501efb1429c4d68046923415498fa63dad3bfa025975efd561326512da2c0901

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65dfd6e1cad3f1fbf488ae3d28a2473f_JaffaCakes118.html
Size

47KB
MD5

65dfd6e1cad3f1fbf488ae3d28a2473f
SHA1

5e6b1242485e8a80c968061481316d69beabe10e
SHA256

501efb1429c4d68046923415498fa63dad3bfa025975efd561326512da2c0901
SHA512

6ff372ca95d1432be34a925318e77b8382fcf8a55112203d6b5cc80620f328cae590d734ff82507edef84207f04faac3e280eab5f15f430075458459cf09c160
SSDEEP

768:m5BnI/jIpVjTo35BJyqCH4X0XVy/rGH5392n+6u3g90KAL7AT:8BnI/jIpVjTo35uqCHg04/rsg83g9EIT

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2916	msedge.exe
2916	msedge.exe
2012	msedge.exe
2012	msedge.exe
2732	identity_helper.exe
2732	identity_helper.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2012 msedge.exe
2012 msedge.exe
2012 msedge.exe
2012 msedge.exe
2012 msedge.exe
2012 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2012 wrote to memory of 4460	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4460	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4928	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 2916	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 2916	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe
PID 2012 wrote to memory of 4496	2012	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65dfd6e1cad3f1fbf488ae3d28a2473f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbd5146f8,0x7ffdbd514708,0x7ffdbd514718
2⤵
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,12096301444519647053,387255424811753649,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
2⤵
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,12096301444519647053,387255424811753649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,12096301444519647053,387255424811753649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
2⤵
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12096301444519647053,387255424811753649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
2⤵
PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12096301444519647053,387255424811753649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,12096301444519647053,387255424811753649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
2⤵
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,12096301444519647053,387255424811753649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12096301444519647053,387255424811753649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
2⤵
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12096301444519647053,387255424811753649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
2⤵
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12096301444519647053,387255424811753649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
2⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12096301444519647053,387255424811753649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
2⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,12096301444519647053,387255424811753649,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5660 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1948

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize
330B

MD5
34568d70e8fb8a6adc964ad267bb31de

SHA1
30ac2c9e8e792b8e894bff3300bac0c27b01fe80

SHA256
530bb281c43aa025fc0d3553c2e64ede5cb8f6944a22ead3b17e4f4749925f4b

SHA512
ce0d6028f2a16db08324fe6960c66392a23af367529b886cb8322ae400899af68018865a6208c15a82832e61d23990be39d992c1a3fddbe478b1f3a4f838e97f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
331B

MD5
506c9f402de7c76d86d3933f49bee1bd

SHA1
1fe899827c151cb5588270199e3dba4136586fe4

SHA256
7dc37974204bf5607b38381d519a7cb99e8d65f65099a031ed0dc024e4cad15d

SHA512
e5692c28b4ddb72760ac76f6fd9b2585226bd5a867f6a3ca79996f38a3efce36a5b87b30a4bca660d440bd1fcb6bda57167a06c0cd8ba981483dec681b09c6cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
fff26cfd9da50ace304168d01c8969ba

SHA1
fbaa0af25ff13f665bc30903ce1fd3cb2ab4a9b3

SHA256
ceca555adf9313abe93bedd78ba9d4474ddad547c6625683f3b4be5ddf29f371

SHA512
9adb893cd0dd361283443c54808f0da74c139133ec59b3a645233503548a06c5fa9967565044bcf1f627a4eed62965b1329c6ab164ea5ba1529b19ae57f63844

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
dfa3ec034462fcf8f4cd72525b0d49f8

SHA1
3c989dd672dd3a3bbe37c5b1cce1faef51105b16

SHA256
3301b271cd751aaedc33561a105cd8489256d6328863acb08c43fe43102ce658

SHA512
4102e82dcfd204aa018a451de807189e28653bc319ebe57d7b7f3d23e3fead47f384f4d2fe0b86639c8dbfaf8d390b78f4af418d3f8e6076610a65569725501e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
372f8a26a06f97e00299635ae84b9e68

SHA1
9dd3c59328bc4ddf9019df21f3ffee6684f7dcae

SHA256
832a8afa75279d2cd6c677de1b5d4643d06f9e202f2321aee445a355ca0451e0

SHA512
f77c3665d36a5f1f44c70ce5621d8614bd67a8dc1584a794b96c4039fdfcabdcd84b7eff0d861ff484a1be3d42d31a5c863d429934d98b0039f1759707f8d6ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d0355634cea713dd60d287c2046ec213

SHA1
247809dbd54a8fae234d4b9162a615cf11c02595

SHA256
0303b791df79ea536890e379454fbf60287a0fac23ee85540751fbf40527d9ef

SHA512
b6d56883f3c04dfc4a5702460849798bf4feb5727b9e7b27db51332c343ab3aaab9e8d406b37cde7d2f84ee4facd8e471a2d96bec0db971a811afb275f8b6ae9

Download Submit
\??\pipe\LOCAL\crashpad_2012_FWAXKFTPBAKPBZDI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit