedj 804/10/2022, 14:14
221004-rj33dsbebr 804/10/2022, 09:53
221004-lwl2raagdr 104/10/2022, 07:58
221004-jt1q1sacc7 803/10/2022, 15:56
221003-tdlx2adgdr 8Analysis
-
max time kernel
1669s -
max time network
1737s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2022, 07:58
Static task
static1
Behavioral task
behavioral1
Sample
BarTender Enterprise 2021 R5 11.2.166048 Multilingual.zip
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
BarTender Enterprise 2021 R5 11.2.166048 Multilingual.zip
Resource
win10v2004-20220812-en
General
-
Target
BarTender Enterprise 2021 R5 11.2.166048 Multilingual.zip
-
Size
766.3MB
-
MD5
09ea7e2bef5722cdb9ee37a7dab48ff3
-
SHA1
d4fb2231f80333b1b50e6f790d3b59eb3ff26374
-
SHA256
280a84ca1f8ece3fc5af67010041af8c1a1bfa2e34e80961e60312800d37db2c
-
SHA512
eb9d65e42bccf4b700eb51c3f2890ac80f2e61a04ff661cdc3c173ff85a1f8e7f9e1cf2de89fd3517ca0b106240791f60158a7af12a5395b49e5299b22d3bf38
-
SSDEEP
12582912:whzb6xxr5Ni69eds1tauM0I7j0LFCLw0FEl1oZ+rPAkIYw+oKj7XkFgMKiLVVKYH:whzb639Ni6agtW7ZwU6+8roYwS7dN2jr
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4964 Setup_x64.exe -
Loads dropped DLL 31 IoCs
pid Process 4964 Setup_x64.exe 4964 Setup_x64.exe 3252 MsiExec.exe 3252 MsiExec.exe 1992 MsiExec.exe 2724 MsiExec.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 4216 rundll32.exe 1992 MsiExec.exe 1992 MsiExec.exe 1992 MsiExec.exe 1992 MsiExec.exe 1992 MsiExec.exe 2724 MsiExec.exe 4300 rundll32.exe 4300 rundll32.exe 4300 rundll32.exe 1992 MsiExec.exe 2724 MsiExec.exe 3124 rundll32.exe 3124 rundll32.exe 3124 rundll32.exe 2724 MsiExec.exe 3220 rundll32.exe 3220 rundll32.exe 3220 rundll32.exe 3220 rundll32.exe 3220 rundll32.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: Setup_x64.exe File opened (read-only) \??\Q: Setup_x64.exe File opened (read-only) \??\N: Setup_x64.exe File opened (read-only) \??\W: Setup_x64.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: Setup_x64.exe File opened (read-only) \??\K: Setup_x64.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: Setup_x64.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: Setup_x64.exe File opened (read-only) \??\Z: Setup_x64.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: Setup_x64.exe File opened (read-only) \??\V: Setup_x64.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\F: Setup_x64.exe File opened (read-only) \??\O: Setup_x64.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: Setup_x64.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: Setup_x64.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: Setup_x64.exe File opened (read-only) \??\P: Setup_x64.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: Setup_x64.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: Setup_x64.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: Setup_x64.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: Setup_x64.exe File opened (read-only) \??\Y: Setup_x64.exe File opened (read-only) \??\S: Setup_x64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3220 rundll32.exe 3220 rundll32.exe 3220 rundll32.exe 3220 rundll32.exe 3220 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 4968 7zG.exe Token: 35 4968 7zG.exe Token: SeSecurityPrivilege 4968 7zG.exe Token: SeSecurityPrivilege 4968 7zG.exe Token: SeSecurityPrivilege 4500 msiexec.exe Token: SeCreateTokenPrivilege 4964 Setup_x64.exe Token: SeAssignPrimaryTokenPrivilege 4964 Setup_x64.exe Token: SeLockMemoryPrivilege 4964 Setup_x64.exe Token: SeIncreaseQuotaPrivilege 4964 Setup_x64.exe Token: SeMachineAccountPrivilege 4964 Setup_x64.exe Token: SeTcbPrivilege 4964 Setup_x64.exe Token: SeSecurityPrivilege 4964 Setup_x64.exe Token: SeTakeOwnershipPrivilege 4964 Setup_x64.exe Token: SeLoadDriverPrivilege 4964 Setup_x64.exe Token: SeSystemProfilePrivilege 4964 Setup_x64.exe Token: SeSystemtimePrivilege 4964 Setup_x64.exe Token: SeProfSingleProcessPrivilege 4964 Setup_x64.exe Token: SeIncBasePriorityPrivilege 4964 Setup_x64.exe Token: SeCreatePagefilePrivilege 4964 Setup_x64.exe Token: SeCreatePermanentPrivilege 4964 Setup_x64.exe Token: SeBackupPrivilege 4964 Setup_x64.exe Token: SeRestorePrivilege 4964 Setup_x64.exe Token: SeShutdownPrivilege 4964 Setup_x64.exe Token: SeDebugPrivilege 4964 Setup_x64.exe Token: SeAuditPrivilege 4964 Setup_x64.exe Token: SeSystemEnvironmentPrivilege 4964 Setup_x64.exe Token: SeChangeNotifyPrivilege 4964 Setup_x64.exe Token: SeRemoteShutdownPrivilege 4964 Setup_x64.exe Token: SeUndockPrivilege 4964 Setup_x64.exe Token: SeSyncAgentPrivilege 4964 Setup_x64.exe Token: SeEnableDelegationPrivilege 4964 Setup_x64.exe Token: SeManageVolumePrivilege 4964 Setup_x64.exe Token: SeImpersonatePrivilege 4964 Setup_x64.exe Token: SeCreateGlobalPrivilege 4964 Setup_x64.exe Token: SeCreateTokenPrivilege 4964 Setup_x64.exe Token: SeAssignPrimaryTokenPrivilege 4964 Setup_x64.exe Token: SeLockMemoryPrivilege 4964 Setup_x64.exe Token: SeIncreaseQuotaPrivilege 4964 Setup_x64.exe Token: SeMachineAccountPrivilege 4964 Setup_x64.exe Token: SeTcbPrivilege 4964 Setup_x64.exe Token: SeSecurityPrivilege 4964 Setup_x64.exe Token: SeTakeOwnershipPrivilege 4964 Setup_x64.exe Token: SeLoadDriverPrivilege 4964 Setup_x64.exe Token: SeSystemProfilePrivilege 4964 Setup_x64.exe Token: SeSystemtimePrivilege 4964 Setup_x64.exe Token: SeProfSingleProcessPrivilege 4964 Setup_x64.exe Token: SeIncBasePriorityPrivilege 4964 Setup_x64.exe Token: SeCreatePagefilePrivilege 4964 Setup_x64.exe Token: SeCreatePermanentPrivilege 4964 Setup_x64.exe Token: SeBackupPrivilege 4964 Setup_x64.exe Token: SeRestorePrivilege 4964 Setup_x64.exe Token: SeShutdownPrivilege 4964 Setup_x64.exe Token: SeDebugPrivilege 4964 Setup_x64.exe Token: SeAuditPrivilege 4964 Setup_x64.exe Token: SeSystemEnvironmentPrivilege 4964 Setup_x64.exe Token: SeChangeNotifyPrivilege 4964 Setup_x64.exe Token: SeRemoteShutdownPrivilege 4964 Setup_x64.exe Token: SeUndockPrivilege 4964 Setup_x64.exe Token: SeSyncAgentPrivilege 4964 Setup_x64.exe Token: SeEnableDelegationPrivilege 4964 Setup_x64.exe Token: SeManageVolumePrivilege 4964 Setup_x64.exe Token: SeImpersonatePrivilege 4964 Setup_x64.exe Token: SeCreateGlobalPrivilege 4964 Setup_x64.exe Token: SeCreateTokenPrivilege 4964 Setup_x64.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4968 7zG.exe 4964 Setup_x64.exe 4964 Setup_x64.exe 2040 msiexec.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4500 wrote to memory of 3252 4500 msiexec.exe 105 PID 4500 wrote to memory of 3252 4500 msiexec.exe 105 PID 4500 wrote to memory of 3252 4500 msiexec.exe 105 PID 4964 wrote to memory of 2040 4964 Setup_x64.exe 106 PID 4964 wrote to memory of 2040 4964 Setup_x64.exe 106 PID 4964 wrote to memory of 2040 4964 Setup_x64.exe 106 PID 4500 wrote to memory of 1992 4500 msiexec.exe 107 PID 4500 wrote to memory of 1992 4500 msiexec.exe 107 PID 4500 wrote to memory of 1992 4500 msiexec.exe 107 PID 4500 wrote to memory of 2724 4500 msiexec.exe 108 PID 4500 wrote to memory of 2724 4500 msiexec.exe 108 PID 2724 wrote to memory of 4216 2724 MsiExec.exe 109 PID 2724 wrote to memory of 4216 2724 MsiExec.exe 109 PID 2724 wrote to memory of 4300 2724 MsiExec.exe 110 PID 2724 wrote to memory of 4300 2724 MsiExec.exe 110 PID 2724 wrote to memory of 3124 2724 MsiExec.exe 111 PID 2724 wrote to memory of 3124 2724 MsiExec.exe 111 PID 2724 wrote to memory of 3220 2724 MsiExec.exe 112 PID 2724 wrote to memory of 3220 2724 MsiExec.exe 112
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\BarTender Enterprise 2021 R5 11.2.166048 Multilingual.zip"1⤵PID:1132
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3328
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\" -spe -an -ai#7zMap32700:164:7zEvent134401⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4968
-
C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe"C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i C:\ProgramData\Seagull\Installer\{99937B8D-3B72-49EF-AB3F-45A5EBEAAB75}\BEAAB75\BarTender.msi AI_SETUPEXEPATH="C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\Setup_x64.exe" SETUPEXEDIR="C:\Users\Admin\Desktop\BarTender Enterprise 2021 R5 11.2.166048 Multilingual\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1664637472 "2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:2040
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 94E4B9373803DD1996AC57E3D249EBC0 C2⤵
- Loads dropped DLL
PID:3252
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C6B678F935166FE8CCD49351DC89DF87 C2⤵
- Loads dropped DLL
PID:1992
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding CF08B3848770FD3391446BC043DC9EA3 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI2260.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241641843 2 CustomActions!CustomActions.CustomActions.SilentInstallProperties3⤵
- Loads dropped DLL
PID:4216
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7F3B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241664718 74 CustomActions!CustomActions.CustomActions.ForceUpgradeProperty3⤵
- Loads dropped DLL
PID:4300
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI965F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241669734 79 CustomActions!CustomActions.CustomActions.SetInstalledVersion3⤵
- Loads dropped DLL
PID:3124
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIBEB8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241681109 84 CustomActions!CustomActions.CustomActions.InstallOptions3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3220
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
194.7MB
MD5cb89850ee9cf83015f30d1df61e97b2a
SHA17ebd4b6e0636cc209ed8bc4ac1c1195459dfbab4
SHA256b8ac3b3c1a2c80ee17c6f8678d6777547477bb726ef7914fac14e2d7f331ba19
SHA512144272199c96c4eab27a3ad18e1995806d6c439dc00222a7b92979bd5343b422663e6421f68720ffae68a91a8bf1a6f207f6f62126678ee6c83c259fdfc77e24
-
Filesize
182KB
MD5fc136d5c16573d1d1a64b0a62b586235
SHA18363d0d80fb25e4ace7b77efcfe119b7675913a1
SHA2565a12236a02ba2984b62d7acfe5afb048e461fc4c76989d055ffe8965f212ebbf
SHA5120ad82e28de1a65251eb536aef9739a76baaaa28a41dae78faacb82a9d1acd83d71816051dec16b7664e16a741706803d1fc0ad914bcdca4d28cb2ac2a05ff427
-
Filesize
182KB
MD5fc136d5c16573d1d1a64b0a62b586235
SHA18363d0d80fb25e4ace7b77efcfe119b7675913a1
SHA2565a12236a02ba2984b62d7acfe5afb048e461fc4c76989d055ffe8965f212ebbf
SHA5120ad82e28de1a65251eb536aef9739a76baaaa28a41dae78faacb82a9d1acd83d71816051dec16b7664e16a741706803d1fc0ad914bcdca4d28cb2ac2a05ff427
-
Filesize
651B
MD500bfeb783aeff425ce898d55718d506d
SHA1aac7a973dc1f9ca7abc529c7ea37ad7eaf491b8f
SHA256d06099ef43eb002055378b1b6d9853f9b1f891ada476932ba575d1f97065a580
SHA5122209d5f4999cb36ebf26c6b8cb3195cc9fc0f0a103f4a28dd77b04605d7c6e79d47d806454c63b8d42bbe32864be7cdb56df3cccf71a6c27fe0b331d8304e1ff
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
54KB
MD59793eda103b3ce9cbff0f08e7353e104
SHA1c9808ac631aafb99c1350709c904672ea4dc90f9
SHA256ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa
SHA512a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32
-
Filesize
54KB
MD59793eda103b3ce9cbff0f08e7353e104
SHA1c9808ac631aafb99c1350709c904672ea4dc90f9
SHA256ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa
SHA512a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32
-
Filesize
372KB
MD53061145ea0c0c8378e3d7e678b54eb51
SHA1432c8f861f196739291b642bb3249b5f08bd5db4
SHA2567da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d
SHA512621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae
-
Filesize
372KB
MD53061145ea0c0c8378e3d7e678b54eb51
SHA1432c8f861f196739291b642bb3249b5f08bd5db4
SHA2567da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d
SHA512621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
834KB
MD5b0b2090c4200fb19e335598969a40f26
SHA1e31d5533f85ef03dd8eb21723df14ff71586bb60
SHA256e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd
SHA512177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2
-
Filesize
834KB
MD5b0b2090c4200fb19e335598969a40f26
SHA1e31d5533f85ef03dd8eb21723df14ff71586bb60
SHA256e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd
SHA512177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2
-
Filesize
525KB
MD51c62521f4ade74fe465aaf61049c3634
SHA1758bd079f98c5f1153213a4c78ee25f89eb64fa6
SHA256ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e
SHA5124b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd
-
Filesize
525KB
MD51c62521f4ade74fe465aaf61049c3634
SHA1758bd079f98c5f1153213a4c78ee25f89eb64fa6
SHA256ae5544ebfa8d92072562dcc4f3a6b48e77ab1a1e263e8e8dabebf6a627286f9e
SHA5124b58f0216f2dcfff69f3e668d09e21c0c85a7087a01621f43a787344afcf31d05644b9374b2ee4719b2ede0019d88083104f7a8122409c1ea961a9c5016262fd
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
54KB
MD59793eda103b3ce9cbff0f08e7353e104
SHA1c9808ac631aafb99c1350709c904672ea4dc90f9
SHA256ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa
SHA512a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32
-
Filesize
54KB
MD59793eda103b3ce9cbff0f08e7353e104
SHA1c9808ac631aafb99c1350709c904672ea4dc90f9
SHA256ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa
SHA512a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
54KB
MD59793eda103b3ce9cbff0f08e7353e104
SHA1c9808ac631aafb99c1350709c904672ea4dc90f9
SHA256ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa
SHA512a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32
-
Filesize
54KB
MD59793eda103b3ce9cbff0f08e7353e104
SHA1c9808ac631aafb99c1350709c904672ea4dc90f9
SHA256ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa
SHA512a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
376KB
MD5c39daeba173815516c180ca4361f7895
SHA1db3ae54329834baa954569a35be5b947c86dc25e
SHA256a34bd87a23349bd52b8b0f25154235b90b698986c8849e101b7e40d11d48e4dc
SHA512e13cd98647059657355a69917898cdecdfc0b8da91036de1c030d20a4c5c1aacc06cd4d54fac65ecf1c8c44527dbba3c545f588260af1a0104b445e3f21ca929
-
Filesize
834KB
MD5b0b2090c4200fb19e335598969a40f26
SHA1e31d5533f85ef03dd8eb21723df14ff71586bb60
SHA256e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd
SHA512177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2
-
Filesize
834KB
MD5b0b2090c4200fb19e335598969a40f26
SHA1e31d5533f85ef03dd8eb21723df14ff71586bb60
SHA256e16ce1f8a1b24d03353502af35fa159ab9962b4ecce8f3bb9dd4b075552505cd
SHA512177dad69d6773dab432a39a91f113949573caa3f3513e1e79361e9d74efe813746bd25a9101ec6436be7476cd77b663102d7ee138a01afbc902738e3ad75fce2
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
780KB
MD55ef8fd841c7b39882d909df4b6806db9
SHA180cdb05c335fa083262dcccf1ee9930dbf60b139
SHA2567f2fdc8e2a4383cc7818c1e5f70a3727179187a03bcb56d7befab165af8f9fa4
SHA512591810d483ed994f5800290117c4b8cfc82177ec7e93bd74c541ef0bb776d286f1820986e30c16cf9e7e9526e3ec500962454403596b3e92bf725498b92dcb3e
-
Filesize
54KB
MD59793eda103b3ce9cbff0f08e7353e104
SHA1c9808ac631aafb99c1350709c904672ea4dc90f9
SHA256ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa
SHA512a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32
-
Filesize
54KB
MD59793eda103b3ce9cbff0f08e7353e104
SHA1c9808ac631aafb99c1350709c904672ea4dc90f9
SHA256ab0706949eb844f5e283f8b7c9dd6506a16ba3730fb3f764c88b0053e262ddaa
SHA512a8e7912d7cc344e0e98fb3f71cfad16097ad0fc7a418c84231844e35ad663eb00907463cbe07a73507de211058d8d459c18579af5c3f87916b5805fb51169b32
-
Filesize
372KB
MD53061145ea0c0c8378e3d7e678b54eb51
SHA1432c8f861f196739291b642bb3249b5f08bd5db4
SHA2567da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d
SHA512621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae
-
Filesize
372KB
MD53061145ea0c0c8378e3d7e678b54eb51
SHA1432c8f861f196739291b642bb3249b5f08bd5db4
SHA2567da0ced479531d54f6f4d4cb558b154e4585c1ac241815815dc6375887a9195d
SHA512621527bdda9a9c3713c7a5428c1607379493ac22006bfdfe10ba42b177b8864b0435698f6133939672aa2858c6b3a0766445c7a16d5d1acd0aaa6b63f4be94ae
-
Filesize
763.6MB
MD5143d94d5593d64dfd6f5ba8d15137413
SHA143af1f03e1dae86f0208369385fb0af8a487ffb9
SHA2560c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce
SHA5121a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455
-
Filesize
763.6MB
MD5143d94d5593d64dfd6f5ba8d15137413
SHA143af1f03e1dae86f0208369385fb0af8a487ffb9
SHA2560c575035b464a7d2f62e71a164e82ad3cd4ef694aeb27fbeef1c27f86aa648ce
SHA5121a9894c3ace38aff436211f80836b1153c9a04f095115f114bccd6db2c55b04dd207ca89f2c835005a2be6861bd68291113ecc66de75e9d1da995d46c2f7f455