Analysis
-
max time kernel
156s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30/04/2023, 21:01
Behavioral task
behavioral1
Sample
GOG_Galaxy_2.0.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
GOG_Galaxy_2.0.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
out.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
out.exe
Resource
win10v2004-20230220-en
General
-
Target
GOG_Galaxy_2.0.exe
-
Size
960KB
-
MD5
2900d9fb03f39b76fbe897f9780add5c
-
SHA1
3a1390d2e5398d6db00aaa08b969c2e1bd7f3fb8
-
SHA256
3a19fd486163e03d64d375cc71897e833b9f86a2f3935c8578c277eb6227a49a
-
SHA512
ee1bb00488ec4de1d2ecb03f5c933ffae79f03a018c20517cee380320607243e72d0197fcdf6cbcd945897bcae5165e94505674838b5ba0f7e143b83f9144746
-
SSDEEP
12288:T27p5j8DPeuUSFHqLV+JjY4UW61O4RAxDleFbWQCQTFgSYyAzB+Q/uLnK3:T27EDFHqLy826My+QiyGJyAV+muLK3
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 9 IoCs
pid Process 736 GalaxyInstaller.exe 824 GalaxySetup.exe 1416 GalaxySetup.tmp 748 VC_redist.x86.exe 1068 VC_redist.x86.exe 1052 VC_redist.x64.exe 1096 DllHost.exe 268 GalaxyClient.exe 2824 GalaxyClientService.exe -
Loads dropped DLL 58 IoCs
pid Process 1740 GOG_Galaxy_2.0.exe 1740 GOG_Galaxy_2.0.exe 1740 GOG_Galaxy_2.0.exe 1740 GOG_Galaxy_2.0.exe 824 GalaxySetup.exe 1416 GalaxySetup.tmp 1416 GalaxySetup.tmp 748 VC_redist.x86.exe 1068 VC_redist.x86.exe 1416 GalaxySetup.tmp 1052 VC_redist.x64.exe 1096 DllHost.exe 1416 GalaxySetup.tmp 1416 GalaxySetup.tmp 1416 GalaxySetup.tmp 1416 GalaxySetup.tmp 268 GalaxyClient.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 2824 GalaxyClientService.exe 2824 GalaxyClientService.exe 2824 GalaxyClientService.exe 2824 GalaxyClientService.exe 2824 GalaxyClientService.exe 2824 GalaxyClientService.exe 2824 GalaxyClientService.exe 2824 GalaxyClientService.exe 2824 GalaxyClientService.exe 2824 GalaxyClientService.exe 2824 GalaxyClientService.exe 2824 GalaxyClientService.exe 2824 GalaxyClientService.exe 2824 GalaxyClientService.exe 268 GalaxyClient.exe 268 GalaxyClient.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe 2324 WerFault.exe -
resource yara_rule behavioral1/memory/1740-54-0x0000000000400000-0x0000000000641000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\GalaxyClient GalaxySetup.tmp Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GalaxyClient.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\GogGalaxy = "C:\\Program Files (x86)\\GOG Galaxy\\GalaxyClient.exe /launchViaAutoStart" GalaxyClient.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GalaxySetup.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GalaxyClient.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\GOG Galaxy\web\images\cp2077\is-QRRLE.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\images\cp2077\is-QOD20.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\images\gogGalaxyLogo\is-C1PPC.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\src\images\is-MJDJM.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\attr\is-GO68R.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\is-N9EIF.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\galaxy\is-AUKOD.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\angularLocales\is-0UP1T.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\galaxy\unittest\is-JD7FQ.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\chardet\is-2EN0F.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\locales\is-KU8G4.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\images\gameImgPlaceholders\is-05OUH.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\is-P1OGQ.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\attr\is-82HHV.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\python\is-5OSL6.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\multidict\is-S26KB.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\chardet\is-IAR4C.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\is-GMDOT.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\locales\is-DL5EV.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\is-LN9IH.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\chardet\is-CBTV4.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\galaxy\api\is-00T48.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\Icons\is-UP5O1.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\Icons\is-UMQHP.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\images\discover\welcomeOfferCovers\is-NRGGS.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\locales\ko-KR\is-507KJ.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\src\images\is-2GQDF.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\chardet\is-6H6KM.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\licences\LatoWeb Font\is-N4Q5J.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\images\gameImgPlaceholders\is-NAHKJ.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\is-L91OU.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\.hash\is-NTFCT.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\is-BQI1B.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\is-E0IJ1.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\is-3BSRM.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\images\gameImgPlaceholders\is-P19NF.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\images\gameImgPlaceholders\is-C819P.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\is-3QJ50.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\yarl\is-KSSM9.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\locales\is-EIOCL.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\python\is-6FHG3.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\dateutil\zoneinfo\is-VU3SF.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\locales\pl-PL\is-893LT.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\locales\fr-FR\is-CJ336.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\multidict\is-E5TJN.tmp GalaxySetup.tmp File opened for modification C:\Program Files (x86)\GOG Galaxy\python\libssl-1_1.dll GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\python\is-H9R87.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\is-O7HDI.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\is-6QTSE.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\is-VLA2I.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\imageformats\is-14PFQ.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\imageformats\is-HHI0E.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\swiftshader\is-EU80L.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\images\cp2077\is-9UNK7.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\.hash\is-BP7SN.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\aiohttp\is-S6TPS.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\.hash\is-13EQM.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\styles\is-969P5.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\images\cp2077\is-IFKLP.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\web\images\cp2077\is-H071A.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\chardet\is-CHRKS.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\aiohttp\.hash\is-08J77.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginEpic\idna\is-913PL.tmp GalaxySetup.tmp File created C:\Program Files (x86)\GOG Galaxy\plugins\GalaxyPluginXbox\dateutil\is-N51S2.tmp GalaxySetup.tmp -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Fonts\is-9GGV3.tmp GalaxySetup.tmp File created C:\Windows\Fonts\is-CVUIE.tmp GalaxySetup.tmp File created C:\Windows\Fonts\is-5PDND.tmp GalaxySetup.tmp File created C:\Windows\Fonts\is-07S2A.tmp GalaxySetup.tmp File created C:\Windows\Fonts\is-NHV0A.tmp GalaxySetup.tmp File created C:\Windows\Fonts\is-PRKHG.tmp GalaxySetup.tmp File created C:\Windows\Fonts\is-03AFM.tmp GalaxySetup.tmp File created C:\Windows\Fonts\is-REJFS.tmp GalaxySetup.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2324 268 WerFault.exe 41 -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GalaxyClient.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 GOG_Galaxy_2.0.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde GOG_Galaxy_2.0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 GalaxyClient.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GalaxyClient.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GalaxyClient.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1524 vlc.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1416 GalaxySetup.tmp 1416 GalaxySetup.tmp 268 GalaxyClient.exe 268 GalaxyClient.exe 2824 GalaxyClientService.exe 2824 GalaxyClientService.exe 2824 GalaxyClientService.exe 2824 GalaxyClientService.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1524 vlc.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 736 GalaxyInstaller.exe Token: SeTakeOwnershipPrivilege 268 GalaxyClient.exe Token: SeRestorePrivilege 268 GalaxyClient.exe Token: SeTakeOwnershipPrivilege 268 GalaxyClient.exe Token: SeRestorePrivilege 268 GalaxyClient.exe Token: SeTakeOwnershipPrivilege 2824 GalaxyClientService.exe Token: SeRestorePrivilege 2824 GalaxyClientService.exe Token: SeTakeOwnershipPrivilege 2824 GalaxyClientService.exe Token: SeRestorePrivilege 2824 GalaxyClientService.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1416 GalaxySetup.tmp 1524 vlc.exe 1524 vlc.exe 1524 vlc.exe 1524 vlc.exe 1524 vlc.exe 1524 vlc.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 1524 vlc.exe 1524 vlc.exe 1524 vlc.exe 1524 vlc.exe 1524 vlc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1524 vlc.exe 268 GalaxyClient.exe 2824 GalaxyClientService.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 1740 wrote to memory of 736 1740 GOG_Galaxy_2.0.exe 30 PID 1740 wrote to memory of 736 1740 GOG_Galaxy_2.0.exe 30 PID 1740 wrote to memory of 736 1740 GOG_Galaxy_2.0.exe 30 PID 1740 wrote to memory of 736 1740 GOG_Galaxy_2.0.exe 30 PID 736 wrote to memory of 824 736 GalaxyInstaller.exe 31 PID 736 wrote to memory of 824 736 GalaxyInstaller.exe 31 PID 736 wrote to memory of 824 736 GalaxyInstaller.exe 31 PID 736 wrote to memory of 824 736 GalaxyInstaller.exe 31 PID 736 wrote to memory of 824 736 GalaxyInstaller.exe 31 PID 736 wrote to memory of 824 736 GalaxyInstaller.exe 31 PID 736 wrote to memory of 824 736 GalaxyInstaller.exe 31 PID 824 wrote to memory of 1416 824 GalaxySetup.exe 32 PID 824 wrote to memory of 1416 824 GalaxySetup.exe 32 PID 824 wrote to memory of 1416 824 GalaxySetup.exe 32 PID 824 wrote to memory of 1416 824 GalaxySetup.exe 32 PID 824 wrote to memory of 1416 824 GalaxySetup.exe 32 PID 824 wrote to memory of 1416 824 GalaxySetup.exe 32 PID 824 wrote to memory of 1416 824 GalaxySetup.exe 32 PID 1416 wrote to memory of 748 1416 GalaxySetup.tmp 36 PID 1416 wrote to memory of 748 1416 GalaxySetup.tmp 36 PID 1416 wrote to memory of 748 1416 GalaxySetup.tmp 36 PID 1416 wrote to memory of 748 1416 GalaxySetup.tmp 36 PID 1416 wrote to memory of 748 1416 GalaxySetup.tmp 36 PID 1416 wrote to memory of 748 1416 GalaxySetup.tmp 36 PID 1416 wrote to memory of 748 1416 GalaxySetup.tmp 36 PID 748 wrote to memory of 1068 748 VC_redist.x86.exe 37 PID 748 wrote to memory of 1068 748 VC_redist.x86.exe 37 PID 748 wrote to memory of 1068 748 VC_redist.x86.exe 37 PID 748 wrote to memory of 1068 748 VC_redist.x86.exe 37 PID 748 wrote to memory of 1068 748 VC_redist.x86.exe 37 PID 748 wrote to memory of 1068 748 VC_redist.x86.exe 37 PID 748 wrote to memory of 1068 748 VC_redist.x86.exe 37 PID 1416 wrote to memory of 1052 1416 GalaxySetup.tmp 38 PID 1416 wrote to memory of 1052 1416 GalaxySetup.tmp 38 PID 1416 wrote to memory of 1052 1416 GalaxySetup.tmp 38 PID 1416 wrote to memory of 1052 1416 GalaxySetup.tmp 38 PID 1416 wrote to memory of 1052 1416 GalaxySetup.tmp 38 PID 1416 wrote to memory of 1052 1416 GalaxySetup.tmp 38 PID 1416 wrote to memory of 1052 1416 GalaxySetup.tmp 38 PID 1052 wrote to memory of 1096 1052 VC_redist.x64.exe 40 PID 1052 wrote to memory of 1096 1052 VC_redist.x64.exe 40 PID 1052 wrote to memory of 1096 1052 VC_redist.x64.exe 40 PID 1052 wrote to memory of 1096 1052 VC_redist.x64.exe 40 PID 1052 wrote to memory of 1096 1052 VC_redist.x64.exe 40 PID 1052 wrote to memory of 1096 1052 VC_redist.x64.exe 40 PID 1052 wrote to memory of 1096 1052 VC_redist.x64.exe 40 PID 1416 wrote to memory of 268 1416 GalaxySetup.tmp 41 PID 1416 wrote to memory of 268 1416 GalaxySetup.tmp 41 PID 1416 wrote to memory of 268 1416 GalaxySetup.tmp 41 PID 1416 wrote to memory of 268 1416 GalaxySetup.tmp 41 PID 268 wrote to memory of 2324 268 GalaxyClient.exe 43 PID 268 wrote to memory of 2324 268 GalaxyClient.exe 43 PID 268 wrote to memory of 2324 268 GalaxyClient.exe 43 PID 268 wrote to memory of 2324 268 GalaxyClient.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\GOG_Galaxy_2.0.exe"C:\Users\Admin\AppData\Local\Temp\GOG_Galaxy_2.0.exe"1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_VQXNW\GalaxyInstaller.exe"C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_VQXNW\GalaxyInstaller.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_VQXNW\GalaxySetup.exe"C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_VQXNW\GalaxySetup.exe" /lang=en_US /campaign="eyJjYW1wYWlnbiI6eyJvcmlnaW4iOiJodHRwOi8vZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QvZW4vP2VtYmVkZGFibGU9dHJ1ZSIsIm9yaWdpbl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMS4wLjAuMCBTYWZhcmkvNTM3LjM2IE9QUi85Ny4wLjAuMCIsInVuaXF1ZV9pZCI6IjE2ODI4ODgwOTctODNlRGdJbC9KZW1oeW1QZ1l4SDBEQT09In0sImxvZ2luX3BhcmFtZXRlcnMiOiJvcmlnaW49aHR0cCUzQSUyRiUyRmdhbGF4eTItc2lnbnVwLmdvZy5wcm9kJTJGZW4lMkYlM0ZlbWJlZGRhYmxlJTNEdHJ1ZSZvcmlnaW5fdXNlcl9hZ2VudD1Nb3ppbGxhJTJGNS4wKyUyOFdpbmRvd3MrTlQrMTAuMCUzQitXaW42NCUzQit4NjQlMjkrQXBwbGVXZWJLaXQlMkY1MzcuMzYrJTI4S0hUTUwlMkMrbGlrZStHZWNrbyUyOStDaHJvbWUlMkYxMTEuMC4wLjArU2FmYXJpJTJGNTM3LjM2K09QUiUyRjk3LjAuMC4wJnVuaXF1ZV9pZD0xNjgyODg4MDk3LTgzZURnSWwlMkZKZW1oeW1QZ1l4SDBEQSUzRCUzRCJ9"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\is-V8DIT.tmp\GalaxySetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-V8DIT.tmp\GalaxySetup.tmp" /SL5="$1016C,272048901,1268224,C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_VQXNW\GalaxySetup.exe" /lang=en_US /campaign="eyJjYW1wYWlnbiI6eyJvcmlnaW4iOiJodHRwOi8vZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QvZW4vP2VtYmVkZGFibGU9dHJ1ZSIsIm9yaWdpbl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMS4wLjAuMCBTYWZhcmkvNTM3LjM2IE9QUi85Ny4wLjAuMCIsInVuaXF1ZV9pZCI6IjE2ODI4ODgwOTctODNlRGdJbC9KZW1oeW1QZ1l4SDBEQT09In0sImxvZ2luX3BhcmFtZXRlcnMiOiJvcmlnaW49aHR0cCUzQSUyRiUyRmdhbGF4eTItc2lnbnVwLmdvZy5wcm9kJTJGZW4lMkYlM0ZlbWJlZGRhYmxlJTNEdHJ1ZSZvcmlnaW5fdXNlcl9hZ2VudD1Nb3ppbGxhJTJGNS4wKyUyOFdpbmRvd3MrTlQrMTAuMCUzQitXaW42NCUzQit4NjQlMjkrQXBwbGVXZWJLaXQlMkY1MzcuMzYrJTI4S0hUTUwlMkMrbGlrZStHZWNrbyUyOStDaHJvbWUlMkYxMTEuMC4wLjArU2FmYXJpJTJGNTM3LjM2K09QUiUyRjk3LjAuMC4wJnVuaXF1ZV9pZD0xNjgyODg4MDk3LTgzZURnSWwlMkZKZW1oeW1QZ1l4SDBEQSUzRCUzRCJ9"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\is-8BF6K.tmp\VC_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\is-8BF6K.tmp\VC_redist.x86.exe" /install /quiet /norestart5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\Temp\{36796B17-F1A6-4C9B-88BC-471F1782FE8C}\.cr\VC_redist.x86.exe"C:\Windows\Temp\{36796B17-F1A6-4C9B-88BC-471F1782FE8C}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-8BF6K.tmp\VC_redist.x86.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /install /quiet /norestart6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-8BF6K.tmp\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\is-8BF6K.tmp\VC_redist.x64.exe" /install /quiet /norestart5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\Temp\{9667C29B-97F6-4202-89E5-2BD1D2048E19}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{9667C29B-97F6-4202-89E5-2BD1D2048E19}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-8BF6K.tmp\VC_redist.x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188 /install /quiet /norestart6⤵PID:1096
-
-
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe"C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /firstRun /installationSource=usedefault /payload=eyJjYW1wYWlnbiI6eyJvcmlnaW4iOiJodHRwOi8vZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QvZW4vP2VtYmVkZGFibGU9dHJ1ZSIsIm9yaWdpbl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMS4wLjAuMCBTYWZhcmkvNTM3LjM2IE9QUi85Ny4wLjAuMCIsInVuaXF1ZV9pZCI6IjE2ODI4ODgwOTctODNlRGdJbC9KZW1oeW1QZ1l4SDBEQT09In0sImxvZ2luX3BhcmFtZXRlcnMiOiJvcmlnaW49aHR0cCUzQSUyRiUyRmdhbGF4eTItc2lnbnVwLmdvZy5wcm9kJTJGZW4lMkYlM0ZlbWJlZGRhYmxlJTNEdHJ1ZSZvcmlnaW5fdXNlcl9hZ2VudD1Nb3ppbGxhJTJGNS4wKyUyOFdpbmRvd3MrTlQrMTAuMCUzQitXaW42NCUzQit4NjQlMjkrQXBwbGVXZWJLaXQlMkY1MzcuMzYrJTI4S0hUTUwlMkMrbGlrZStHZWNrbyUyOStDaHJvbWUlMkYxMTEuMC4wLjArU2FmYXJpJTJGNTM3LjM2K09QUiUyRjk3LjAuMC4wJnVuaXF1ZV9pZD0xNjgyODg4MDk3LTgzZURnSWwlMkZKZW1oeW1QZ1l4SDBEQSUzRCUzRCJ95⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 268 -s 5846⤵
- Loads dropped DLL
- Program crash
PID:2324
-
-
-
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RemoveUnlock.TTS"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1524
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RemoveUnlock.TTS"1⤵PID:1736
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2824
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.2MB
MD544f107864b3a967bb1b3e9da47ad8e90
SHA18331f0a5dda5f8cc489653ad8672f731e35fedb7
SHA2567cfa689f13c1b123069047affc9e89b0bf21d51ee0dfdafde18565cb73efde94
SHA5125e3373bc546b41ecf58f42308a1d05c47dcde36e964d679145670fe3477630bddd98b862e3a0c09a9c29b4fa350eb408732028fd4a06163b026a70eaf22db1cd
-
Filesize
13.2MB
MD544f107864b3a967bb1b3e9da47ad8e90
SHA18331f0a5dda5f8cc489653ad8672f731e35fedb7
SHA2567cfa689f13c1b123069047affc9e89b0bf21d51ee0dfdafde18565cb73efde94
SHA5125e3373bc546b41ecf58f42308a1d05c47dcde36e964d679145670fe3477630bddd98b862e3a0c09a9c29b4fa350eb408732028fd4a06163b026a70eaf22db1cd
-
Filesize
1.7MB
MD57818a804fa9fd0f9a09263b6b35325fc
SHA1590971157aa72d48f7939556a7554bc9d8975cd5
SHA256f2fd84a60790d043b531ec8eef9ad2cc961270e5f34096db1331388f1fa80416
SHA51263a9821c2a23f2f91ef1893e69a902065596e138850b825df8fb54ceed5ff551cde623049521a78821dce48720a8ae2ed53a8927ae0f404a905a24243fece561
-
Filesize
372KB
MD5dd7065f6e3bd80c6e7e6419e2475c8a8
SHA1f01ce83abf97c075fdad042cf6e3f994110ceb78
SHA2560c1b8043c56a29366da4e7065060201b9f82beba9d1c3c6c393f1a04dc2b136c
SHA51200656505b68db7bad3a78e283517fb1b2a21217245317334eb6457466564e04ef85a454adbbc97927430da6a6654a66bfaa756808e22dc394413b7bdf434a6c5
-
Filesize
1.7MB
MD53e72226a19d731e0d0baa1e9a2017dd7
SHA1d1ea639b8a0532f9ce092861016f79d672dcef25
SHA25697190cd46762d1947922ff330a406a2bc74c5bcd8e29b937be6ebddbfa3a43c8
SHA512eedc3c54196c37c08d9c9651b378db8f431c76fce206801ae1f29f0fac8a3b37a076d8610070ff5ac1b90866517b09beaa447018155b53350d8fdabdca44f541
-
Filesize
338KB
MD5c645048dcbff4fd35d51a254c18dc131
SHA1a3c9b97073d69318979a4d1bb66f02edc7ccdd88
SHA256ea3fb61653067989f3c95126cb6b470057f3f281fda7152f0940af8677e87a53
SHA512421f45e6f501aeca01ecfe876d0406404eacc13f4bdc8931e9ef46cf6487e3593394042c29169a6af0a8961f95aaa1ff06576da7b495e6fa039568d24723e6ca
-
Filesize
1.3MB
MD58fbf4845c06da70e17e40376244b97ba
SHA1488bb2cfc96dbe103425b9657ddfd646aae4388c
SHA256fef566ecb133f2d13d18980b8ad667ed202957be7d8716721e9da83f5bb1e04b
SHA512c1eafd234fe4b5aad87759931edd9c0f8bd902f35b78bbec699b5a5d882011ad7c0a780b781518f4d98c7c880115e1aa57795d5fe138001a7184114d6880c5c1
-
Filesize
526KB
MD59cb7c18b68e61c0eac049a3d7d0b970c
SHA183f17545fc35c2e1a0b627236309d8c0933a67d3
SHA2560d0a7c34d2b972fad2a1ec4df2ef604b55742b5e43f42d254851ad6bb5ffe609
SHA5129bc86e1199540e5299e61d7b873d70d3668f1e281b9dff2fba555d45cab99e23263d49ce50a4d217e0dcf3e3090a5af0e9dd64b32aec14b5ef6edaaec6e29aa4
-
Filesize
539KB
MD5ed29d945a6e4ab83974d783e5a910d20
SHA14a008b7dcd527fd2ad6b0e4211f431a983104605
SHA256c12cc8c1f3202c19729538fd3b38b7627cdc122bdad7efdfd37bfac236d7839e
SHA5128d6eb5ed8ac4b1f95f2f10d0241e130a60540a10b48bb7bb5ced23c6847d333e7818145cfeb93073b2370c216f627f0d7d0a0844e036e9b726a56a4a06409f2f
-
Filesize
5.1MB
MD5ecd2fed8765416bf429f32f14cc5c747
SHA100f09763508c58be76a0ef0b348358a0802d4745
SHA256e9087632fe379f46fc8d6b4f9dfe6b167640c914873ef033d4bfe9138614d7e8
SHA51277d38303cb59cdcf68cc779d2c40fad0a327d0258802749aeb5b5b25647bc6c687e5b5a10ce8448dc7c6083267a3a86da747540b2eb15e03fd169478851a2057
-
Filesize
5.6MB
MD568c19f9f45a98734a6e42745a75ff2d3
SHA11f39560b10ab2bf6f3fab76a3be5f305b169fcaa
SHA2561233ea25703cc1830f658f379bc3e2e4486ea08b9beb356b5d0e4e0a1d4a3329
SHA512df7e50d8b17f415c9e2ae33851294370a72ab2368b4cf0cc6c5883740ddd7daa02ecd918440c21c5421bc149c0d611220aab4e51f3fd674b9adf167a79f95e41
-
Filesize
1.0MB
MD59dcd0f88d822d9e8f5d72dc15f53fb71
SHA15e06d4ec06f720a06320bf660fe5f34a460af200
SHA25699dd9ff6dda27004de1b43e01cf9d5e415c45fd9bfc05e6293ba87a8109e86c5
SHA512cc39d393ff5f31827bb92a2c30736575b8464f9ccdc14493785d77bcc7cea8125ee9124b09465619cd9dc73e971a3f480c5ed4f64adf62133c3b86032d328b5a
-
Filesize
90.3MB
MD5f380b5b90187ad35f34d3ca0c3051948
SHA12bd45db66c4b64b3fda98d841598274c4ac21f29
SHA256fe0b72b8372d60da2d7ed73451d59720d49a54ee71274a8a9e678b4e9c1fbbc0
SHA512c92a7bdfd76ceb2ee8088b2d4f3ce738b43448a96a97360b520594620ee6014c7a8643780b0ab0c9da8f6587508311e508690b7523136c133580bc7d2b73d85a
-
Filesize
173KB
MD5657d32eec34d3225b38262a5878e9474
SHA122daaca36c1d49bdb8b2851f40596d4cd025dcb0
SHA256ec4f39fe48a83d113191402d33420728f571df81b46e41e5c37a46845b4d2f62
SHA512d4889aff3da2fe9d9cbe175b18793af7e82f0fd6e1fb72ec8aeaf0c8e0872f008beb54a2d44f6fd7f389d0ee104c93ecd1998ddbf4f1d0c7be38e802f5c96895
-
Filesize
576KB
MD56ff65827e6191c4aebe6d611341ae02e
SHA141ecaa87dcc727340e6358251a08d3bab240b58e
SHA256a149b0e6087f27928cd44ecaf6702399745ceda59001f3918d08f4baacaa7544
SHA51285d34e0562a72c783ec2ddf2ded5c12ada293032451e4a73b530fffddaca73bbc921d5442b2b18780ae66e41d2c2441a775bbd9b14ddefba2a89984ec282df33
-
Filesize
987KB
MD5562e8efa4422fdab66fd48ae64dfc7a5
SHA122d7f566adfd42c6c18c5a2e2ccd5d5a3bd49706
SHA25673185706c9d2aa093c5e0511cee6ff5c52db25228924edb8f3edaf5af913d303
SHA512b513c177f8dc6edd26391af045bbbd57fc31c3346cc78ae1083373247e08405416198682e773a33991b6f311cd4f65fd2656cb55c63668499494eb7454852f0a
-
Filesize
802KB
MD5570163e4b53390b17bf78af85e8af01d
SHA1e642d74d485c4a3ed3a339ff3f2497b06033ccf2
SHA256dd57aabccc4193e57140f7df1ef9e4e03ff06239a9061ba9760a9a799fa4ba9a
SHA5126ca6f066ca9ede06947a52b519ffa37570f31add071545ff07a3c19227642cbfc9441805ad9635e6a75be54adbc272283074c0fd347acd99a4924dcbb9d4cecc
-
Filesize
3.3MB
MD5ebda4a669acd86def15d9389e3c408ff
SHA188c7f3cdccb377397fa295efd5dbf5af3c5d1bdd
SHA256399092911144baf021d14ccd882ad8ab8d312e579b8e11fbac1dfb16e72c5740
SHA5129a406d7fb6827bd992baf4c1c26a84187dafa89dd1afce51f97953c5f4f29319021043f860ddd1d94346265fcec8663581112af9455b0da1dd3a75da6102105a
-
Filesize
27KB
MD5633860092d5763dbb1b4ed0837429ab0
SHA1adfa76664ec6be58629ca8d58c73ae80277cf076
SHA256272ca2a34d1a03ee9b22f78c8f101daa5aee84bf8851956380f7c31b04e7ffab
SHA51278312f12cf247190fb3f2ada10bc7c74ab0b2aacb73236431a29ead85ecafb7b1e0a66ef859c3492880624cc70d6c647e8b883a445c1591042dc3729b178fd2a
-
Filesize
1KB
MD5bf804964f529597485b5aa66f76656d8
SHA11625addc939cf41ad6677ed2330da32d656d3496
SHA2564b09dfb390e8e522d12861d0f5e22462658bdacaceaee67bc5132228f9e802d0
SHA5126c9009c448830cd678be6d6edc28ee5e936ce25ff100c93df66ad24a8f93fc21739ffe80e27d94f400736cf76ae7735ddb7568ffa68ae23a0f566396eb6c4413
-
Filesize
131KB
MD59cfacd6bb21d545f154a3ec82aaf9d93
SHA11bbee4abe68031b38256c0f4584adb6aed95ce7b
SHA25657f498d7770150c5516cccff38dabeb90f54647d8e73a2cd45044155d86ff953
SHA51271f7d498c4442a6f0956cc030e459c8e53d041ae4e4ab1fe6b4a56d141ae6cee95ef26c10722e11923b9c65a2f90efed94da925095c19b9ec911ca499d84856a
-
Filesize
104KB
MD52a92f0dc6dac8545718ee475b7b961ed
SHA1c154cdcf10e411f1622e29a7f019ae610f35ddf1
SHA2563c53b164dfaa56213b081c97d388082a3731f064b44bd5cbcf0876b075a3b890
SHA512190ef026570129f8a9f03e22866fc8b49597644a53d06bb9c1e0cf37edbf689df86de928fb9bf782797262b1fcf85c52e212156eae94af2cd1ae4b25b3298234
-
Filesize
37KB
MD5c1f15ad6155a74d5983e43f3015682c5
SHA143aae9a8776dec93c992a21c14a27c8af5b9e2f7
SHA256eabd436dbe6bc4de1416971dfb0060696e2f0aeb15d87c50496137a0e7140e13
SHA512cc032541a189b4dda78ecbd57d0375a43d86e45a8e0ee92a22878f3b5208e7e3a6527103bc2150143a9e82e1cf6c558d5f3f67070bd98d7318933b77fe95be89
-
Filesize
268B
MD50983ab2871e1f03d0d78954b0e78ded8
SHA1c15910cdc2a98840d4731cb477d497dfea23387c
SHA256375a77b239a3564ed9b2c2ebd3607d9faf3d4fddb0db517ba25942e57629f093
SHA51287a497a9f216fd7dddaa2ef7e0a9ed930ca5634811de5da124b4444b9aea9e755b434770cd6a1921b5f3b7e10fbafab0f442946122765b016f0a28e38e623f3a
-
Filesize
132KB
MD5de7b60f5a2dbd33ed7a6f8593f704c11
SHA17f04fa834a457f321ef1b645ab2076d2b9178a0f
SHA2567cf7bd09531fc5750e5e28686356df4fa9c42621cf647600fead70e5184973d3
SHA512534574b0e5047b4d4b7bb6d668eef622372dba5a0157eb441f166aed92daf9ce8a7334b607a756e35088b3593379566baad1f8e872946adfd84e233fdbe98d79
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
2KB
MD5b9458ee7df2e344cfb7ebca63abce667
SHA1f14b31b480a196c1b072455a61ef4bd316c0deb9
SHA256d78056318678cad58d996b46f016dc172e9fcc4eacee69ef4d5417cf115d98c7
SHA512af03bf595e635cb0b99cf2a23a96de8e343779d797e00054974ab6c3d49421386c16db65a84f63548d76329c52b49ea7a555d6c3627700e90115c7cb2644ec28
-
Filesize
2KB
MD5b9458ee7df2e344cfb7ebca63abce667
SHA1f14b31b480a196c1b072455a61ef4bd316c0deb9
SHA256d78056318678cad58d996b46f016dc172e9fcc4eacee69ef4d5417cf115d98c7
SHA512af03bf595e635cb0b99cf2a23a96de8e343779d797e00054974ab6c3d49421386c16db65a84f63548d76329c52b49ea7a555d6c3627700e90115c7cb2644ec28
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
566KB
MD526d02cc778b804689bda1aafa9a76fb1
SHA15452c96593478f59471730366c682da19881051d
SHA25661eadf4a0bb3710671f5b6f1db10c522a2d0a07177d3b79eb844d7f69d8f8635
SHA512047ecfb6df19e39579dd2a7359fec312f4dcf2293e9e4f232a22acd37a3c22707ecbf53d6ed0fe44989b8a52502fd43f525e20b85b83f29223205ade6a7aee90
-
Filesize
263.1MB
MD5b60970dfb43bbee8f7dd8f785b06e513
SHA1ff3f3ef0c44ffa4120b2f30023573c57dec4d71e
SHA256793227a3a9a7e30a80d7d2f623ffa0d68c63c9ea2fd0f0e8fbe1d9adbbbae0d6
SHA51298601a93b6df844a315c2d45429aef54640948ceafa75e3e19d46aa490aa4bac5fb07d3974840e929f256f25b86c9e751546a7ac4c11e09c36516d7f42a555af
-
Filesize
263.1MB
MD5b60970dfb43bbee8f7dd8f785b06e513
SHA1ff3f3ef0c44ffa4120b2f30023573c57dec4d71e
SHA256793227a3a9a7e30a80d7d2f623ffa0d68c63c9ea2fd0f0e8fbe1d9adbbbae0d6
SHA51298601a93b6df844a315c2d45429aef54640948ceafa75e3e19d46aa490aa4bac5fb07d3974840e929f256f25b86c9e751546a7ac4c11e09c36516d7f42a555af
-
Filesize
263.1MB
MD5b60970dfb43bbee8f7dd8f785b06e513
SHA1ff3f3ef0c44ffa4120b2f30023573c57dec4d71e
SHA256793227a3a9a7e30a80d7d2f623ffa0d68c63c9ea2fd0f0e8fbe1d9adbbbae0d6
SHA51298601a93b6df844a315c2d45429aef54640948ceafa75e3e19d46aa490aa4bac5fb07d3974840e929f256f25b86c9e751546a7ac4c11e09c36516d7f42a555af
-
Filesize
480KB
MD5391cf634b3ccf3971811be5ef016fe32
SHA18e3023466d02dfb8f2e1b48555b998532dc9a377
SHA256de9a2072df66c11af8cc255788c4c572f7b45ba7ab19524ad2e01a23f55e9ca8
SHA512c1594a33efcfac7c6e6935e76ed030855886453b6397ba53a63225efbeb513a1ccb39ea7d528cc43bb1e2b56fd0e02b306e0e65dc6896613c2b4ca6c4a165d9a
-
Filesize
585B
MD50069f49d053b0b56ef449c4cc8b861f9
SHA1fdbe0f50827c022017f17be3db3afd986228e266
SHA25672211501de8490d22aa4ec45710737ca980624fd31563b400b497534e3a36599
SHA5127b35f3ae4505e10fc554e063d3220493d657aea511bd632465db9d344e4ddffaaef0fe13c802c892fcf7e3df1281a11d6f369de9ba5787e84292de3ecd3208fb
-
Filesize
555B
MD577f0ebc2ec5ecd47916207bf510904e2
SHA1514dd58f5379932360f32dfa41d5706c0bf56076
SHA256c6a6618fa0bb69a977b8e5e6985fed76575e8671015f53f6bf3c21e2707917c1
SHA5120d3fedfc364961872e605dcab3865172636a4fa9b6b5e4897c11dc342cff108551589eb2f88f2653ac0e1d4306600642217ccb0b6ed0cbaa6d147d264aacadb5
-
Filesize
555B
MD577f0ebc2ec5ecd47916207bf510904e2
SHA1514dd58f5379932360f32dfa41d5706c0bf56076
SHA256c6a6618fa0bb69a977b8e5e6985fed76575e8671015f53f6bf3c21e2707917c1
SHA5120d3fedfc364961872e605dcab3865172636a4fa9b6b5e4897c11dc342cff108551589eb2f88f2653ac0e1d4306600642217ccb0b6ed0cbaa6d147d264aacadb5
-
Filesize
14.3MB
MD51e7bd6790391b5b710c6372ab2042351
SHA175f1aee6dccf3d6e6ac49926563737005b93ba13
SHA256952a0c6cb4a3dd14c3666ef05bb1982c5ff7f87b7103c2ba896354f00651e358
SHA512ae3860a060be483c9fcbcf6a41f561faf2cd681f39138dd13a563e3f39cf4b4f41e7c0f7b58bc8b585b2728245025be4b198f06634a97fa98847258272f9f59b
-
Filesize
14.3MB
MD51e7bd6790391b5b710c6372ab2042351
SHA175f1aee6dccf3d6e6ac49926563737005b93ba13
SHA256952a0c6cb4a3dd14c3666ef05bb1982c5ff7f87b7103c2ba896354f00651e358
SHA512ae3860a060be483c9fcbcf6a41f561faf2cd681f39138dd13a563e3f39cf4b4f41e7c0f7b58bc8b585b2728245025be4b198f06634a97fa98847258272f9f59b
-
Filesize
13.8MB
MD53aa2d769397da14166eacdb3640458ee
SHA1b38b7fc28c5e2ef157f93297036202911d2fc2bf
SHA256b4d433e2f66b30b478c0d080ccd5217ca2a963c16e90caf10b1e0592b7d8d519
SHA512404d2301c4719b8791639e8100eff6df7cd9c3ca62ad0a5c7ac8252f8adc2601aeefe83da982a409b9e3d901f74518ff98d2af5ebdd8cc77067be39c20eb1c56
-
Filesize
13.8MB
MD53aa2d769397da14166eacdb3640458ee
SHA1b38b7fc28c5e2ef157f93297036202911d2fc2bf
SHA256b4d433e2f66b30b478c0d080ccd5217ca2a963c16e90caf10b1e0592b7d8d519
SHA512404d2301c4719b8791639e8100eff6df7cd9c3ca62ad0a5c7ac8252f8adc2601aeefe83da982a409b9e3d901f74518ff98d2af5ebdd8cc77067be39c20eb1c56
-
Filesize
3.3MB
MD5ebda4a669acd86def15d9389e3c408ff
SHA188c7f3cdccb377397fa295efd5dbf5af3c5d1bdd
SHA256399092911144baf021d14ccd882ad8ab8d312e579b8e11fbac1dfb16e72c5740
SHA5129a406d7fb6827bd992baf4c1c26a84187dafa89dd1afce51f97953c5f4f29319021043f860ddd1d94346265fcec8663581112af9455b0da1dd3a75da6102105a
-
Filesize
3.3MB
MD5ebda4a669acd86def15d9389e3c408ff
SHA188c7f3cdccb377397fa295efd5dbf5af3c5d1bdd
SHA256399092911144baf021d14ccd882ad8ab8d312e579b8e11fbac1dfb16e72c5740
SHA5129a406d7fb6827bd992baf4c1c26a84187dafa89dd1afce51f97953c5f4f29319021043f860ddd1d94346265fcec8663581112af9455b0da1dd3a75da6102105a
-
Filesize
632KB
MD568f7654abfd77baade7a36e1d718ebc4
SHA1eabba5cb899aee962f85b52e359c9f85d83771b6
SHA2565b60b35079913ba1e00cddf762c1759650de8a3c2b76e373b996ced4843becdb
SHA512b48c4ba6112e7ac1dae5846eb41812d265a72fc13966c8f8bdf7099fec88d27b414fe566905a6eea4e2f574c379fe87059018c8a365bed55a46eea9a42b38889
-
Filesize
632KB
MD568f7654abfd77baade7a36e1d718ebc4
SHA1eabba5cb899aee962f85b52e359c9f85d83771b6
SHA2565b60b35079913ba1e00cddf762c1759650de8a3c2b76e373b996ced4843becdb
SHA512b48c4ba6112e7ac1dae5846eb41812d265a72fc13966c8f8bdf7099fec88d27b414fe566905a6eea4e2f574c379fe87059018c8a365bed55a46eea9a42b38889
-
Filesize
632KB
MD51d7599c4a31b82e70308c022e9494011
SHA17d04a03d5502df2838d40dd131b1cae226cb5205
SHA25621d2935d29c807a3a56c406849b97dbc7f720822920930d0e2b13a44203c107c
SHA512080ff020e0d2d9c0ce6beee8143c0f49e1b4450baa08072a8662f4b25ad6b034ee0ad174f2d4acd5b011cb8fb140656755007e245673f7677964b9e99555ab08
-
Filesize
632KB
MD51d7599c4a31b82e70308c022e9494011
SHA17d04a03d5502df2838d40dd131b1cae226cb5205
SHA25621d2935d29c807a3a56c406849b97dbc7f720822920930d0e2b13a44203c107c
SHA512080ff020e0d2d9c0ce6beee8143c0f49e1b4450baa08072a8662f4b25ad6b034ee0ad174f2d4acd5b011cb8fb140656755007e245673f7677964b9e99555ab08
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
13.2MB
MD544f107864b3a967bb1b3e9da47ad8e90
SHA18331f0a5dda5f8cc489653ad8672f731e35fedb7
SHA2567cfa689f13c1b123069047affc9e89b0bf21d51ee0dfdafde18565cb73efde94
SHA5125e3373bc546b41ecf58f42308a1d05c47dcde36e964d679145670fe3477630bddd98b862e3a0c09a9c29b4fa350eb408732028fd4a06163b026a70eaf22db1cd
-
Filesize
13.2MB
MD544f107864b3a967bb1b3e9da47ad8e90
SHA18331f0a5dda5f8cc489653ad8672f731e35fedb7
SHA2567cfa689f13c1b123069047affc9e89b0bf21d51ee0dfdafde18565cb73efde94
SHA5125e3373bc546b41ecf58f42308a1d05c47dcde36e964d679145670fe3477630bddd98b862e3a0c09a9c29b4fa350eb408732028fd4a06163b026a70eaf22db1cd
-
Filesize
13.2MB
MD544f107864b3a967bb1b3e9da47ad8e90
SHA18331f0a5dda5f8cc489653ad8672f731e35fedb7
SHA2567cfa689f13c1b123069047affc9e89b0bf21d51ee0dfdafde18565cb73efde94
SHA5125e3373bc546b41ecf58f42308a1d05c47dcde36e964d679145670fe3477630bddd98b862e3a0c09a9c29b4fa350eb408732028fd4a06163b026a70eaf22db1cd
-
Filesize
13.2MB
MD544f107864b3a967bb1b3e9da47ad8e90
SHA18331f0a5dda5f8cc489653ad8672f731e35fedb7
SHA2567cfa689f13c1b123069047affc9e89b0bf21d51ee0dfdafde18565cb73efde94
SHA5125e3373bc546b41ecf58f42308a1d05c47dcde36e964d679145670fe3477630bddd98b862e3a0c09a9c29b4fa350eb408732028fd4a06163b026a70eaf22db1cd
-
Filesize
1.7MB
MD57818a804fa9fd0f9a09263b6b35325fc
SHA1590971157aa72d48f7939556a7554bc9d8975cd5
SHA256f2fd84a60790d043b531ec8eef9ad2cc961270e5f34096db1331388f1fa80416
SHA51263a9821c2a23f2f91ef1893e69a902065596e138850b825df8fb54ceed5ff551cde623049521a78821dce48720a8ae2ed53a8927ae0f404a905a24243fece561
-
Filesize
372KB
MD5dd7065f6e3bd80c6e7e6419e2475c8a8
SHA1f01ce83abf97c075fdad042cf6e3f994110ceb78
SHA2560c1b8043c56a29366da4e7065060201b9f82beba9d1c3c6c393f1a04dc2b136c
SHA51200656505b68db7bad3a78e283517fb1b2a21217245317334eb6457466564e04ef85a454adbbc97927430da6a6654a66bfaa756808e22dc394413b7bdf434a6c5
-
Filesize
1.7MB
MD53e72226a19d731e0d0baa1e9a2017dd7
SHA1d1ea639b8a0532f9ce092861016f79d672dcef25
SHA25697190cd46762d1947922ff330a406a2bc74c5bcd8e29b937be6ebddbfa3a43c8
SHA512eedc3c54196c37c08d9c9651b378db8f431c76fce206801ae1f29f0fac8a3b37a076d8610070ff5ac1b90866517b09beaa447018155b53350d8fdabdca44f541
-
Filesize
338KB
MD5c645048dcbff4fd35d51a254c18dc131
SHA1a3c9b97073d69318979a4d1bb66f02edc7ccdd88
SHA256ea3fb61653067989f3c95126cb6b470057f3f281fda7152f0940af8677e87a53
SHA512421f45e6f501aeca01ecfe876d0406404eacc13f4bdc8931e9ef46cf6487e3593394042c29169a6af0a8961f95aaa1ff06576da7b495e6fa039568d24723e6ca
-
Filesize
1.3MB
MD58fbf4845c06da70e17e40376244b97ba
SHA1488bb2cfc96dbe103425b9657ddfd646aae4388c
SHA256fef566ecb133f2d13d18980b8ad667ed202957be7d8716721e9da83f5bb1e04b
SHA512c1eafd234fe4b5aad87759931edd9c0f8bd902f35b78bbec699b5a5d882011ad7c0a780b781518f4d98c7c880115e1aa57795d5fe138001a7184114d6880c5c1
-
Filesize
526KB
MD59cb7c18b68e61c0eac049a3d7d0b970c
SHA183f17545fc35c2e1a0b627236309d8c0933a67d3
SHA2560d0a7c34d2b972fad2a1ec4df2ef604b55742b5e43f42d254851ad6bb5ffe609
SHA5129bc86e1199540e5299e61d7b873d70d3668f1e281b9dff2fba555d45cab99e23263d49ce50a4d217e0dcf3e3090a5af0e9dd64b32aec14b5ef6edaaec6e29aa4
-
Filesize
539KB
MD5ed29d945a6e4ab83974d783e5a910d20
SHA14a008b7dcd527fd2ad6b0e4211f431a983104605
SHA256c12cc8c1f3202c19729538fd3b38b7627cdc122bdad7efdfd37bfac236d7839e
SHA5128d6eb5ed8ac4b1f95f2f10d0241e130a60540a10b48bb7bb5ced23c6847d333e7818145cfeb93073b2370c216f627f0d7d0a0844e036e9b726a56a4a06409f2f
-
Filesize
5.1MB
MD5ecd2fed8765416bf429f32f14cc5c747
SHA100f09763508c58be76a0ef0b348358a0802d4745
SHA256e9087632fe379f46fc8d6b4f9dfe6b167640c914873ef033d4bfe9138614d7e8
SHA51277d38303cb59cdcf68cc779d2c40fad0a327d0258802749aeb5b5b25647bc6c687e5b5a10ce8448dc7c6083267a3a86da747540b2eb15e03fd169478851a2057
-
Filesize
5.6MB
MD568c19f9f45a98734a6e42745a75ff2d3
SHA11f39560b10ab2bf6f3fab76a3be5f305b169fcaa
SHA2561233ea25703cc1830f658f379bc3e2e4486ea08b9beb356b5d0e4e0a1d4a3329
SHA512df7e50d8b17f415c9e2ae33851294370a72ab2368b4cf0cc6c5883740ddd7daa02ecd918440c21c5421bc149c0d611220aab4e51f3fd674b9adf167a79f95e41
-
Filesize
1.0MB
MD59dcd0f88d822d9e8f5d72dc15f53fb71
SHA15e06d4ec06f720a06320bf660fe5f34a460af200
SHA25699dd9ff6dda27004de1b43e01cf9d5e415c45fd9bfc05e6293ba87a8109e86c5
SHA512cc39d393ff5f31827bb92a2c30736575b8464f9ccdc14493785d77bcc7cea8125ee9124b09465619cd9dc73e971a3f480c5ed4f64adf62133c3b86032d328b5a
-
Filesize
173KB
MD5657d32eec34d3225b38262a5878e9474
SHA122daaca36c1d49bdb8b2851f40596d4cd025dcb0
SHA256ec4f39fe48a83d113191402d33420728f571df81b46e41e5c37a46845b4d2f62
SHA512d4889aff3da2fe9d9cbe175b18793af7e82f0fd6e1fb72ec8aeaf0c8e0872f008beb54a2d44f6fd7f389d0ee104c93ecd1998ddbf4f1d0c7be38e802f5c96895
-
Filesize
576KB
MD56ff65827e6191c4aebe6d611341ae02e
SHA141ecaa87dcc727340e6358251a08d3bab240b58e
SHA256a149b0e6087f27928cd44ecaf6702399745ceda59001f3918d08f4baacaa7544
SHA51285d34e0562a72c783ec2ddf2ded5c12ada293032451e4a73b530fffddaca73bbc921d5442b2b18780ae66e41d2c2441a775bbd9b14ddefba2a89984ec282df33
-
Filesize
802KB
MD5570163e4b53390b17bf78af85e8af01d
SHA1e642d74d485c4a3ed3a339ff3f2497b06033ccf2
SHA256dd57aabccc4193e57140f7df1ef9e4e03ff06239a9061ba9760a9a799fa4ba9a
SHA5126ca6f066ca9ede06947a52b519ffa37570f31add071545ff07a3c19227642cbfc9441805ad9635e6a75be54adbc272283074c0fd347acd99a4924dcbb9d4cecc
-
Filesize
131KB
MD59cfacd6bb21d545f154a3ec82aaf9d93
SHA11bbee4abe68031b38256c0f4584adb6aed95ce7b
SHA25657f498d7770150c5516cccff38dabeb90f54647d8e73a2cd45044155d86ff953
SHA51271f7d498c4442a6f0956cc030e459c8e53d041ae4e4ab1fe6b4a56d141ae6cee95ef26c10722e11923b9c65a2f90efed94da925095c19b9ec911ca499d84856a
-
Filesize
104KB
MD52a92f0dc6dac8545718ee475b7b961ed
SHA1c154cdcf10e411f1622e29a7f019ae610f35ddf1
SHA2563c53b164dfaa56213b081c97d388082a3731f064b44bd5cbcf0876b075a3b890
SHA512190ef026570129f8a9f03e22866fc8b49597644a53d06bb9c1e0cf37edbf689df86de928fb9bf782797262b1fcf85c52e212156eae94af2cd1ae4b25b3298234
-
Filesize
566KB
MD526d02cc778b804689bda1aafa9a76fb1
SHA15452c96593478f59471730366c682da19881051d
SHA25661eadf4a0bb3710671f5b6f1db10c522a2d0a07177d3b79eb844d7f69d8f8635
SHA512047ecfb6df19e39579dd2a7359fec312f4dcf2293e9e4f232a22acd37a3c22707ecbf53d6ed0fe44989b8a52502fd43f525e20b85b83f29223205ade6a7aee90
-
Filesize
566KB
MD526d02cc778b804689bda1aafa9a76fb1
SHA15452c96593478f59471730366c682da19881051d
SHA25661eadf4a0bb3710671f5b6f1db10c522a2d0a07177d3b79eb844d7f69d8f8635
SHA512047ecfb6df19e39579dd2a7359fec312f4dcf2293e9e4f232a22acd37a3c22707ecbf53d6ed0fe44989b8a52502fd43f525e20b85b83f29223205ade6a7aee90
-
Filesize
566KB
MD526d02cc778b804689bda1aafa9a76fb1
SHA15452c96593478f59471730366c682da19881051d
SHA25661eadf4a0bb3710671f5b6f1db10c522a2d0a07177d3b79eb844d7f69d8f8635
SHA512047ecfb6df19e39579dd2a7359fec312f4dcf2293e9e4f232a22acd37a3c22707ecbf53d6ed0fe44989b8a52502fd43f525e20b85b83f29223205ade6a7aee90
-
Filesize
566KB
MD526d02cc778b804689bda1aafa9a76fb1
SHA15452c96593478f59471730366c682da19881051d
SHA25661eadf4a0bb3710671f5b6f1db10c522a2d0a07177d3b79eb844d7f69d8f8635
SHA512047ecfb6df19e39579dd2a7359fec312f4dcf2293e9e4f232a22acd37a3c22707ecbf53d6ed0fe44989b8a52502fd43f525e20b85b83f29223205ade6a7aee90
-
Filesize
14.3MB
MD51e7bd6790391b5b710c6372ab2042351
SHA175f1aee6dccf3d6e6ac49926563737005b93ba13
SHA256952a0c6cb4a3dd14c3666ef05bb1982c5ff7f87b7103c2ba896354f00651e358
SHA512ae3860a060be483c9fcbcf6a41f561faf2cd681f39138dd13a563e3f39cf4b4f41e7c0f7b58bc8b585b2728245025be4b198f06634a97fa98847258272f9f59b
-
Filesize
13.8MB
MD53aa2d769397da14166eacdb3640458ee
SHA1b38b7fc28c5e2ef157f93297036202911d2fc2bf
SHA256b4d433e2f66b30b478c0d080ccd5217ca2a963c16e90caf10b1e0592b7d8d519
SHA512404d2301c4719b8791639e8100eff6df7cd9c3ca62ad0a5c7ac8252f8adc2601aeefe83da982a409b9e3d901f74518ff98d2af5ebdd8cc77067be39c20eb1c56
-
Filesize
28KB
MD5077cb4461a2767383b317eb0c50f5f13
SHA1584e64f1d162398b7f377ce55a6b5740379c4282
SHA2568287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
SHA512b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547
-
Filesize
3.3MB
MD5ebda4a669acd86def15d9389e3c408ff
SHA188c7f3cdccb377397fa295efd5dbf5af3c5d1bdd
SHA256399092911144baf021d14ccd882ad8ab8d312e579b8e11fbac1dfb16e72c5740
SHA5129a406d7fb6827bd992baf4c1c26a84187dafa89dd1afce51f97953c5f4f29319021043f860ddd1d94346265fcec8663581112af9455b0da1dd3a75da6102105a
-
Filesize
632KB
MD568f7654abfd77baade7a36e1d718ebc4
SHA1eabba5cb899aee962f85b52e359c9f85d83771b6
SHA2565b60b35079913ba1e00cddf762c1759650de8a3c2b76e373b996ced4843becdb
SHA512b48c4ba6112e7ac1dae5846eb41812d265a72fc13966c8f8bdf7099fec88d27b414fe566905a6eea4e2f574c379fe87059018c8a365bed55a46eea9a42b38889
-
Filesize
632KB
MD51d7599c4a31b82e70308c022e9494011
SHA17d04a03d5502df2838d40dd131b1cae226cb5205
SHA25621d2935d29c807a3a56c406849b97dbc7f720822920930d0e2b13a44203c107c
SHA512080ff020e0d2d9c0ce6beee8143c0f49e1b4450baa08072a8662f4b25ad6b034ee0ad174f2d4acd5b011cb8fb140656755007e245673f7677964b9e99555ab08
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2