4be86ec74f3a8bb1240b33e6a641d68768e1c6be3b8d1b34cc556c4a7f22f39f

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

693fbad148eb05ad3f236347c97e1eb0_JaffaCakes118.html
Size

60KB
MD5

693fbad148eb05ad3f236347c97e1eb0
SHA1

88bab1e6e5f164d554f86c9bd5e41ce501ab3ac4
SHA256

4be86ec74f3a8bb1240b33e6a641d68768e1c6be3b8d1b34cc556c4a7f22f39f
SHA512

36fa0e9603b6051570ee96d49749299014ee9c73ed4e77a3d2f00bd1f0b7a9a8afa1c331c9e444060f9f031dc5f00f0c73a3fe6d8eca7af8c946b60a07422cd8
SSDEEP

1536:TZ6dh/AHqYhUjaeesLOx5JDE5urvpqbMN2b3RqV2Nob6JPgG7ZcUakJ86ZI1uL2c:TZ+4xPgfo2Nob6JPgG7ZcUakq6ZI1uqc

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2184	msedge.exe
2184	msedge.exe
2964	msedge.exe
2964	msedge.exe
840	identity_helper.exe
840	identity_helper.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe
5496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2964 msedge.exe
2964 msedge.exe
2964 msedge.exe
2964 msedge.exe
2964 msedge.exe
2964 msedge.exe
2964 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2964 wrote to memory of 3824	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 3824	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4548	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 2184	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 2184	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe
PID 2964 wrote to memory of 4732	2964	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\693fbad148eb05ad3f236347c97e1eb0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a1dd46f8,0x7ff9a1dd4708,0x7ff9a1dd4718
2⤵
PID:3824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12997128158972032442,17771455373510951174,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
2⤵
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,12997128158972032442,17771455373510951174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,12997128158972032442,17771455373510951174,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
2⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12997128158972032442,17771455373510951174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:1772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12997128158972032442,17771455373510951174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12997128158972032442,17771455373510951174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
2⤵
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,12997128158972032442,17771455373510951174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
2⤵
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,12997128158972032442,17771455373510951174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12997128158972032442,17771455373510951174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
2⤵
PID:1736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12997128158972032442,17771455373510951174,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
2⤵
PID:64

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12997128158972032442,17771455373510951174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
2⤵
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12997128158972032442,17771455373510951174,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
2⤵
PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12997128158972032442,17771455373510951174,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5172 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
f3286030c06264b0661154003067bb85

SHA1
1663bd3d5b9e917ba8cc0cee17fb6184bee34dcb

SHA256
3b65c7440ab115f2e370be459cc917da507ab65178d327e8a6e975252227f044

SHA512
2213f2fe1ed311177f64980bc948df862a1f2bef9fff44d15c47573ffeefa5cdcfbf196fc4354b5a936d05b1f20e7e30ca3779e5908228d4a828e53949fe065f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
925B

MD5
c0527607a308540796b30f072628db93

SHA1
7d8d3e61cb28e4bce495fafc21fd2f68ae9f0834

SHA256
497946c73a97a3dece6a081f152b7a74332fd78ad3804c272df2ed999350a61c

SHA512
51643f3bfbcc8a8e6fdf7e77bcd46279c0253a80ec412765d163b6558330e820016d1be9e46d05cf4393c494e19a20bcf98b03423f621309ec4b247acae5c1ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc50bf7a3568f187d6d19de499087714

SHA1
9c87e7a12460e3a7c67272c4713c003705a0ff66

SHA256
8b5d90d9be71ebe4a44ee83f96cf3d3adbe7ad4ba55fd6da6e837d50aed071c0

SHA512
1f0b6fc65b0090e5d4053c3e1308966d19e21301e0bcdbd45f15b862735de885930f078277e58eea95b44a52c60570cb3c1c13561b5b92a98e2dd68a35a60c60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
01f80a784c12806df723acb63326943c

SHA1
5f08d016a247e9f103c136f4460358f8a6f41bbb

SHA256
0b75ba5b135729d08486e9f08242ef5bfaa49f1ef2c6595d8db3930f79a93997

SHA512
72d346a08121627e0aae619f85500e18ddfd730780a4b27b41eb7450a685962b9278351105d374022b76b9de19af48b64ba0ca26b2e0de40dbce462b2620e102

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7dbc763bb77ab8dcb3a9934b3d30f671

SHA1
024f8d8ce9c5d49a523a3deac91f902b108dac64

SHA256
32bb6a69dd566eaf96c8f594ca44c0f9b500f3391eb884b7b04c77c34df7521f

SHA512
e3bffaf8dca5a6934ee5ab7fe37af0a3364e2a0405a448b95e2577d049f81e15f193290aacfc21ff6f58db8b185811dd47a70a65f61c056b977a020f1307f1af

Download Submit
\??\pipe\LOCAL\crashpad_2964_IXLVBOPBVLCZYWAA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit