Analysis
-
max time kernel
145s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 00:52
Static task
static1
Behavioral task
behavioral1
Sample
8c6059c61fbd01607e1a2d26e8def73f_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8c6059c61fbd01607e1a2d26e8def73f_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8c6059c61fbd01607e1a2d26e8def73f_JaffaCakes118.html
-
Size
142KB
-
MD5
8c6059c61fbd01607e1a2d26e8def73f
-
SHA1
cd24bf68224ed5c8e8a31087acebf614d5a930b5
-
SHA256
cf3a958d8e5475f22bad2334e93fc46d1c16033e24d8d3817fc92234d8053558
-
SHA512
4a40c7f6325283b3ca70689b275a7d034de15a102ca6803a9f8e58c111a092b2716b1c4c5e9608a242dde0cd1fb7ccced48198f188cd62fb891056a6e091bb7b
-
SSDEEP
3072:IV2FAHuiV2zhoxrObymfB3RjgXTBB5Sg2GfP4SNWXqqiShZXPzTWdWzGD:vAmfB31uBB5Sg
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2004 msedge.exe 2004 msedge.exe 1444 msedge.exe 1444 msedge.exe 1332 identity_helper.exe 1332 identity_helper.exe 4824 msedge.exe 4824 msedge.exe 4824 msedge.exe 4824 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1444 wrote to memory of 2436 1444 msedge.exe 80 PID 1444 wrote to memory of 2436 1444 msedge.exe 80 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2620 1444 msedge.exe 81 PID 1444 wrote to memory of 2004 1444 msedge.exe 82 PID 1444 wrote to memory of 2004 1444 msedge.exe 82 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83 PID 1444 wrote to memory of 1228 1444 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8c6059c61fbd01607e1a2d26e8def73f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7fff739b46f8,0x7fff739b4708,0x7fff739b47182⤵PID:2436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11607957395690394036,1986082549512742598,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:2620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,11607957395690394036,1986082549512742598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,11607957395690394036,1986082549512742598,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:82⤵PID:1228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11607957395690394036,1986082549512742598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11607957395690394036,1986082549512742598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:1832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11607957395690394036,1986082549512742598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:12⤵PID:2944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11607957395690394036,1986082549512742598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:12⤵PID:3040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11607957395690394036,1986082549512742598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:82⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11607957395690394036,1986082549512742598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11607957395690394036,1986082549512742598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:12⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11607957395690394036,1986082549512742598,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:12⤵PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11607957395690394036,1986082549512742598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:12⤵PID:1152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11607957395690394036,1986082549512742598,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:4724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11607957395690394036,1986082549512742598,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4712 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4824
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3220
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
Filesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\73a4c568-69c2-45f5-8c96-dddca60b1f31.tmp
Filesize1KB
MD51a1d1410b4bc9180ac1757739c914ac7
SHA1ab470284fcd04e3e55b1e8cf53516cc282586965
SHA2565c10f861dc50c044421b882f36c589c7da514a6753dfef28007d03ed422be904
SHA5123d768bd98c3f44748a469561cbbf2a7e7a909736589eba5375046bbebe45e3c7366bfa08bbe43fc9775824f8f7403b7decd0b1293417067216176eb743445681
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize192B
MD58c00792d7ddd8392b5f676eb716ac103
SHA1e070c6a56148f2256a130bfa5d7639b34c57a017
SHA2569f2bfc3476e5dac69656a758e9741252846998104d57b308516bf0a8f9c844e6
SHA5121d002a2f0a8d3a4ab0b59f1e7341d9fe7900577c1476b630a89841002619a6742e1509845119ddaf3847bd917963435cf0f952f5519e96b75f316f6c57369c1c
-
Filesize
875B
MD5b1c2098645faadc003aaf4b890d238a2
SHA19c9e2b4fbc5425455a10713ba870939009d5b9f9
SHA256ec5ccfa94e16a7c5381876281e4e0de58f589626fff23d76f11aaee88ae1c9ba
SHA51232c69fa12ba27d72afa1c700e99a0fd7ea1f4931439fbe3b74cf2060d99829a57bddeb49c734f99254aa06b7289d700cd1a1aa9ea7dc44032d1fdea184e87c5f
-
Filesize
5KB
MD54a1061ce0cd9362d17de465e2cdab014
SHA1fd96936a73a293f594a79ad347e904c07ae305c8
SHA256cfb841fd76f4e2a8b37c205a8b2c668cac673dcbc8e7a0e2c2bc6395042d9040
SHA5125ac96c2f24a91143396609293c06f925a8926ffb72545f61bbb65759038bb8644d143eeb9b5dc8a4ae175c893222360bae65306345783673c6db2d74ed94e2c7
-
Filesize
7KB
MD5af2af40c434dc1cea700dcfe9a5c1145
SHA14b109351f47a4c607d3f0a1d138b0dfecd47e3e4
SHA2560c4da0548d74a90a85546aa9e288068db36ad0662506f88e7d99e2ea1e4fa265
SHA512930dff416583f1a6ea12cefb1f9a8677e4af4297ee8f2bc3b6f9eb37398d07c6064b1972c5164353f7563134a2cea8634d6ac6cc661d4267bf2591d3df083a66
-
Filesize
6KB
MD560ba8ed10ce0829b6ef39a84d2259583
SHA10dc4819d056b9b0339c8b0d0cb7fd98e0a5c9d23
SHA256d1f3b061ecf3ae31704c805fb6df67a8517b12dcce4162427b9e561768a26f26
SHA5126c7f1ee69ec630a9f5dec0cf6d5f6bbff3c482eb6927c1f64b34dbf814c7ad6aa4d59c5f7483a9757f6f1e2cb5d0085941e049949c50f98db0bbe9bbd94aa9bd
-
Filesize
539B
MD5c6a4404b18fb98012e9ceddacba9095d
SHA121e81dd237d347f976f5f9b14a23bc15da8bd132
SHA256452358557c28c61f876ee02694aad97d708c8963854cd8b1d11cd05c337a811b
SHA5123781eaa6ac895486cd9733a67d0d601bd666afdd5d6d4b9203568adccc255d89ede08f3785da2900287e1ec720f0d28b94826df92b0ce0f19e3a8b92a5a79376
-
Filesize
204B
MD5b9ffe3f0a4f5d606bf3d2087042c79ec
SHA1f7a33d45d22bbb6ad7420eede7ec43ec3ac890e6
SHA256fd803943b4820cf9713e0f93420a2f2cfbd63ba3535e1a0c2e9c65c39cd2b19b
SHA512a14b060695f7cefa0b17369b7e492be35f6ba51f4d35be1ee407ee20d9be33f621d2ba8a26affb2687847969fa68717c0b6d171c4d15da59c3b60569d43df046
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5c37203cab48ae2d520581c2c1bb1b3a2
SHA16df8059734fb39e437c01003fc2b8e4f8c8b73a1
SHA2561b5310d887edbde36cf75655307b88b3681c5258fa42151afdef1d36282a216a
SHA5126ea01ff103710f52a54b51a30c6d2c626743791758e3192b6f92ca60fe96d19a9aef31d1f9fd56daa200119d754dac034f476eca74edaa36a36e98e651c90063