Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 00:51
Static task
static1
Behavioral task
behavioral1
Sample
478437e8dd2332d6975c04d551d362aa_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
478437e8dd2332d6975c04d551d362aa_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
478437e8dd2332d6975c04d551d362aa_JaffaCakes118.html
-
Size
57KB
-
MD5
478437e8dd2332d6975c04d551d362aa
-
SHA1
e48f971780de0260e33f266e6dafbe33a2770b1a
-
SHA256
2e4b2ecd987e2b1e8fbe71ffc28da2650feac2b5a7ed4ab313f38e21b85808a4
-
SHA512
73cfd87cad706f1949826a094aae5369bb9f59a038ffd9d4f0ccb0c76e9e90ff782ea80346ef02e7327bc5bf4d232f2a0f58d5108b3d80140bd487122dbe33bb
-
SSDEEP
1536:ijEQvK8OPHdVgwo2vgyHJv0owbd6zKD6CDK2RVroHMwpDK2RVy:ijnOPHdVe2vgyHJutDK2RVroHMwpDK2m
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4564 msedge.exe 4564 msedge.exe 4860 msedge.exe 4860 msedge.exe 3760 identity_helper.exe 3760 identity_helper.exe 4780 msedge.exe 4780 msedge.exe 4780 msedge.exe 4780 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe 4860 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4860 wrote to memory of 3028 4860 msedge.exe 83 PID 4860 wrote to memory of 3028 4860 msedge.exe 83 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 3112 4860 msedge.exe 84 PID 4860 wrote to memory of 4564 4860 msedge.exe 85 PID 4860 wrote to memory of 4564 4860 msedge.exe 85 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86 PID 4860 wrote to memory of 4720 4860 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\478437e8dd2332d6975c04d551d362aa_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4ad746f8,0x7ffd4ad74708,0x7ffd4ad747182⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16039633846367976397,16375967911220711895,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵PID:3112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,16039633846367976397,16375967911220711895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,16039633846367976397,16375967911220711895,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:4720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16039633846367976397,16375967911220711895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16039633846367976397,16375967911220711895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵PID:1424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16039633846367976397,16375967911220711895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:12⤵PID:960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16039633846367976397,16375967911220711895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:12⤵PID:4988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16039633846367976397,16375967911220711895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:12⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16039633846367976397,16375967911220711895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:12⤵PID:1244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16039633846367976397,16375967911220711895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:82⤵PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16039633846367976397,16375967911220711895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16039633846367976397,16375967911220711895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:12⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16039633846367976397,16375967911220711895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:12⤵PID:436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16039633846367976397,16375967911220711895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:12⤵PID:616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16039633846367976397,16375967911220711895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:12⤵PID:1068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16039633846367976397,16375967911220711895,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6840 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4780
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5096
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:8
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5584971c8ba88c824fd51a05dddb45a98
SHA1b7c9489b4427652a9cdd754d1c1b6ac4034be421
SHA256e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307
SHA5125dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726
-
Filesize
152B
MD5b28ef7d9f6d74f055cc49876767c886c
SHA1d6b3267f36c340979f8fc3e012fdd02c468740bf
SHA256fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37
SHA512491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize768B
MD533e26ce16dc8545610997d5e1776a7ce
SHA18817c46bac9ac7371e931f598bed3d5dc078596d
SHA256ca252b5b28b9817cc3ac1a2eb13ca21ae124f9e6e5f83e4565a9a6a45559c1f2
SHA512101d071072dde02769dc54ece0081eefca9e3525ab93d75e0ea62e07f2df1d86d137cb56278245d43f7a225c122a65a327db5223a8fa575c6d967d6604b5bc69
-
Filesize
1KB
MD59f97cdcc2c6914fa7bcec51886fe7017
SHA182b6a5f284ef5294166d7fb76c4de0ece801bcc4
SHA2568d845ce786974e42ec400c9d84cd03663ad18da7ff3718c399fb5b6b4bc13e06
SHA512a6fd0b8e852e99e263c1c0ed8f92f609d59f6e32f0138a536f7a9f4be8b30210446cca8037be542ed69e53cb3db4aae98803412413f7b5af3f3252083a66ea53
-
Filesize
7KB
MD55f49f2d30f7a36ae4e9a663a75683133
SHA1e2367e04bfd32b2b77776296002217c02598afd4
SHA256585ce3c7e94aca85dbe8fd3eb3e4c96fcfaae8dd858fe1a6e39fac1850d3120c
SHA512318a8b8adc75f6d9f95ed46225f2e21316f4ad364fd21daf0192207f939de3ed1d408a5be8108094dbe80166104be35afc65bd68f49519d42c63c9efd07ecef8
-
Filesize
6KB
MD565e4d0a0ca28d62936c7b3920ec0fe51
SHA16c68dcc69e25a85c0ccc68692d24e6c179831d20
SHA256b3e863698c1acf1ea66553beb988d0c04426b49815325a898b4755107839f64a
SHA51211282d872250d1a101345da57e0e1d674fc575c053789af1eea061fb699dba0dc26e36e9f86df95406e46b296e375cb9670da24da4c084ff31241899c8e3c301
-
Filesize
6KB
MD58e3399c8a441caf9e2ce988e95d4bbfe
SHA1be9df42780568f998edf687318f33d354c5528fa
SHA256ed0e7b53ac620d0adab3f2fc42c37bf84bc18a5cdbcb4bdeda5dc128c5a0bd68
SHA512bb3ac09730be0c41048b814045028f5df1ffcc9d59510d6470811a2afa690a9a9399a9cd7fcd86c0b5437c391b711be98c66bdbc0a5c4e1b06ae1affdf635e03
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD56480503b4b312694ca30d351a32ffc10
SHA17610da4f564867fd1a0c2e4b0280b862120c0218
SHA256d17af52079866516119ea143451987ad8aced5bfdf636b3e7e0f17471645385d
SHA512869cb0c3eaca730ea18a59aa5cf462eaecc23663c45b79f07fae9461480918cefa7b1dcfc5c0b4a22d41941b64c288609a811202acc847578ec2eb22343399bb