Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/10/2024, 22:18
Static task
static1
Behavioral task
behavioral1
Sample
2648e0e58e09b168a1e41a7b021969a9_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2648e0e58e09b168a1e41a7b021969a9_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
2648e0e58e09b168a1e41a7b021969a9_JaffaCakes118.html
-
Size
20KB
-
MD5
2648e0e58e09b168a1e41a7b021969a9
-
SHA1
bebb8e840a3ecafb0bb2bddf9470879786d58d80
-
SHA256
626e0c175259991002f9b90d35fbb8b9fdb43e4b0bbd29c605b12880674b21b7
-
SHA512
33402efb0add47c388e98586b9a3521e09160a3dcc493718f6fbc8b4f732a01ef7d652a8d3397bea145e0b60ae35a370755f66ecf2e13ec9b3740b44a3e6f44b
-
SSDEEP
192:CDP20nQBn4qXnjXYXnmXndlzKPEeYm5V7y3DGBvOHPIM7lUndnMzRQSPlMOuKRKp:pJyqzXYWNIYm50GBvOvXUdagp
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2980 msedge.exe 2980 msedge.exe 3500 msedge.exe 3500 msedge.exe 4748 identity_helper.exe 4748 identity_helper.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
pid Process 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe 3500 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3500 wrote to memory of 4432 3500 msedge.exe 83 PID 3500 wrote to memory of 4432 3500 msedge.exe 83 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2576 3500 msedge.exe 85 PID 3500 wrote to memory of 2980 3500 msedge.exe 86 PID 3500 wrote to memory of 2980 3500 msedge.exe 86 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87 PID 3500 wrote to memory of 3960 3500 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2648e0e58e09b168a1e41a7b021969a9_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5f9f46f8,0x7ffd5f9f4708,0x7ffd5f9f47182⤵PID:4432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:2576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:82⤵PID:3960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:1216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:12⤵PID:2300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:12⤵PID:2228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:12⤵PID:404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:12⤵PID:1092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:12⤵PID:3112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:12⤵PID:1432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:82⤵PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:12⤵PID:1696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:12⤵PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2032 /prefetch:12⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:12⤵PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,13128206085417893586,12151799818361217224,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4724 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2436
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4288
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:932
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD585ba073d7015b6ce7da19235a275f6da
SHA1a23c8c2125e45a0788bac14423ae1f3eab92cf00
SHA2565ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
SHA512eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3
-
Filesize
152B
MD57de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1010da169e15457c25bd80ef02d76a940c1210301
SHA2566e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
SHA512e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c
-
Filesize
295B
MD5fe1dcb89d7715e4a587ee66fac64fdc6
SHA14141eabea4910fee885013adafb2023cd682a727
SHA25647b411aab7ed3e02740097a39971e86e70c2d9f31669cd6adde15288632e68c6
SHA512f5e560e9f4e8c58e27c0ea323c90e3f020aded57cedc324e5f96674e77aebe2d3ec6e2564309dc68e71ff23a3ee1ef1229f747390265da69ca5a53c0be799399
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD5b8d8f6c94c7fcb7e0d7cf6a75c0ed37c
SHA1ce0b9b08e0d58bd1a5404b5cea5720c2e2de4911
SHA256de87d76c16ab27d8c63315b0576a703efbc19df8c226e802264ace675f6110b2
SHA512de9a0993cfac8f8565d98fb346b5a41cdb5949fd1cb9c5398d2ebd998e596e072d11fa3ab980e4c435ca02df4af6ddbece6bea3615bfb683e0ffe80531ffd76e
-
Filesize
6KB
MD517cc5d43b5e65c5e52756f18cc25d6bd
SHA11abfc7a8e853a71661bd41931ca975b885bd08e0
SHA256bd466b2786d95a814955f46877f41de6ea176024b862dee94981e85bc3a6352c
SHA512d14a2244a56dd995cb3865795ba762fe26a4818f73513528ce63426562ee1595227009f93e0d48d03d4a81a67e561c912e9b1650625e107d1f39509085603ba1
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD55ad79b15dfbc897ee34849db6723b63c
SHA14a5ae601295b4ec30a883ff9a7366658680125db
SHA25670b69b207062f00d61eb893b0638efd77add635aa93d35f485b8df0d4df32a5e
SHA512637225d2a5440e3098a953021dba08fdfc5dccd41bd6af94b85fd33901682a6f45f4d39c366501aa8c00a311558db5f60b200924645c3459bf83045bc04d5262