Overview
overview
7Static
static
3TeddyPcFiles.rar
windows7-x64
7TeddyPcFiles.rar
windows10-2004-x64
7TeddyPcFil...n).exe
windows7-x64
7TeddyPcFil...n).exe
windows10-2004-x64
7TeddyPcApi...ts.pyc
windows7-x64
3TeddyPcApi...ts.pyc
windows10-2004-x64
3config.pyc
windows7-x64
3config.pyc
windows10-2004-x64
3main.pyc
windows7-x64
3main.pyc
windows10-2004-x64
3saved_account_db.pyc
windows7-x64
3saved_account_db.pyc
windows10-2004-x64
3TeddyPcFil...g.json
windows7-x64
3TeddyPcFil...g.json
windows10-2004-x64
3TeddyPcFil...b.json
windows7-x64
3TeddyPcFil...b.json
windows10-2004-x64
3Analysis
-
max time kernel
256s -
max time network
261s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-03-2024 20:09
Behavioral task
behavioral1
Sample
TeddyPcFiles.rar
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
TeddyPcFiles.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
TeddyPcFiles/Teddy PC (main).exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
TeddyPcFiles/Teddy PC (main).exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
TeddyPcApiRequests.pyc
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
TeddyPcApiRequests.pyc
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
config.pyc
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
config.pyc
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
main.pyc
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
main.pyc
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
saved_account_db.pyc
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
saved_account_db.pyc
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
TeddyPcFiles/config.json
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
TeddyPcFiles/config.json
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
TeddyPcFiles/saved_account_db.json
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
TeddyPcFiles/saved_account_db.json
Resource
win10v2004-20240226-en
General
-
Target
TeddyPcFiles/Teddy PC (main).exe
-
Size
15.4MB
-
MD5
31183e0d16f4c66a59e6989212ade4e0
-
SHA1
c8ba290a15f9086b55504083c96a4f4391ec22f8
-
SHA256
1e440b158dc8162de4704d5985c4c15000df2e2b703dfeaec22fbe6bf7a59b73
-
SHA512
237a70a53ca0f8c9cf51e755355210220fd04d0f621e331eab4530d897edd18de699488907ff01ce2836ad1c22253323b2a5146b511196f9c6e60ea9676c6a55
-
SSDEEP
196608:Mq9XaO93xXh04A1HeT39IigwIc0/ajaA0W8/LV2ck3FEpXSOq33NUqfEx:8eXh0h1+TtIiFU/MaHW8p2ypfg62Ex
Malware Config
Signatures
-
Loads dropped DLL 34 IoCs
pid Process 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe 3496 Teddy PC (main).exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 3504 msedge.exe 3504 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4612 identity_helper.exe 4612 identity_helper.exe 2740 msedge.exe 2740 msedge.exe 2740 msedge.exe 2740 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3496 Teddy PC (main).exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe 4308 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3520 wrote to memory of 3496 3520 Teddy PC (main).exe 89 PID 3520 wrote to memory of 3496 3520 Teddy PC (main).exe 89 PID 3496 wrote to memory of 3504 3496 Teddy PC (main).exe 90 PID 3496 wrote to memory of 3504 3496 Teddy PC (main).exe 90 PID 3496 wrote to memory of 4308 3496 Teddy PC (main).exe 98 PID 3496 wrote to memory of 4308 3496 Teddy PC (main).exe 98 PID 4308 wrote to memory of 4348 4308 msedge.exe 99 PID 4308 wrote to memory of 4348 4308 msedge.exe 99 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 2536 4308 msedge.exe 100 PID 4308 wrote to memory of 3504 4308 msedge.exe 101 PID 4308 wrote to memory of 3504 4308 msedge.exe 101 PID 4308 wrote to memory of 1708 4308 msedge.exe 102 PID 4308 wrote to memory of 1708 4308 msedge.exe 102 PID 4308 wrote to memory of 1708 4308 msedge.exe 102 PID 4308 wrote to memory of 1708 4308 msedge.exe 102 PID 4308 wrote to memory of 1708 4308 msedge.exe 102 PID 4308 wrote to memory of 1708 4308 msedge.exe 102 PID 4308 wrote to memory of 1708 4308 msedge.exe 102 PID 4308 wrote to memory of 1708 4308 msedge.exe 102 PID 4308 wrote to memory of 1708 4308 msedge.exe 102 PID 4308 wrote to memory of 1708 4308 msedge.exe 102 PID 4308 wrote to memory of 1708 4308 msedge.exe 102 PID 4308 wrote to memory of 1708 4308 msedge.exe 102 PID 4308 wrote to memory of 1708 4308 msedge.exe 102 PID 4308 wrote to memory of 1708 4308 msedge.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\TeddyPcFiles\Teddy PC (main).exe"C:\Users\Admin\AppData\Local\Temp\TeddyPcFiles\Teddy PC (main).exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\TeddyPcFiles\Teddy PC (main).exe"C:\Users\Admin\AppData\Local\Temp\TeddyPcFiles\Teddy PC (main).exe"2⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:3504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/api/redirect?clientId=3446cd72694c4a4485d81b77adbb2141&responseType=code3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8bd8546f8,0x7ff8bd854708,0x7ff8bd8547184⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:24⤵PID:2536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:3504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:84⤵PID:1708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:14⤵PID:4120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:14⤵PID:3644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:84⤵PID:1564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5532 /prefetch:84⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:14⤵PID:3796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:14⤵PID:3652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:14⤵PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:14⤵PID:4232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10513317190848640277,16683855637365151089,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4712 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
PID:2740
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3968
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51eb86108cb8f5a956fdf48efbd5d06fe
SHA17b2b299f753798e4891df2d9cbf30f94b39ef924
SHA2561b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40
SHA512e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d
-
Filesize
152B
MD5f35bb0615bb9816f562b83304e456294
SHA11049e2bd3e1bbb4cea572467d7c4a96648659cb4
SHA25605e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71
SHA512db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1
-
Filesize
185B
MD5fa88c3bfda3b1796f85a6a584c6d1aa7
SHA184d491531661b24cf143c3ec93cadcd5577c3424
SHA2569868ffd2c601b0c0c34326e353e44641cb4ef25177773db6c1d9a576551ad74d
SHA5124d32859e058d66d523fe873dfa5a60aa1566211758ac62e74ceb6afeb177d9444566bbb57886cd82f062f934b43619ca132f3ad1b306f7a9eb0800e6d949c78a
-
Filesize
6KB
MD506658efaa7787ef5d39071900ec62af0
SHA162f1179862c112200070b2994575647cda8fc08c
SHA256ac8be622d7352d8c481180e7e108950c1c6b8c2121617d881e86241663ee8aef
SHA51213d22ec5abeb93fec68257516b439b73f7396ea3ac12cb5fd9cc8496ad1ade58051614ac2732a0053701f8a60b9918059312e743e189f65b93117dd999273826
-
Filesize
6KB
MD55d99d55c909619af751806e48233a265
SHA1c76056128350f20a7a55f105b0be476546b01141
SHA256bbd7ff226f2f5bb8e9b542522d07c61404de1c308a90f9ea4050a888d44555b7
SHA512fdc3278b942425a3a21191fd78427c20a424776a8eb6515f054a50e2126b4bb6a59f3d946020c1681d309ebead293fa9b226e6807c6854054f2b9a307ceadf30
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5e71b0023cb018c1334d69f8722071e15
SHA12847c27a3e021c6c4b7af2e0e2ce9607a7689334
SHA2569b3629c248fc80ea947fa19d366a9a005a858afd0e6b0da49893dd5b606e3107
SHA51249a2ba4291ede09cdcc135515ff4582b16ebf0fe53e25d35d7c3775a60de9be3cbe8259adec8be07e62a1abd40f8520ff686572a929c3d93425ee898a58f34f2
-
Filesize
11KB
MD5339e4b50a34301683a40afd297101a26
SHA166050ca72ec07b7470cbe7c9b453a46e19ad7a5c
SHA2561d64ab3304ea927979aea9e38dadb74e5f51e62bde10ea87c2d4551bcb4e4ccf
SHA5125063dd00c50480a0b53d263d3285ea48aa1b94cd9e654a56d771d0b64ccb9a1dd5cb4f77b9e45d4e185cd1fe1109dbb7baca803d6d2e17dec5d361443901a447
-
Filesize
13KB
MD58013d237df05fd4e4c56a2735b666464
SHA1f48c1b06aedf324c14b98935461f3cf1d5cdb5ab
SHA25661199bfa141342ece07c99b1bd37484f569c0952672816fa8ebfcb34fd209898
SHA512e783c88c7a1082ef975222db6e7ec49009e311297ccc2e66895420447d10b2b9c331cee1f308ec37b6db9eab842982fd75d76f1530ced9d5c81e7a38cad708b8
-
Filesize
796KB
MD5d218b7dc4c1879a98e2cc1d40a1efcc0
SHA1cbc1d7135e8acb0b6afa6e2be0ac8fbc22ab8903
SHA25600621235f2a05b7d11b966eeb0c2e6284891b38a635c543d97c9d4dda71295f5
SHA51237aefbf2d611c228b201d89c13f213f290f4a40a15133c5ce4ff09a74c44c2f2c32abc3783029a90b5dd8af544b9d94dde97857d160307c86a9c77a3a2f7d291
-
Filesize
750KB
MD50ed8efdbb9d2747f12118f041ce15d28
SHA1b63b12c8da1bc76f61ae669047fa0b937bf3ae5c
SHA25610170e6e0bd1fccda5047d9f509b708d5add7ac4d5767ca161cf1478d3bca616
SHA512c51c7ad17f961a16ae6c4b501e81d5bfe00d6c9118d9f31b0e44d0ac33c0db36ec795d2ac47f5817d5961b3fe4a19b4dcbe0053465db7d04b9a02a984247d874
-
Filesize
158KB
MD53151f5be4d073c7a25f5c492a4b99874
SHA16bb05a280ae97e5e4e6f5eb96c94c2f9fa61ecb4
SHA256db6a580afeb112af6abc4091f8cdb2f4275fb6fde5f02549ff3771db2d78c4b0
SHA5123d3d0274dc31399f6048aa3c211bb94c6a703cca808b01efbd621d5d3490db9acb80a19d6e56b273f422760c434bc4ae904355137904ee202d2cf164616b31da
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
63KB
MD541806866d74e5edce05edc0ad47752b9
SHA1c3d603c029fdac45bac37bb2f449fab86b8845dd
SHA25676db93bd64cb4a36edb37694456f89bb588db98cf2733eb436f000b309eec3b2
SHA5122a019efaf3315b8b98be93ac4bea15cec8b9ecc6eab298fa93d3947bad2422b5a126d52cb4998363bdc82641fba9b8f42d589afe52d02914e55a5a6116989fde
-
Filesize
82KB
MD537eace4b806b32f829de08db3803b707
SHA18a4e2bb2d04685856d1de95b00f3ffc6ea1e76b9
SHA2561be51ef2b5acbe490217aa1ff12618d24b95df6136c6844714b9ca997b4c7f9b
SHA5121591a263de16373ee84594943a0993721b1e1a2f56140d348a646347a8e9760930df4f632adcee9c9870f9c20d7818a3a8c61b956723bf94777e0b7fb7689b2d
-
Filesize
121KB
MD5a25cdcf630c024047a47a53728dc87cd
SHA18555ae488e0226a272fd7db9f9bdbb7853e61a21
SHA2563d43869a4507ed8ece285ae85782d83bb16328cf636170acb895c227ebb142ac
SHA512f6a4272deddc5c5c033a06e80941a16f688e28179eab3dbc4f7a9085ea4ad6998b89fc9ac501c5bf6fea87e0ba1d9f2eda819ad183b6fa7b6ddf1e91366c12af
-
Filesize
247KB
MD5e4e032221aca4033f9d730f19dc3b21a
SHA1584a3b4bc26a323ce268a64aad90c746731f9a48
SHA25623bdd07b84d2dbcb077624d6dcbfc66ab13a9ef5f9eebe31dc0ffece21b9e50c
SHA5124a350ba9e8481b66e7047c9e6c68e6729f8074a29ef803ed8452c04d6d61f8f70300d5788c4c3164b0c8fb63e7c9715236c0952c3166b606e1c7d7fff36b7c4c
-
Filesize
63KB
MD5ba682dfcdd600a4bb43a51a0d696a64c
SHA1df85ad909e9641f8fcaa0f8f5622c88d904e9e20
SHA2562ad55e11bddb5b65cdf6e9e126d82a3b64551f7ad9d4cbf74a1058fd7e5993bd
SHA51279c607e58881d3c3dfb83886fe7aa4cddb5221c50499d33fe21e1efb0ffa1fd0d3f52cbe97b16b04fbe2b067d6eb5997ac66dec9d2a160d3cb6d44ffca0f5636
-
Filesize
155KB
MD53273720ddf2c5b75b072a1fb13476751
SHA15fe0a4f98e471eb801a57b8c987f0feb1781ca8b
SHA256663f1087c2ed664c5995a3ffa64546d2e33a0fce8a9121b48cc7c056b74a2948
SHA512919dbbfcc2f5913655d77f6c4ae9baa3a300153a5821dc9f23e0aceb89f69cb9fb86d6ce8f367b9301e0f7b6027e6b2f0911a2e73255ab5150a74b862f8af18e
-
Filesize
33KB
MD5758128e09779a4baa28e68a8b9ee2476
SHA14e81c682cf18e2a4b46e50f037799c43c6075f11
SHA2563c5b0823e30810aee47fdfad567491bc33dd640c37e35c8600e75c5a8d05ce2a
SHA5125096f0daacf72012a7ad08b177c366b4fe1ded3a18aebfe438820b79c7cb735350ef831a7fb7d10482eefd4c0b8a41511042bb41f4507bbc0332c52df9288088
-
Filesize
50KB
MD5e2a301b3fd3bdfec3bf6ca006189b2ac
SHA186b29ee1a42de70135a6786cdce69987f1f61193
SHA2564990f62e11c0a5ab15a9ffce9d054f06d0bc9213aea0c2a414a54fa01a5eb6dc
SHA5124e5493cc4061be923b253164fd785685d5eccf16fd3acb246b9d840f6f7d9ed53555f53725af7956157d89eaa248a3505c30bd88c26e04aabdae62e4774ffa4e
-
Filesize
31KB
MD5284fbc1b32f0282fc968045b922a4ee2
SHA17ccea7a48084f2c8463ba30ddae8af771538ae82
SHA256ac3b144d7d7c8ee39f29d8749c5a35c4314b5365198821605c883fd11807e766
SHA512baa75f7553cf595ad78c84cbb0f2a50917c93596ece1ff6221e64272adc6facdd8376e00918c6c3246451211d9dfc66442d31759bd52c26985c7f133cf011065
-
Filesize
77KB
MD5485d998a2de412206f04fa028fe6ba90
SHA1286e29d4f91a46171ba1e3c8229e6de94b499f1d
SHA2568f9ede5044643413c3b072cd31a565956498ca07cdd17fb6a04483d388fdad76
SHA51268591522e9188f06ff81cd2b3506b40b9ad508d6e34f0111819bf5eff47ed9adf95ebfae5d05b685c4f53b186d15cc45e0d831d96be926f7a5762ee2f1341f1f
-
Filesize
172KB
MD5e5b1a076e9828985ea8ea07d22c6abd0
SHA12a2827938a490cd847ea4e67e945deb4eef8cbb1
SHA256591589dadc659d1ad4856d16cd25dc8e57eaa085bf68eb2929f8f93aba69db1b
SHA5120afd20f581efb08a7943a1984e469f1587c96252e44b3a05ca3dfb6c7b8b9d1b9fd609e03a292de6ec63b6373aeacc822e30d550b2f2d35bf7bf8dd6fc11f54f
-
Filesize
62KB
MD5b9433c77e6b04532ac587056d21947c2
SHA10bcbf7b0ae1c3b815788b62879384217d9744abf
SHA256a3488d90b5493dd0af5054750194cdeafbf05db42e881c78d92449932565308d
SHA512a0fcbf898038f2337db8b2aa5873e3fd8970f5f7d01725e9a20be091985495feab01d7dc7b8a6b7ab898d2875566029fd3d217883a1301bf67f8c4288bb29b4f
-
Filesize
24KB
MD5b21b864e357ccd72f35f2814bd1e6012
SHA12ff0740c26137c6a81b96099c1f5209db33ac56a
SHA256ce9e2a30c20e6b83446d9ba83bb83c5570e1b1da0e87ff467d1b4fc090da6c53
SHA51229667eb0e070063ef28b7f8cc39225136065340ae358ad0136802770b2f48ac4bda5e60f2e2083f588859b7429b9ea3bad1596a380601e3b2b4bb74791df92a3
-
Filesize
53KB
MD5e3d1b83909f6f1eee896ac57bb24bbdf
SHA120992879399bee44184240d5091172882da1019e
SHA256c0dafa83e6cb70a399028ce9d1f20931a597e11a8854e2fddb1fd90129d6da55
SHA512b4ae7f50f14795edfb355ed1fdfdf4902283b0b354d801bf440ca47e4ae55a8f990392c1f515e55b145ee414c8522382b67a5b7da0630b232fffa88f89cef033
-
Filesize
249KB
MD55b1b2e84229d6156b45ac9c2f3a8e779
SHA102101e65d75b6b74251632cb1d854da7da813955
SHA256ba8405808a14825cbc4c41968e21dae0bdfff7adcc30407c24de45dbdb6c124a
SHA512ed8a8f8cd54c0f2096c985e6648b82664c1eca8153f59b2971700350576458536f29ac94f5c2848e661d08eacd10809376adc7b0e4b15c86becaa342b21bffa2
-
Filesize
195KB
MD5dc3fa55903a323b0d879867bfb33748b
SHA1922b708b3968055132915c4b267b4eb2777ddf27
SHA25621e63e841890417eb1b64fc7e0927c9e36eb8baf2dd3212fe764590a1fcd40d4
SHA51293923f87550f9823594b118520a00f15bf325a02157b3541e25c8db15956b4b12af8c05034267ef817221827a287bb126245147c53d10b3c2789c40aa0576d64
-
Filesize
48KB
MD51351a17fe8b2915c7b939f85ed80eb11
SHA1480eac8f353e4a32c0d0ccf8a7d5fcec14a56137
SHA25629f767807ea5a9a463cbec1f4cd5b435e0e9259f7e43206dec15e6c7139352f8
SHA512a7c3d2382cfab1c5e856fd53115f074197a35b12d8e373d75709d48a68e88467c26e71df92864ab249ebbb82b8edd3933bb9a76d97a7aa4def64a97d41d2f21f
-
Filesize
35KB
MD57a783b3600b6c90ed11078bc9d25e78b
SHA1da19a65ba602658805ea5800de0f2089e002978e
SHA256c93ecab23a1d0d1088aa3b8c6273ca4ee2df9593d3c167d13dfb79bfc155b60e
SHA51280a7a9b47d75e1269c4ced87a196402dc16ec71e231d8e8841bb14aabaec0ae6b0338a659654af9d3068ec81f2ee439d342410192c65bf900181d0189f3684c2
-
Filesize
1.4MB
MD5852a31cacf70f1eb49e7141dd8ba3467
SHA1e95f27b99b94c4aa38b3cd57abad60beba7910ae
SHA2564a19b01c865bfb5d8a96e772d7986dc3aa9af72adf6ab20702538b7f38c2404b
SHA512b752313e966a6729da337fa542e63f62b2942381a2edbb70fa865b3f62af232858394720682283110cba12736a662ce156636a3ed9e3e0e4478516d5fe9ed7bc
-
Filesize
4KB
MD505eb3947ce9a8c3bef66c14d0f938671
SHA106ffc811ee51609809d88894022e222b339aefee
SHA256c9417470c16ced7a43d6c4a8e027afa6edc62c24d5aee7c4c2dcd11385964d3b
SHA5124db7c14fba78185edf6459016608cb8fa0a250dfb48432c552bb4e0466cf49622b34d847e17c254bb1c8d15bf365e91bce3ede552ba8733fde9d21779f7f1c13
-
Filesize
979KB
MD5d39e8831d3386055f5e62f72ce06250e
SHA10675273ff19fbf719a20eb1fa39c020ceaa77015
SHA256c486372dc708dd42888e3f35c361447d8fa97e0921a203fb29f0e19d25f56931
SHA51237c8b8cb20109879f211f10f8e3f9712992c961905de31aa1ac7a032f7bd96c5bbbbbdab4330c2c8f8ed4e4c473fa5df5809177fe412d841c7beba73118e0d40
-
Filesize
844KB
MD563a9e111d85173b018afc553b0de35dc
SHA1e3d261bf92053feae69b790c577ba6489b212b04
SHA256f96d78f3cc409cd2988462e5994ebde65d554a4fc128d033c0745c5295d24984
SHA5121d0db30739aa5475f99bf7310514b82a4179c564d0eb11215613cb0555171c88d72648846ddb8b78626578c0e43a970656934abba8abd8c6987142d01ff62c3e
-
Filesize
1.7MB
MD507a6895c2f99a69a7d60b1ba7ad4fc8c
SHA19c5a6d215727589c446b502bad34531d8dff92a4
SHA256267b6f073f8b6f96c1551d7c8b9bf2849fc3f4bdd1335144d4b866243badead5
SHA512f00fa8289dbe0ace3023fe9e74f7f868b1a8fa137845236914cd36d77d362d15aa63dfe24cd5755fe45117ce800d949ac777386e29235770bb83e209310c23f0
-
Filesize
38KB
MD50f8e4992ca92baaf54cc0b43aaccce21
SHA1c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA5126e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
-
Filesize
768KB
MD519a2aba25456181d5fb572d88ac0e73e
SHA1656ca8cdfc9c3a6379536e2027e93408851483db
SHA2562e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
SHA512df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
-
Filesize
45KB
MD553c003dec693f83c57f326b6df5d5f05
SHA16977ebcbf74a039501825697021c504d7cc63928
SHA25632555defdb044714dbaaec281820fa7a0c226545d40561b905294d2e0bdba102
SHA5122c4b9dff022d25906981d52f68a9bda8e7840597bea6cbea9bc8036392dea56fbecaedcd1b9f6547074c28b018266e424ca0ae8e66bad947544a8571f83fd2f4
-
Filesize
193KB
MD5d7ecc2746314fec5ca46b64c964ea93e
SHA139fc49d4058a65f0aa4fbdc3d3bcc8c7beecaa01
SHA25658b95f03a2d7ec49f5260e3e874d2b9fb76e95ecc80537e27abef0c74d03cb00
SHA512d5a595aaf3c7603804deae4d4cc34130876a4c38ccd9f9f29d8b8b11906fa1a03dd9a1f8f5dbde9dc2c62b89fe52dfe5b4ee409a8d336edf7b5b8141d12e82d2
-
Filesize
3.0MB
MD5fb19048d232625c9a6f890125c22cab3
SHA175674d6d3d925eb08014c48a20c275225aaf1d52
SHA256f1b547edf006e32ac72344ad2508751eeb58e39b6885cc153493945a494b264e
SHA512a1f9da8ce6aebd75512d56635a7b8aa7455ebdd65b208f0356e59995a92baf2dd0cc0ae2624f5f7a2e1a206ddd0bd937dbe5778a94de6646c3092ff646fffe98
-
Filesize
1.6MB
MD52eaeff28f7d131518ea7fe461b448fcd
SHA168735a5a0fd8ea2ba6e526897778996e0798698c
SHA25671812cfdd792a404817df2e2c158366736b93ee47e4e95e8fdf29834d45763b6
SHA5129aa2ff371d8f4a434acc73e1b6f3a90a571dcae18e495b1f1decae9273b0a9870d6057fb57688a6c58cc1c5828737a9f7f5f7183121a12563690a555731e7ad6
-
Filesize
29KB
MD5e07ae2f7f28305b81adfd256716ae8c6
SHA19222cd34c14a116e7b9b70a82f72fc523ef2b2f6
SHA256fb06ac13f8b444c3f7ae5d2af15710a4e60a126c3c61a1f1e1683f05f685626c
SHA512acb143194ca465936a48366265ae3e11a2256aeae333c576c8c74f8ed9b60987daff81647aef74e236b30687a28bc7e3aa21c6aedbfa47b1501658a2bfd117b4
-
Filesize
904KB
MD5efd5258e678588bdbd51f368fef66931
SHA1df5fb5978aad9e93b25a10dfc4d1aab26cf403b4
SHA256fbe0768ac49e4e18340b9ae064a07374ef3553164eb1d07d62b4c0b50239fbe1
SHA512fbf4ebfc66a6f6ef3a6ff7281c0abf9fc0d08fc7144abf1a3ed9c5a6d26c858d65c2f49cc00e02ecff1257eb7a54c4cd493b867567ed5e14574eb801c3a38455
-
Filesize
1.3MB
MD5e247959584dc5499917d90a95c317097
SHA14f0556140af9bf7f1274b283e1692f5924d2cb3c
SHA256d5bcf9ceb3dc3e602e55631e2c1f03cba1afff9604e69606994d5d6f81dc7d20
SHA5121b60dab541e18ec75155eaa4c2f00facebe2c46dfbe772698d0f7fbb8fa444966f48e8a4fa26476d43c42586239fcab2c2083ebff95e5937b1bb6011418d0b52
-
Filesize
1KB
MD5e9117326c06fee02c478027cb625c7d8
SHA12ed4092d573289925a5b71625cf43cc82b901daf
SHA256741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
SHA512d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
-
Filesize
1.2MB
MD5b4f3df75c561e63439d8719e9fd6d4e9
SHA135752499de304188c126da75cf29032bc4e0d34f
SHA2567b139fc3c4e15be72fcd1aaebefc693648d0e83226c7d4383e9ba1b095a1ad9d
SHA51260b596e6aaa5eba3a4b62f647879edb129f6619ec989dd27c7321c911e20acb24e11a95c5f2efd100e7f6ea9abf1d47e3000c84e58160de15ee017c9de54b1e6
-
Filesize
1.4MB
MD57ab45516793ff472a38f5f1f2aa80e77
SHA1507f13c4e1aada406a1c2a63b2f508a24edd1054
SHA25657d0870ba485d8e4d895886a9c0726b393db4f09bbd55780165ad35488cd0f52
SHA51258b87f1c028a8235cff830351d0828d79eb0ae780af1f29c946965b93cc934a1159443e9f6d14c63eaa9b00f5b519300dff4219fad920b52b63294f610229852
-
Filesize
722KB
MD5f6d3ca5d7db9c6e983ac00bc1eee98a5
SHA14b88457f65c33f327eb5026f0b1c49392109c4b9
SHA256e4d32388852b8094ecc4e25255514d313e085237170e76946e40e487b3e5fb51
SHA512e2b2f6fc0b49548028ca270736a688e032fa298b43921030614c49cb4d7e470db3c62935dc6b92ad9dfd2d4e51a92deba49f428e0dac042b2fdc7f64d381336d
-
Filesize
1.1MB
MD55cc36a5de45a2c16035ade016b4348eb
SHA135b159110e284b83b7065d2cff0b5ef4ccfa7bf1
SHA256f28ac3e3ad02f9e1d8b22df15fa30b2190b080261a9adc6855248548cd870d20
SHA5129cccbf81e80c32976b7b2e0e3978e8f7350cce542356131b24ebab34b256efd44643d41ee4b2994b9152c2e5af302aa182a1889c99605140f47494a501ef46c1
-
Filesize
93KB
MD53ccc89b98dab137bc5af9c1e62923829
SHA155d93e9782094925d80e4ce27d13a0a9761b7002
SHA25640e91aaa369a5c171c0d30630707ae9bb64412fedf149aeecfa5707a2324f770
SHA5124ebe427c75d83c019f8d378a030ae21e07decf30cd10623115eb0cc6ad7a689159e95c7fabac82ce82cea3720fae6c6faf712b600236dad039255884872eb6c0