Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14/07/2024, 11:58
Static task
static1
Behavioral task
behavioral1
Sample
45b7128e9b5b5127456e518fea42e9cf_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
45b7128e9b5b5127456e518fea42e9cf_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
45b7128e9b5b5127456e518fea42e9cf_JaffaCakes118.html
-
Size
15KB
-
MD5
45b7128e9b5b5127456e518fea42e9cf
-
SHA1
4b61f407c18aca7c7b6c991f059ae2bacfbdbe25
-
SHA256
92c376e2385d5f0a044389d62b5727b12200f424573e0af42be246f9971cf613
-
SHA512
008137b2d8abd9d014aa29245737e57c2e014f086faf689b1c5111423e546975534244100a6ef65247111f9c52b30cf9c4a6dc07bb3e37773e19cda123e5fe4a
-
SSDEEP
192:wJurhX5jcCgZbP+BdMkcAbfc3DrJkhnMdeSdxa+Y6HYLksIrA7sS3fLClmP3KTA5:wJyrceMkcAD22lMeSdzYzwTkK2V
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4664 msedge.exe 4664 msedge.exe 1240 msedge.exe 1240 msedge.exe 1244 identity_helper.exe 1244 identity_helper.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe 1240 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1240 wrote to memory of 1408 1240 msedge.exe 83 PID 1240 wrote to memory of 1408 1240 msedge.exe 83 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 1144 1240 msedge.exe 84 PID 1240 wrote to memory of 4664 1240 msedge.exe 85 PID 1240 wrote to memory of 4664 1240 msedge.exe 85 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86 PID 1240 wrote to memory of 3620 1240 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\45b7128e9b5b5127456e518fea42e9cf_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8005446f8,0x7ff800544708,0x7ff8005447182⤵PID:1408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3037395996035796522,12764412464051047749,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:1144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,3037395996035796522,12764412464051047749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,3037395996035796522,12764412464051047749,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:82⤵PID:3620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3037395996035796522,12764412464051047749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3037395996035796522,12764412464051047749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:2712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3037395996035796522,12764412464051047749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:12⤵PID:4076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3037395996035796522,12764412464051047749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵PID:4224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3037395996035796522,12764412464051047749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3037395996035796522,12764412464051047749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,3037395996035796522,12764412464051047749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:82⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,3037395996035796522,12764412464051047749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3037395996035796522,12764412464051047749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:12⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3037395996035796522,12764412464051047749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:12⤵PID:1656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3037395996035796522,12764412464051047749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:12⤵PID:3916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3037395996035796522,12764412464051047749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:12⤵PID:3600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3037395996035796522,12764412464051047749,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6032 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3548
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4264
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eaaad45aced1889a90a8aa4c39f92659
SHA15c0130d9e8d1a64c97924090d9a5258b8a31b83c
SHA2565e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b
SHA5120db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4
-
Filesize
152B
MD53ee50fb26a9d3f096c47ff8696c24321
SHA1a8c83e798d2a8b31fec0820560525e80dfa4fe66
SHA256d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f
SHA512479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5
-
Filesize
211KB
MD5151fb811968eaf8efb840908b89dc9d4
SHA17ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA256043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
SHA51283aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD5b33ae86b97eb0f99c5f209ab22867a5b
SHA18b770b96db55d1265ff614edc9cd13b6dca00317
SHA2566c0f2e76dd520f6e0d5a307cfdbcb8ead3285b4dce544cebfedd89add408bbed
SHA51200a1cbfbb99284347b45cdb74b65d2a99b8977e36af74684c10cb717b748d999aa38015689dd6d3d3ce3066e0802a5bce305fd68e2ecba7f2dc20cba1513c0fc
-
Filesize
1KB
MD5e1def45fa5344ced005b150e5cf49919
SHA1351bf5089b04766a7ff96da98f5a2501057a762c
SHA256379407862e0a2781ab4f05cfc1ac154879308c844330748616c8b42c4e568f4f
SHA51202d1e64a599ce6a013c916c76c2ce94af9099fd22313b75826d53ae3765ccc834dc613d01856ad237de45832abb00313711b4fa1689f0fdd166bbb85c1961cb3
-
Filesize
6KB
MD5135e00d9400cacd3f635ee89bd730417
SHA1370f89b86c8bb6ece257f063f2a666b79f1c5f59
SHA256623ba9ed881ecbf61344f956481992f3b2c8a94985a06510d5a9be52f6e9d7b0
SHA5122ffc0a3afd945e4526950d7e0176a632a38421bdaa32440f09a3760ec7073456b376b2536a8059d2ce3824af2b8713433be72742d9edecdec205245c97827acc
-
Filesize
6KB
MD57989677e84c5146c5dc901514fc5458a
SHA1a4b7f56c562278bf56b7706c8e26b7664652da4e
SHA256b9a3ba87790db75399d4108f5c0fc11b2dcad8b96be8ebf78d568492a8d523e1
SHA512e1afaf04a7169c291eabdbad05283c5d32a405a3adc17dbd9eab2a8e7d45eabd9610dd77d1f679558f46d3aab8480859a78b4b119280b74926bfe1922ca241b3
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5a9aca91247e3e0eb7a24230c143502ce
SHA1da16a5d4548af997122e58565f33efc409bd689a
SHA256de86630e905cb309ba51944204eed4e5b6b97d7e3104da5e8e00342e1899282b
SHA5123d55bd20167e2fe9b82b5db307372aad0056bca959f46745fe21d77b46e230517006e3f4a6f55e273ee50c35d7e85c10a8635bae4186aafca98c7dbe47e0f91f