Analysis
-
max time kernel
127s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
15/07/2024, 00:07
General
-
Target
GOG_Galaxy_2.0.exe
-
Size
960KB
-
MD5
073c6e12924e8ed40908ebd8f50269f6
-
SHA1
55531db348c074a2bea5a78ac79f0193e5281a35
-
SHA256
35d28d41f6ae7bee08889ae3f470af4f94eaf52fa55ab3c1661ae9419947d8c1
-
SHA512
c5dba4fe0f655f961a4198b6eeb96face546585a1b78210149a952bbbe9793fa8db9efefd522681200dd693c5e9fa81ddbdf0bcf0e525a82ad10fd72ba741686
-
SSDEEP
12288:T27p5j8DPeuUSFHqLV+JjY4UW61O4RAxDleFbWQCQTFgSYyAzB+Q/uLnK3:T27EDFHqLy826My+QiyGJyAV+muLK3
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 16 IoCs
-
Loads dropped DLL 64 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
-
Modifies system certificate store 2 TTPs 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 38 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GOG_Galaxy_2.0.exe"C:\Users\Admin\AppData\Local\Temp\GOG_Galaxy_2.0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xZcUX\GalaxyInstaller.exe"C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xZcUX\GalaxyInstaller.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xZcUX\GalaxySetup.exe"C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xZcUX\GalaxySetup.exe" /lang=en_US /campaign="eyJjYW1wYWlnbiI6eyJvcmlnaW4iOiJodHRwOi8vZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QvZW4vP2VtYmVkZGFibGU9dHJ1ZSIsIm9yaWdpbl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyNi4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidW5pcXVlX2lkIjoiMTcyMTAwMTYzMy1EdFFKUkhTSVFqUEc2QTNIYlhsMDVBPT0ifSwibG9naW5fcGFyYW1ldGVycyI6Im9yaWdpbj1odHRwJTNBJTJGJTJGZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QlMkZlbiUyRiUzRmVtYmVkZGFibGUlM0R0cnVlJm9yaWdpbl91c2VyX2FnZW50PU1vemlsbGElMkY1LjArJTI4V2luZG93cytOVCsxMC4wJTNCK1dpbjY0JTNCK3g2NCUyOStBcHBsZVdlYktpdCUyRjUzNy4zNislMjhLSFRNTCUyQytsaWtlK0dlY2tvJTI5K0Nocm9tZSUyRjEyNi4wLjAuMCtTYWZhcmklMkY1MzcuMzYmdW5pcXVlX2lkPTE3MjEwMDE2MzMtRHRRSlJIU0lRalBHNkEzSGJYbDA1QSUzRCUzRCJ9"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-3LCG4.tmp\GalaxySetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-3LCG4.tmp\GalaxySetup.tmp" /SL5="$80060,273144529,1268224,C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xZcUX\GalaxySetup.exe" /lang=en_US /campaign="eyJjYW1wYWlnbiI6eyJvcmlnaW4iOiJodHRwOi8vZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QvZW4vP2VtYmVkZGFibGU9dHJ1ZSIsIm9yaWdpbl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyNi4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidW5pcXVlX2lkIjoiMTcyMTAwMTYzMy1EdFFKUkhTSVFqUEc2QTNIYlhsMDVBPT0ifSwibG9naW5fcGFyYW1ldGVycyI6Im9yaWdpbj1odHRwJTNBJTJGJTJGZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QlMkZlbiUyRiUzRmVtYmVkZGFibGUlM0R0cnVlJm9yaWdpbl91c2VyX2FnZW50PU1vemlsbGElMkY1LjArJTI4V2luZG93cytOVCsxMC4wJTNCK1dpbjY0JTNCK3g2NCUyOStBcHBsZVdlYktpdCUyRjUzNy4zNislMjhLSFRNTCUyQytsaWtlK0dlY2tvJTI5K0Nocm9tZSUyRjEyNi4wLjAuMCtTYWZhcmklMkY1MzcuMzYmdW5pcXVlX2lkPTE3MjEwMDE2MzMtRHRRSlJIU0lRalBHNkEzSGJYbDA1QSUzRCUzRCJ9"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-OMUOO.tmp\VC_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\is-OMUOO.tmp\VC_redist.x86.exe" /install /quiet /norestart5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{ACBB58C6-23D1-4791-BBFF-37BA16B735E0}\.cr\VC_redist.x86.exe"C:\Windows\Temp\{ACBB58C6-23D1-4791-BBFF-37BA16B735E0}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-OMUOO.tmp\VC_redist.x86.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /install /quiet /norestart6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-OMUOO.tmp\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\is-OMUOO.tmp\VC_redist.x64.exe" /install /quiet /norestart5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{01FABDE2-65D9-4508-A278-E27E59F0D7D2}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{01FABDE2-65D9-4508-A278-E27E59F0D7D2}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-OMUOO.tmp\VC_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=648 /install /quiet /norestart6⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe"C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /firstRun /installationSource=usedefault /payload=eyJjYW1wYWlnbiI6eyJvcmlnaW4iOiJodHRwOi8vZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QvZW4vP2VtYmVkZGFibGU9dHJ1ZSIsIm9yaWdpbl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyNi4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidW5pcXVlX2lkIjoiMTcyMTAwMTYzMy1EdFFKUkhTSVFqUEc2QTNIYlhsMDVBPT0ifSwibG9naW5fcGFyYW1ldGVycyI6Im9yaWdpbj1odHRwJTNBJTJGJTJGZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QlMkZlbiUyRiUzRmVtYmVkZGFibGUlM0R0cnVlJm9yaWdpbl91c2VyX2FnZW50PU1vemlsbGElMkY1LjArJTI4V2luZG93cytOVCsxMC4wJTNCK1dpbjY0JTNCK3g2NCUyOStBcHBsZVdlYktpdCUyRjUzNy4zNislMjhLSFRNTCUyQytsaWtlK0dlY2tvJTI5K0Nocm9tZSUyRjEyNi4wLjAuMCtTYWZhcmklMkY1MzcuMzYmdW5pcXVlX2lkPTE3MjEwMDE2MzMtRHRRSlJIU0lRalBHNkEzSGJYbDA1QSUzRCUzRCJ95⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe"C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /clientLanguage=en-US5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe"C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /installerLaunch /payload=eyJjYW1wYWlnbiI6eyJvcmlnaW4iOiJodHRwOi8vZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QvZW4vP2VtYmVkZGFibGU9dHJ1ZSIsIm9yaWdpbl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyNi4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidW5pcXVlX2lkIjoiMTcyMTAwMTYzMy1EdFFKUkhTSVFqUEc2QTNIYlhsMDVBPT0ifSwibG9naW5fcGFyYW1ldGVycyI6Im9yaWdpbj1odHRwJTNBJTJGJTJGZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QlMkZlbiUyRiUzRmVtYmVkZGFibGUlM0R0cnVlJm9yaWdpbl91c2VyX2FnZW50PU1vemlsbGElMkY1LjArJTI4V2luZG93cytOVCsxMC4wJTNCK1dpbjY0JTNCK3g2NCUyOStBcHBsZVdlYktpdCUyRjUzNy4zNislMjhLSFRNTCUyQytsaWtlK0dlY2tvJTI5K0Nocm9tZSUyRjEyNi4wLjAuMCtTYWZhcmklMkY1MzcuMzYmdW5pcXVlX2lkPTE3MjEwMDE2MzMtRHRRSlJIU0lRalBHNkEzSGJYbDA1QSUzRCUzRCJ95⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe"C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=gpu-process --field-trial-handle=3576,6399331852599183236,12766683365366094322,131072 --disable-features=NetworkService --no-sandbox --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.74.352 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win10 x64)" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --service-request-channel-token=13228192529590573529 --mojo-platform-channel-handle=3580 /prefetch:26⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe"C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --disable-threaded-scrolling --js-flags=--expose-gc --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --field-trial-handle=3576,6399331852599183236,12766683365366094322,131072 --disable-features=NetworkService --enable-blink-features=CSSBackdropFilter,AsyncClipboard --lang=en-US --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.74.352 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win10 x64)" --disable-pdf-extension --disable-spell-checking --uncaught-exception-stack-size=999 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=13684168017683125576 --renderer-client-id=3 --mojo-platform-channel-handle=4356 /prefetch:16⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe"C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=gpu-process --field-trial-handle=3576,6399331852599183236,12766683365366094322,131072 --disable-features=NetworkService --disable-gpu-sandbox --use-gl=disabled --no-sandbox --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.74.352 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win10 x64)" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --service-request-channel-token=12969410558164474444 --mojo-platform-channel-handle=2368 /prefetch:26⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.3MB
MD516bdc3ec70e6266438a673dd37197446
SHA1963fb9a1c5f91cb7460225074a27fa590bdf925e
SHA2566d85e3478854ec9a8690e61a178e2638b210506222eb6cd9b1e8e22a3a711c90
SHA512018d9c4eeaed14699207377ee32d62bc95e8cab3656f01c1143c392fbac8402419c2d0d30a230a4dc27e7ec7b511b0821a36f84410380358124a159fe984b94a
-
Filesize
2.2MB
MD5f11aa32e673a5fe205804fc8f27dd15d
SHA12f3e7bf477a8ee79ff8b67bbbe85079c4a00dfc9
SHA25608700a4c80042ea8690d2623fde9e808f913b2a201307802f3a893b892ef70df
SHA512b3e66a53b05b3e8ca1aa01905b0f24a2e98933bab9ae507eb5b8a4d475ee25c683d8d9df1c1d484500bec78ef915715e463ecb849304bd0d5ba90ad3693e9660
-
Filesize
1.7MB
MD57818a804fa9fd0f9a09263b6b35325fc
SHA1590971157aa72d48f7939556a7554bc9d8975cd5
SHA256f2fd84a60790d043b531ec8eef9ad2cc961270e5f34096db1331388f1fa80416
SHA51263a9821c2a23f2f91ef1893e69a902065596e138850b825df8fb54ceed5ff551cde623049521a78821dce48720a8ae2ed53a8927ae0f404a905a24243fece561
-
Filesize
372KB
MD5dd7065f6e3bd80c6e7e6419e2475c8a8
SHA1f01ce83abf97c075fdad042cf6e3f994110ceb78
SHA2560c1b8043c56a29366da4e7065060201b9f82beba9d1c3c6c393f1a04dc2b136c
SHA51200656505b68db7bad3a78e283517fb1b2a21217245317334eb6457466564e04ef85a454adbbc97927430da6a6654a66bfaa756808e22dc394413b7bdf434a6c5
-
Filesize
1.7MB
MD53e72226a19d731e0d0baa1e9a2017dd7
SHA1d1ea639b8a0532f9ce092861016f79d672dcef25
SHA25697190cd46762d1947922ff330a406a2bc74c5bcd8e29b937be6ebddbfa3a43c8
SHA512eedc3c54196c37c08d9c9651b378db8f431c76fce206801ae1f29f0fac8a3b37a076d8610070ff5ac1b90866517b09beaa447018155b53350d8fdabdca44f541
-
Filesize
338KB
MD5c645048dcbff4fd35d51a254c18dc131
SHA1a3c9b97073d69318979a4d1bb66f02edc7ccdd88
SHA256ea3fb61653067989f3c95126cb6b470057f3f281fda7152f0940af8677e87a53
SHA512421f45e6f501aeca01ecfe876d0406404eacc13f4bdc8931e9ef46cf6487e3593394042c29169a6af0a8961f95aaa1ff06576da7b495e6fa039568d24723e6ca
-
Filesize
1.3MB
MD58fbf4845c06da70e17e40376244b97ba
SHA1488bb2cfc96dbe103425b9657ddfd646aae4388c
SHA256fef566ecb133f2d13d18980b8ad667ed202957be7d8716721e9da83f5bb1e04b
SHA512c1eafd234fe4b5aad87759931edd9c0f8bd902f35b78bbec699b5a5d882011ad7c0a780b781518f4d98c7c880115e1aa57795d5fe138001a7184114d6880c5c1
-
Filesize
526KB
MD59cb7c18b68e61c0eac049a3d7d0b970c
SHA183f17545fc35c2e1a0b627236309d8c0933a67d3
SHA2560d0a7c34d2b972fad2a1ec4df2ef604b55742b5e43f42d254851ad6bb5ffe609
SHA5129bc86e1199540e5299e61d7b873d70d3668f1e281b9dff2fba555d45cab99e23263d49ce50a4d217e0dcf3e3090a5af0e9dd64b32aec14b5ef6edaaec6e29aa4
-
Filesize
539KB
MD5ed29d945a6e4ab83974d783e5a910d20
SHA14a008b7dcd527fd2ad6b0e4211f431a983104605
SHA256c12cc8c1f3202c19729538fd3b38b7627cdc122bdad7efdfd37bfac236d7839e
SHA5128d6eb5ed8ac4b1f95f2f10d0241e130a60540a10b48bb7bb5ced23c6847d333e7818145cfeb93073b2370c216f627f0d7d0a0844e036e9b726a56a4a06409f2f
-
Filesize
287KB
MD5fe8390a1579b4d0ac0f168bc59a70ae0
SHA1927f98a0c58e96de4886bb5253b538627de9e823
SHA256feb6006bd1fa6224313fc02d70c38da1c95827152452370c8aa2087e122b02ce
SHA512d924a509933dcfe97b79ef4f715107c55f931058391f7a782cf496a84dfe42656e5f7a523dbbc7b21cf51cbea8aa02b43a5392e2b0e6a4f06a97d504eebb1f7d
-
Filesize
5.1MB
MD5ecd2fed8765416bf429f32f14cc5c747
SHA100f09763508c58be76a0ef0b348358a0802d4745
SHA256e9087632fe379f46fc8d6b4f9dfe6b167640c914873ef033d4bfe9138614d7e8
SHA51277d38303cb59cdcf68cc779d2c40fad0a327d0258802749aeb5b5b25647bc6c687e5b5a10ce8448dc7c6083267a3a86da747540b2eb15e03fd169478851a2057
-
Filesize
5.6MB
MD568c19f9f45a98734a6e42745a75ff2d3
SHA11f39560b10ab2bf6f3fab76a3be5f305b169fcaa
SHA2561233ea25703cc1830f658f379bc3e2e4486ea08b9beb356b5d0e4e0a1d4a3329
SHA512df7e50d8b17f415c9e2ae33851294370a72ab2368b4cf0cc6c5883740ddd7daa02ecd918440c21c5421bc149c0d611220aab4e51f3fd674b9adf167a79f95e41
-
Filesize
1.0MB
MD59dcd0f88d822d9e8f5d72dc15f53fb71
SHA15e06d4ec06f720a06320bf660fe5f34a460af200
SHA25699dd9ff6dda27004de1b43e01cf9d5e415c45fd9bfc05e6293ba87a8109e86c5
SHA512cc39d393ff5f31827bb92a2c30736575b8464f9ccdc14493785d77bcc7cea8125ee9124b09465619cd9dc73e971a3f480c5ed4f64adf62133c3b86032d328b5a
-
Filesize
703KB
MD5884537665618e90e195912a01fc0b007
SHA10dfb2689ed2b37260392776a6aa4025b31c5025f
SHA25698a132ff75b044ce9a666148cce3742214a8525f3c839f4c2a47356aeb93e652
SHA51202eb60c9e42d1477aa5c27e0c38af1757b09738c2e287964fa5aa510547abf0cef6050f9ae64442250634a8fd21ad345c3fd3432466cecffad384805ed3d6461
-
Filesize
2.4MB
MD5e863188d86f3291d101d3165a57f42c1
SHA1d22b38ef7fb33203506a997114ec1bbf54df8a35
SHA256ef31c88b93350311ec3b55d8a6a1279bf919196ae268254a51e698a049045321
SHA51218d84e4ab9012d20b041cb4409486c41267e141196c4bc249bb7b1f3b5ca6c4641f4664a510c81d2f4ffcaac3af149035f2ec1699ffbe61a15ab7b7d651d39e5
-
Filesize
173KB
MD5657d32eec34d3225b38262a5878e9474
SHA122daaca36c1d49bdb8b2851f40596d4cd025dcb0
SHA256ec4f39fe48a83d113191402d33420728f571df81b46e41e5c37a46845b4d2f62
SHA512d4889aff3da2fe9d9cbe175b18793af7e82f0fd6e1fb72ec8aeaf0c8e0872f008beb54a2d44f6fd7f389d0ee104c93ecd1998ddbf4f1d0c7be38e802f5c96895
-
Filesize
576KB
MD56ff65827e6191c4aebe6d611341ae02e
SHA141ecaa87dcc727340e6358251a08d3bab240b58e
SHA256a149b0e6087f27928cd44ecaf6702399745ceda59001f3918d08f4baacaa7544
SHA51285d34e0562a72c783ec2ddf2ded5c12ada293032451e4a73b530fffddaca73bbc921d5442b2b18780ae66e41d2c2441a775bbd9b14ddefba2a89984ec282df33
-
Filesize
987KB
MD5562e8efa4422fdab66fd48ae64dfc7a5
SHA122d7f566adfd42c6c18c5a2e2ccd5d5a3bd49706
SHA25673185706c9d2aa093c5e0511cee6ff5c52db25228924edb8f3edaf5af913d303
SHA512b513c177f8dc6edd26391af045bbbd57fc31c3346cc78ae1083373247e08405416198682e773a33991b6f311cd4f65fd2656cb55c63668499494eb7454852f0a
-
Filesize
802KB
MD5570163e4b53390b17bf78af85e8af01d
SHA1e642d74d485c4a3ed3a339ff3f2497b06033ccf2
SHA256dd57aabccc4193e57140f7df1ef9e4e03ff06239a9061ba9760a9a799fa4ba9a
SHA5126ca6f066ca9ede06947a52b519ffa37570f31add071545ff07a3c19227642cbfc9441805ad9635e6a75be54adbc272283074c0fd347acd99a4924dcbb9d4cecc
-
Filesize
27KB
MD5240a27d574f21e6dbe82ccfed9d11916
SHA1bc22e5eb3e1b8c330b667d956118ac3ef1472923
SHA256e5434b7722d33b1dd24a53bca66e7a746739f5801956fb1ce1ace7b2a1771327
SHA512071fc1843a8911da9d6d354cec06605feb6a56eb7627f69e2338a57ea7fc3522caf0549c284a8b7f68f18fa284bc3bc51f13dcf6d192b1738d07dcc042b5d8c4
-
Filesize
1KB
MD5bf804964f529597485b5aa66f76656d8
SHA11625addc939cf41ad6677ed2330da32d656d3496
SHA2564b09dfb390e8e522d12861d0f5e22462658bdacaceaee67bc5132228f9e802d0
SHA5126c9009c448830cd678be6d6edc28ee5e936ce25ff100c93df66ad24a8f93fc21739ffe80e27d94f400736cf76ae7735ddb7568ffa68ae23a0f566396eb6c4413
-
Filesize
131KB
MD59cfacd6bb21d545f154a3ec82aaf9d93
SHA11bbee4abe68031b38256c0f4584adb6aed95ce7b
SHA25657f498d7770150c5516cccff38dabeb90f54647d8e73a2cd45044155d86ff953
SHA51271f7d498c4442a6f0956cc030e459c8e53d041ae4e4ab1fe6b4a56d141ae6cee95ef26c10722e11923b9c65a2f90efed94da925095c19b9ec911ca499d84856a
-
Filesize
104KB
MD52a92f0dc6dac8545718ee475b7b961ed
SHA1c154cdcf10e411f1622e29a7f019ae610f35ddf1
SHA2563c53b164dfaa56213b081c97d388082a3731f064b44bd5cbcf0876b075a3b890
SHA512190ef026570129f8a9f03e22866fc8b49597644a53d06bb9c1e0cf37edbf689df86de928fb9bf782797262b1fcf85c52e212156eae94af2cd1ae4b25b3298234
-
Filesize
40KB
MD50b0e0cddd17466c1e3b81e608e29efc3
SHA130120f882defb836ee1cee65eae9bb3771a259b5
SHA25691a6099a4e818b25085359ab1e6bbb0773503ab0e5cdac21bac0f6720ff21e12
SHA512362d42f2e974b7536dc154bf4c5057ff737b2ea940e87b00a8b4183542b7ef6f5ab32840b2401523ba5e230509e865c95e65dc0bb0adba97b9433e624f5962dd
-
Filesize
268B
MD50983ab2871e1f03d0d78954b0e78ded8
SHA1c15910cdc2a98840d4731cb477d497dfea23387c
SHA256375a77b239a3564ed9b2c2ebd3607d9faf3d4fddb0db517ba25942e57629f093
SHA51287a497a9f216fd7dddaa2ef7e0a9ed930ca5634811de5da124b4444b9aea9e755b434770cd6a1921b5f3b7e10fbafab0f442946122765b016f0a28e38e623f3a
-
Filesize
333B
MD5e823d5a016a25d58c4049f9389624685
SHA183845b03459ed820e5fa862f8a4c38dca34d58ec
SHA256f622cfbd3bb53cf4cecc8a29685ee8a4e839548e102e79f97474e83eae2ad894
SHA512d84f44365f379ec5c69be2025cd226bce995f5731ce3b114bd3b240a287a042e1658cafd8e2edeafe3e164a9610d8ee3d8143e403e58ed26b79f11cc04593f3f
-
Filesize
696B
MD52bdf4a49716a88a2b28c615b77be32b3
SHA1ff6198c684338ec3c9d6b376ec3bc2fa47fa4010
SHA256171d2cfde70003a04429a70ad48978296bcae0dd9ef196dba4b2d12250ee503e
SHA512118544fe26f82bb44310472eeab65bbe5686adf905067b305529a7240e69e7cecbaa665a74d90dd2c3c3146687ccd02ac5a78a7c5e6bfc80bc8cc237bbcdd7ac
-
Filesize
6.8MB
MD5880582f1109fcd85a0a37cee73c341d4
SHA1aab9767740e4c5597b91332f1d680b3306ef9a97
SHA256e4724a1452c799f13e307202383e013302b35e755bc7af267ba3386bee0fd415
SHA5126d7c1c1884e5b2e71720ba05825f98f2204ae64296819f160db347caf20ad40c7abdcd71f025b3226a28e9f26d403fc8d3d37440c501da43a8889fc111904c4a
-
Filesize
135KB
MD535a480f9b79fefcc52fbeb9f407b9ddb
SHA171b93366f61ab551728b19839e88307b5ad5660d
SHA256696168032cb8e76bfeb70892bb7a027e66d9284dd5ee839852f964eed0e5441d
SHA5122a0972476ee922e80a5303ecec277d57fde355beb2fa6313d4304e63448f9acc46cb36782983e67875fb8bcb1c211ddfa6bc104ee7101d9546ba5d95589d7f0e
-
Filesize
207KB
MD55a641d4af4cd4ebc751c4d0ff5390451
SHA10b6d6c07151f9e93e107d97173ea5de6d21c6ff3
SHA2560e16584de89206c4e127988def8ea28d70bb0ef2dc8c914a2d8dc65a83fd2115
SHA5124a0c770313c8206e9c878c24e7462cd5ea7af76d418261b503abc576378f59a6963a90a588e0f7ed2aaafbb14daf2d6316b5148998d2fa84c1ac4f58189205fa
-
Filesize
216B
MD527a84a27f209f48a479209da0d5e0521
SHA13cdf3d98ce2a2690a55e1a1424e09a8fdcd83bad
SHA256fff7e156b1bae681103ee779afb58cd0d508cf549b137b1c54d0e695ef1c0a13
SHA512e84a529bf34cc32157775fc31834c9dff333578f11f158d7362f282c478e20b5ccd37e9f16cf73412c2274ceefd73b7bd7d98abc8a564dde49d92e4d7e5a2fe0
-
Filesize
48B
MD5d5860b96f38104106e637476487cde33
SHA1b14e56b1431fd2fd6eb2a1a00e8003b779b16e6c
SHA256f640237ebb02a96f35f4a685ecbf6bddfd43f4eb69f738006551ccb36b284de6
SHA5122041c1cb09c989dbf5f71467e20ff85d54953c71b7416a92ecb7191d62ceabb0d8f2a2328eeafeeb579235a08833837abfc165fd4bf2dfdb104acae6de46fab2
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
2KB
MD5b9458ee7df2e344cfb7ebca63abce667
SHA1f14b31b480a196c1b072455a61ef4bd316c0deb9
SHA256d78056318678cad58d996b46f016dc172e9fcc4eacee69ef4d5417cf115d98c7
SHA512af03bf595e635cb0b99cf2a23a96de8e343779d797e00054974ab6c3d49421386c16db65a84f63548d76329c52b49ea7a555d6c3627700e90115c7cb2644ec28
-
Filesize
2KB
MD51c07a849d7dabee5460ca861a578a795
SHA105cf925ef2c58211a87c2d2c56cbc909de4249ad
SHA256dc1ff826c6b7f3bb7486246067a205f5c58274f8e88801d1d5a3ca74f4efaf25
SHA5120d8aded38d84eb65026f3a3f3860551d05b3594e0fa7e6a2728ad1cf6d59f5a83c9d7a73c806d9e3f1326760fe1ba2a86223cde7695c93175aa1f62eecc84595
-
Filesize
566KB
MD526d02cc778b804689bda1aafa9a76fb1
SHA15452c96593478f59471730366c682da19881051d
SHA25661eadf4a0bb3710671f5b6f1db10c522a2d0a07177d3b79eb844d7f69d8f8635
SHA512047ecfb6df19e39579dd2a7359fec312f4dcf2293e9e4f232a22acd37a3c22707ecbf53d6ed0fe44989b8a52502fd43f525e20b85b83f29223205ade6a7aee90
-
Filesize
480KB
MD5391cf634b3ccf3971811be5ef016fe32
SHA18e3023466d02dfb8f2e1b48555b998532dc9a377
SHA256de9a2072df66c11af8cc255788c4c572f7b45ba7ab19524ad2e01a23f55e9ca8
SHA512c1594a33efcfac7c6e6935e76ed030855886453b6397ba53a63225efbeb513a1ccb39ea7d528cc43bb1e2b56fd0e02b306e0e65dc6896613c2b4ca6c4a165d9a
-
Filesize
555B
MD57b11a2b50548f6e537f62063817c65f8
SHA1891b24b24eb7fd5a95e765015763beee27385790
SHA256891320597758a78ffc1d89c67cbd0b570aa94c32047e6f3ac9121e0d180c1aa9
SHA5120e93582ec31dff7ed66e5498656a80d245cf34b1ce556864222d7505d9a531cedb9e91590c880a5852cd3a8c351847019d0e69b02240feb4dc257374ecf587e2
-
Filesize
561B
MD5068a761b1ea67b67ac574d7a79180949
SHA1af2d474fe6ddec279f7f4453b3e532279a7d250a
SHA256a08b8fdc1bb517a3e29c29fac6af7636e475e3e27d66384c4b63bcb326b43b5a
SHA51288e50fa96b4845f193a6954ee72fcf4ba4f9071dddcdea713f33c0a1381ff7d59fdd706253a3e682f16d10bb90ccae8f3ec24316ca84933b880ccbe75d5e506b
-
Filesize
3.3MB
MD5300342bd92d7c94783a75aef90780d83
SHA16c061285e94addf89329f9f2b4c4022eb21a6dde
SHA256a652e160d8d0bf4c4e2585506635c25425a508d2430fd00e1aa913111ad0dba9
SHA5124f5f63f42033f83e02338372a216c0b6f3233defe7b91488d0c850f72090a85d7c575092cb77a0639b423236831092447d388f51b076a7649b862c2b021f372d
-
Filesize
14.3MB
MD51e7bd6790391b5b710c6372ab2042351
SHA175f1aee6dccf3d6e6ac49926563737005b93ba13
SHA256952a0c6cb4a3dd14c3666ef05bb1982c5ff7f87b7103c2ba896354f00651e358
SHA512ae3860a060be483c9fcbcf6a41f561faf2cd681f39138dd13a563e3f39cf4b4f41e7c0f7b58bc8b585b2728245025be4b198f06634a97fa98847258272f9f59b
-
Filesize
13.8MB
MD53aa2d769397da14166eacdb3640458ee
SHA1b38b7fc28c5e2ef157f93297036202911d2fc2bf
SHA256b4d433e2f66b30b478c0d080ccd5217ca2a963c16e90caf10b1e0592b7d8d519
SHA512404d2301c4719b8791639e8100eff6df7cd9c3ca62ad0a5c7ac8252f8adc2601aeefe83da982a409b9e3d901f74518ff98d2af5ebdd8cc77067be39c20eb1c56
-
Filesize
28KB
MD5077cb4461a2767383b317eb0c50f5f13
SHA1584e64f1d162398b7f377ce55a6b5740379c4282
SHA2568287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
SHA512b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547
-
Filesize
5KB
MD596dd80972b008f7531b1c14b52c49559
SHA1862d800319898af13cde9523456eefeece311127
SHA2569d3761eb7baf7b6f5eb3153abe366fba17cebc172ab65a2915fed7039daca835
SHA512349c577d98ba5c30edf0d8581e32638f4c40aeced6ab53848a5091d38a11c98c372eef7b24790c796fc440c95ab7ff895464e5199cf9f559b51e43ee64cee7f2
-
Filesize
632KB
MD51d7599c4a31b82e70308c022e9494011
SHA17d04a03d5502df2838d40dd131b1cae226cb5205
SHA25621d2935d29c807a3a56c406849b97dbc7f720822920930d0e2b13a44203c107c
SHA512080ff020e0d2d9c0ce6beee8143c0f49e1b4450baa08072a8662f4b25ad6b034ee0ad174f2d4acd5b011cb8fb140656755007e245673f7677964b9e99555ab08
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
632KB
MD568f7654abfd77baade7a36e1d718ebc4
SHA1eabba5cb899aee962f85b52e359c9f85d83771b6
SHA2565b60b35079913ba1e00cddf762c1759650de8a3c2b76e373b996ced4843becdb
SHA512b48c4ba6112e7ac1dae5846eb41812d265a72fc13966c8f8bdf7099fec88d27b414fe566905a6eea4e2f574c379fe87059018c8a365bed55a46eea9a42b38889
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
576KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
5.2MB
-
Filesize
1.8MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
