Malware Analysis Report

2025-01-03 08:03

Sample ID 240421-bkjr5sfa56
Target fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118
SHA256 32e0aa84467fbe642c7ffc3b0096828c6c93937b8fe3cf95c4f0fe232c896e4f
Tags
metasploit backdoor trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

32e0aa84467fbe642c7ffc3b0096828c6c93937b8fe3cf95c4f0fe232c896e4f

Threat Level: Known bad

The file fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

metasploit backdoor trojan

MetaSploit

Metasploit family

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-04-21 01:12

Signatures

Metasploit family

metasploit

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-21 01:12

Reported

2024-04-21 01:14

Platform

win7-20231129-en

Max time kernel

137s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2888 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe C:\Windows\SysWOW64\msq23.exe
PID 2888 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe C:\Windows\SysWOW64\msq23.exe
PID 2888 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe C:\Windows\SysWOW64\msq23.exe
PID 2888 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe C:\Windows\SysWOW64\msq23.exe
PID 2768 wrote to memory of 2692 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2768 wrote to memory of 2692 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2768 wrote to memory of 2692 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2768 wrote to memory of 2692 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2692 wrote to memory of 2752 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2692 wrote to memory of 2752 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2692 wrote to memory of 2752 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2692 wrote to memory of 2752 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2752 wrote to memory of 2724 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2752 wrote to memory of 2724 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2752 wrote to memory of 2724 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2752 wrote to memory of 2724 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2724 wrote to memory of 1928 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2724 wrote to memory of 1928 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2724 wrote to memory of 1928 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2724 wrote to memory of 1928 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1928 wrote to memory of 928 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1928 wrote to memory of 928 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1928 wrote to memory of 928 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1928 wrote to memory of 928 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 928 wrote to memory of 2684 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 928 wrote to memory of 2684 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 928 wrote to memory of 2684 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 928 wrote to memory of 2684 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2684 wrote to memory of 1632 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2684 wrote to memory of 1632 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2684 wrote to memory of 1632 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2684 wrote to memory of 1632 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1632 wrote to memory of 1388 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1632 wrote to memory of 1388 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1632 wrote to memory of 1388 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1632 wrote to memory of 1388 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1388 wrote to memory of 284 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1388 wrote to memory of 284 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1388 wrote to memory of 284 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1388 wrote to memory of 284 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 492 "C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 540 "C:\Windows\SysWOW64\msq23.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 528 "C:\Windows\SysWOW64\msq23.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 532 "C:\Windows\SysWOW64\msq23.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 544 "C:\Windows\SysWOW64\msq23.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 536 "C:\Windows\SysWOW64\msq23.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 552 "C:\Windows\SysWOW64\msq23.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 548 "C:\Windows\SysWOW64\msq23.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 568 "C:\Windows\SysWOW64\msq23.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 556 "C:\Windows\SysWOW64\msq23.exe"

Network

N/A

Files

\Windows\SysWOW64\msq23.exe

MD5 fe14ab6cdb298b93420e2a6b295134fa
SHA1 7f9eb898131984e7227f492e22a6e447f5c688ff
SHA256 32e0aa84467fbe642c7ffc3b0096828c6c93937b8fe3cf95c4f0fe232c896e4f
SHA512 55be76409d535efe0744a86bcd81e869f8b6ce62b98b11dff9d75095546e68bb1aeb1402efa1f44297d6f1cd7b1971cd1cbd0a904672d2e2a170d0c671b2ba9d

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-21 01:12

Reported

2024-04-21 01:14

Platform

win10v2004-20240412-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe"

Signatures

MetaSploit

trojan backdoor metasploit

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File created C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A
File opened for modification C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4664 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe C:\Windows\SysWOW64\msq23.exe
PID 4664 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe C:\Windows\SysWOW64\msq23.exe
PID 4664 wrote to memory of 1840 N/A C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe C:\Windows\SysWOW64\msq23.exe
PID 1840 wrote to memory of 3816 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1840 wrote to memory of 3816 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1840 wrote to memory of 3816 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 3816 wrote to memory of 4920 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 3816 wrote to memory of 4920 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 3816 wrote to memory of 4920 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 4920 wrote to memory of 4352 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 4920 wrote to memory of 4352 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 4920 wrote to memory of 4352 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 4352 wrote to memory of 1236 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 4352 wrote to memory of 1236 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 4352 wrote to memory of 1236 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1236 wrote to memory of 3820 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1236 wrote to memory of 3820 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1236 wrote to memory of 3820 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 3820 wrote to memory of 516 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 3820 wrote to memory of 516 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 3820 wrote to memory of 516 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 516 wrote to memory of 1548 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 516 wrote to memory of 1548 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 516 wrote to memory of 1548 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1548 wrote to memory of 2944 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1548 wrote to memory of 2944 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 1548 wrote to memory of 2944 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2944 wrote to memory of 4904 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2944 wrote to memory of 4904 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe
PID 2944 wrote to memory of 4904 N/A C:\Windows\SysWOW64\msq23.exe C:\Windows\SysWOW64\msq23.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 1148 "C:\Users\Admin\AppData\Local\Temp\fe14ab6cdb298b93420e2a6b295134fa_JaffaCakes118.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 1116 "C:\Windows\SysWOW64\msq23.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 1124 "C:\Windows\SysWOW64\msq23.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 1128 "C:\Windows\SysWOW64\msq23.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 1136 "C:\Windows\SysWOW64\msq23.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 1140 "C:\Windows\SysWOW64\msq23.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 1132 "C:\Windows\SysWOW64\msq23.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 1144 "C:\Windows\SysWOW64\msq23.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 1108 "C:\Windows\SysWOW64\msq23.exe"

C:\Windows\SysWOW64\msq23.exe

C:\Windows\system32\msq23.exe 1156 "C:\Windows\SysWOW64\msq23.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 14.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 11.179.89.13.in-addr.arpa udp

Files

C:\Windows\SysWOW64\msq23.exe

MD5 fe14ab6cdb298b93420e2a6b295134fa
SHA1 7f9eb898131984e7227f492e22a6e447f5c688ff
SHA256 32e0aa84467fbe642c7ffc3b0096828c6c93937b8fe3cf95c4f0fe232c896e4f
SHA512 55be76409d535efe0744a86bcd81e869f8b6ce62b98b11dff9d75095546e68bb1aeb1402efa1f44297d6f1cd7b1971cd1cbd0a904672d2e2a170d0c671b2ba9d