Analysis
-
max time kernel
104s -
max time network
101s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30/01/2023, 11:07
Static task
static1
Behavioral task
behavioral1
Sample
secureclientinstaller.msi
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
secureclientinstaller.msi
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
secureclientinstaller.msi
-
Size
163.3MB
-
MD5
87e7420a226540b442e1e9005633cf08
-
SHA1
1f79f0522cc0fd2d7e29e2da8bb4b577c34f015f
-
SHA256
c6fb5cce89b8af5c6c8cad24b421c69f58ac64b3f93944c81108a7de06d09635
-
SHA512
424794c7184f1e3b398dfb55a6b61b524de56511c27f4fb6141b978eefbf0d50c03f13950a682e3570ed1d3a25bdbd371a5138c4140370c20b18be282b8aab19
-
SSDEEP
3145728:Uybah/qezBAi/Y2Twczv0H9nSkxwceFd9Sgn8N1IHrKkU+hKSRGWku:Xy/Dyi/fsczOxSYiFd9Sg8jKCqKSR3ku
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 2 1208 msiexec.exe 5 1360 msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 1748 {DE740379-FA3B-4136-A089-A0E2074E6D31}.exe 540 SurpassClient.exe -
Loads dropped DLL 6 IoCs
pid Process 2020 MsiExec.exe 2020 MsiExec.exe 1748 {DE740379-FA3B-4136-A089-A0E2074E6D31}.exe 540 SurpassClient.exe 540 SurpassClient.exe 540 SurpassClient.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ SurpassClient.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ SurpassClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ SurpassClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ SurpassClient.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\miaC3DC.tmp\data\OFFLINE\5BE60B43\D89555\Autorun.inf {DE740379-FA3B-4136-A089-A0E2074E6D31}.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\miaC3DC.tmp\data\OFFLINE\5BE60B43\D89555\Autorun.inf {DE740379-FA3B-4136-A089-A0E2074E6D31}.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\6c8815.msi msiexec.exe File created C:\Windows\Installer\6c8818.msi msiexec.exe File opened for modification C:\Windows\Installer\6c8816.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\6c8815.msi msiexec.exe File created C:\Windows\Installer\6c8816.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI97EC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA48A.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\{DE740379-FA3B-4136-A089-A0E2074E6D31}.exe {DE740379-FA3B-4136-A089-A0E2074E6D31}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\{DE740379-FA3B-4136-A089-A0E2074E6D31}.exe\IsHostApp {DE740379-FA3B-4136-A089-A0E2074E6D31}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SurpassClient.exe SurpassClient.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\SurpassClient.exe\IsHostApp SurpassClient.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1360 msiexec.exe 1360 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1208 msiexec.exe Token: SeIncreaseQuotaPrivilege 1208 msiexec.exe Token: SeRestorePrivilege 1360 msiexec.exe Token: SeTakeOwnershipPrivilege 1360 msiexec.exe Token: SeSecurityPrivilege 1360 msiexec.exe Token: SeCreateTokenPrivilege 1208 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1208 msiexec.exe Token: SeLockMemoryPrivilege 1208 msiexec.exe Token: SeIncreaseQuotaPrivilege 1208 msiexec.exe Token: SeMachineAccountPrivilege 1208 msiexec.exe Token: SeTcbPrivilege 1208 msiexec.exe Token: SeSecurityPrivilege 1208 msiexec.exe Token: SeTakeOwnershipPrivilege 1208 msiexec.exe Token: SeLoadDriverPrivilege 1208 msiexec.exe Token: SeSystemProfilePrivilege 1208 msiexec.exe Token: SeSystemtimePrivilege 1208 msiexec.exe Token: SeProfSingleProcessPrivilege 1208 msiexec.exe Token: SeIncBasePriorityPrivilege 1208 msiexec.exe Token: SeCreatePagefilePrivilege 1208 msiexec.exe Token: SeCreatePermanentPrivilege 1208 msiexec.exe Token: SeBackupPrivilege 1208 msiexec.exe Token: SeRestorePrivilege 1208 msiexec.exe Token: SeShutdownPrivilege 1208 msiexec.exe Token: SeDebugPrivilege 1208 msiexec.exe Token: SeAuditPrivilege 1208 msiexec.exe Token: SeSystemEnvironmentPrivilege 1208 msiexec.exe Token: SeChangeNotifyPrivilege 1208 msiexec.exe Token: SeRemoteShutdownPrivilege 1208 msiexec.exe Token: SeUndockPrivilege 1208 msiexec.exe Token: SeSyncAgentPrivilege 1208 msiexec.exe Token: SeEnableDelegationPrivilege 1208 msiexec.exe Token: SeManageVolumePrivilege 1208 msiexec.exe Token: SeImpersonatePrivilege 1208 msiexec.exe Token: SeCreateGlobalPrivilege 1208 msiexec.exe Token: SeBackupPrivilege 1732 vssvc.exe Token: SeRestorePrivilege 1732 vssvc.exe Token: SeAuditPrivilege 1732 vssvc.exe Token: SeBackupPrivilege 1360 msiexec.exe Token: SeRestorePrivilege 1360 msiexec.exe Token: SeRestorePrivilege 1148 DrvInst.exe Token: SeRestorePrivilege 1148 DrvInst.exe Token: SeRestorePrivilege 1148 DrvInst.exe Token: SeRestorePrivilege 1148 DrvInst.exe Token: SeRestorePrivilege 1148 DrvInst.exe Token: SeRestorePrivilege 1148 DrvInst.exe Token: SeRestorePrivilege 1148 DrvInst.exe Token: SeLoadDriverPrivilege 1148 DrvInst.exe Token: SeLoadDriverPrivilege 1148 DrvInst.exe Token: SeLoadDriverPrivilege 1148 DrvInst.exe Token: SeRestorePrivilege 1360 msiexec.exe Token: SeTakeOwnershipPrivilege 1360 msiexec.exe Token: SeRestorePrivilege 1360 msiexec.exe Token: SeTakeOwnershipPrivilege 1360 msiexec.exe Token: SeRestorePrivilege 1360 msiexec.exe Token: SeTakeOwnershipPrivilege 1360 msiexec.exe Token: SeRestorePrivilege 1360 msiexec.exe Token: SeTakeOwnershipPrivilege 1360 msiexec.exe Token: SeRestorePrivilege 1360 msiexec.exe Token: SeTakeOwnershipPrivilege 1360 msiexec.exe Token: SeRestorePrivilege 1360 msiexec.exe Token: SeTakeOwnershipPrivilege 1360 msiexec.exe Token: SeRestorePrivilege 1360 msiexec.exe Token: SeTakeOwnershipPrivilege 1360 msiexec.exe Token: SeRestorePrivilege 1360 msiexec.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1208 msiexec.exe 1748 {DE740379-FA3B-4136-A089-A0E2074E6D31}.exe 1208 msiexec.exe 540 SurpassClient.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1360 wrote to memory of 2020 1360 msiexec.exe 32 PID 1360 wrote to memory of 2020 1360 msiexec.exe 32 PID 1360 wrote to memory of 2020 1360 msiexec.exe 32 PID 1360 wrote to memory of 2020 1360 msiexec.exe 32 PID 1360 wrote to memory of 2020 1360 msiexec.exe 32 PID 1360 wrote to memory of 2020 1360 msiexec.exe 32 PID 1360 wrote to memory of 2020 1360 msiexec.exe 32 PID 2020 wrote to memory of 1748 2020 MsiExec.exe 33 PID 2020 wrote to memory of 1748 2020 MsiExec.exe 33 PID 2020 wrote to memory of 1748 2020 MsiExec.exe 33 PID 2020 wrote to memory of 1748 2020 MsiExec.exe 33 PID 2020 wrote to memory of 1748 2020 MsiExec.exe 33 PID 2020 wrote to memory of 1748 2020 MsiExec.exe 33 PID 2020 wrote to memory of 1748 2020 MsiExec.exe 33 PID 1748 wrote to memory of 540 1748 {DE740379-FA3B-4136-A089-A0E2074E6D31}.exe 34 PID 1748 wrote to memory of 540 1748 {DE740379-FA3B-4136-A089-A0E2074E6D31}.exe 34 PID 1748 wrote to memory of 540 1748 {DE740379-FA3B-4136-A089-A0E2074E6D31}.exe 34 PID 1748 wrote to memory of 540 1748 {DE740379-FA3B-4136-A089-A0E2074E6D31}.exe 34 PID 1748 wrote to memory of 540 1748 {DE740379-FA3B-4136-A089-A0E2074E6D31}.exe 34 PID 1748 wrote to memory of 540 1748 {DE740379-FA3B-4136-A089-A0E2074E6D31}.exe 34 PID 1748 wrote to memory of 540 1748 {DE740379-FA3B-4136-A089-A0E2074E6D31}.exe 34
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\secureclientinstaller.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1208
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 53C7DD12E156DBFCA7C02724711549B72⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\{DE740379-FA3B-4136-A089-A0E2074E6D31}.exe"C:\Users\Admin\AppData\Local\Temp\{DE740379-FA3B-4136-A089-A0E2074E6D31}.exe" "/g=C:\Users\Admin\AppData\Local\Temp\" ALLUSERS=FALSE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops autorun.inf file
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\miaC3DC.tmp\SurpassClient.exe.\SurpassClient.exe "/g=C:\Users\Admin\AppData\Local\Temp\" ALLUSERS=FALSE /m="C:\Users\Admin\AppData\Local\Temp\{DE740~1.EXE" /k=""4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:540
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1732
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000578" "0000000000000060"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1148
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb19fc2702c6a90bf32fd1137593cc33
SHA1701d97904612382a278e3279da1e9b959ea3a057
SHA2569606a67570fa7c76d20328b8ba53e8ebcdb52436482d6ce1b810e28070b1ad9b
SHA51260437a8c0428f6876665bd07932e79e3417d45f31f6f324c818bf742dda9b729e40a90c671ca1c4a2b274ab0baf74d1008aaafba0d2ce64f5867f06af672a84c
-
Filesize
4.4MB
MD5819b99310c7ca28651c9a2185452843a
SHA12a1dbf6650ed587af8248e49c29e925cfc9e04af
SHA2567373930b0f4bf1e7ef0ac07bae1812d839f192fd27f3e2e3fc0a95387090221a
SHA5123a425ed92a4259ec3b035d2a5073202a94b3de56ccf233b2c36435bbbd06ec3704f7b053055f90b515467beeb3189c48f001048c70759472f0786e4a57aaa494
-
Filesize
4.4MB
MD5819b99310c7ca28651c9a2185452843a
SHA12a1dbf6650ed587af8248e49c29e925cfc9e04af
SHA2567373930b0f4bf1e7ef0ac07bae1812d839f192fd27f3e2e3fc0a95387090221a
SHA5123a425ed92a4259ec3b035d2a5073202a94b3de56ccf233b2c36435bbbd06ec3704f7b053055f90b515467beeb3189c48f001048c70759472f0786e4a57aaa494
-
Filesize
820KB
MD51c2ae57713db4671c331ab9e9dcfbe86
SHA1b45644ee12819146728a8671b65f867ecb99c9b7
SHA25691c8b5563d24e3c385114548a3fa5946877e1530550ff689ff581ef67b141dae
SHA512cd82566d64f792de861e8e6872e14964cc406615fb4af0eea68eb1679e749da1fbefff852d05909e2ea65cb20d05fc5fc36b0fb0202b1ceb43be7782cea24098
-
Filesize
9.4MB
MD5b99200d97df9cb051d978886ccf1b9fe
SHA18686e326ccf2ac5ddea41c617a130bb16e37393e
SHA2565dbce1bbd70bfdaf46c5563357dda9d854471b946bfa9ce9beec8a80d60cb0fe
SHA512cb9ecccf8544711bd114e99c802d920be4e6f8ff61ce35a9ac8f255919a0f671a68e871719c4f6b822d86d520feba55f7ec6fcef54fffd1da5f0b33cc96efbf9
-
Filesize
569KB
MD5b21a697f173642fb9635fe6f84c56d33
SHA1a8cb355623f088f8743cc0ee392539e09bef10c1
SHA2566f037e0c92f16c28c483d3ba040e18756d2d229db4c3394c7ba5a9ba033bf802
SHA5123c4c15f0a59561bcde5f4203e4adeda2c63aff31530de481cbcd5d4fb8711db9cb4427191fab988b1162393bf68827b59c84e0e8b93e70c6d2403f32d31fe0c3
-
Filesize
161.6MB
MD5102a15c650ab7934928cd2365afef538
SHA1309a3ad4983adf40558fcbc257ef280511abe5f9
SHA256da6032fdf29ecb28c12ff4f8eddb6137a890bae3cf2681f73fb28d2b64d4cdf1
SHA512a45c73b4d4824a5244514f9ba7893b41d86603548685e74a1ab822f3e95abb901fe7945e2da334159b807b4f42c97bf51f6577085fc985ecd089d37f0462c6d0
-
Filesize
161.6MB
MD5102a15c650ab7934928cd2365afef538
SHA1309a3ad4983adf40558fcbc257ef280511abe5f9
SHA256da6032fdf29ecb28c12ff4f8eddb6137a890bae3cf2681f73fb28d2b64d4cdf1
SHA512a45c73b4d4824a5244514f9ba7893b41d86603548685e74a1ab822f3e95abb901fe7945e2da334159b807b4f42c97bf51f6577085fc985ecd089d37f0462c6d0
-
Filesize
391KB
MD566ec5097c09cc3c2f95d4f6b40d5c1a9
SHA12b22f3be1d328bef52e0ff4feb47b84468cebce7
SHA256b205553fd808cd53410677b08e1ead0ba040e96e49d3c963f02949660bf9d3a3
SHA5121dd8d99a6472cf9b29d530cbf7c64345227913f5c149182b56d3d4ed13a7d970ee60b560d226a65a50fef0cefd1d6e04da2af822c4f4025c5b6b066730a3534e
-
Filesize
99KB
MD5d1623f75c7b651bfabab28cd7fcc3cc3
SHA1b20fc4814c464118c49255e4e8293240fb179be7
SHA256cafc99819785b403f3209a1fb554908f6d5d10786ce7316f0d93d0940d8921ff
SHA512ed76811630c8e12bcc862665a46c6c0a9320af4565392c23f273d7873758816e5312e4885d0aba585edbebf30c98c588c20429edd5200e02a1e73a1d95cda363
-
Filesize
397KB
MD5226acd3e8819b05531ab672b15d117e2
SHA13f6bc45686ff1b1e7e824078527e448018d7f69c
SHA256c89109cb5b50d60599b2253ffb03ba3db369a3b785afcce3412bf37b72d1a5a2
SHA51217782200e8ae3a51f8bf471c19c750735d730c195338ab2933214b9714b659c673d48851ce5da842595bda8e4e1d4166cf543580eb73acabc6608d7ab8f3aea4
-
Filesize
4.4MB
MD5819b99310c7ca28651c9a2185452843a
SHA12a1dbf6650ed587af8248e49c29e925cfc9e04af
SHA2567373930b0f4bf1e7ef0ac07bae1812d839f192fd27f3e2e3fc0a95387090221a
SHA5123a425ed92a4259ec3b035d2a5073202a94b3de56ccf233b2c36435bbbd06ec3704f7b053055f90b515467beeb3189c48f001048c70759472f0786e4a57aaa494
-
Filesize
569KB
MD5b21a697f173642fb9635fe6f84c56d33
SHA1a8cb355623f088f8743cc0ee392539e09bef10c1
SHA2566f037e0c92f16c28c483d3ba040e18756d2d229db4c3394c7ba5a9ba033bf802
SHA5123c4c15f0a59561bcde5f4203e4adeda2c63aff31530de481cbcd5d4fb8711db9cb4427191fab988b1162393bf68827b59c84e0e8b93e70c6d2403f32d31fe0c3
-
Filesize
161.6MB
MD5102a15c650ab7934928cd2365afef538
SHA1309a3ad4983adf40558fcbc257ef280511abe5f9
SHA256da6032fdf29ecb28c12ff4f8eddb6137a890bae3cf2681f73fb28d2b64d4cdf1
SHA512a45c73b4d4824a5244514f9ba7893b41d86603548685e74a1ab822f3e95abb901fe7945e2da334159b807b4f42c97bf51f6577085fc985ecd089d37f0462c6d0
-
Filesize
391KB
MD566ec5097c09cc3c2f95d4f6b40d5c1a9
SHA12b22f3be1d328bef52e0ff4feb47b84468cebce7
SHA256b205553fd808cd53410677b08e1ead0ba040e96e49d3c963f02949660bf9d3a3
SHA5121dd8d99a6472cf9b29d530cbf7c64345227913f5c149182b56d3d4ed13a7d970ee60b560d226a65a50fef0cefd1d6e04da2af822c4f4025c5b6b066730a3534e