85d203e0a41080998316a431f4ce405a08d2f4edf4cfc1cce229999f90f29e69

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe
Size

346KB
MD5

661b15946b8eae5a25c91cba3d2c369d
SHA1

b06de620aaa401f95deca482b971ebb9197cddbd
SHA256

85d203e0a41080998316a431f4ce405a08d2f4edf4cfc1cce229999f90f29e69
SHA512

90975f7ef117e867cf6887d3149e23d647c40402042bde13e81007c2c64e029647be13beab72ae22a0325401a53dce58e3b77019e814f390bcf0744d99f790db
SSDEEP

6144:ye347mvlhNC7JuyKAs8LG9R3HNe76JvML/9c7Cr7Ob+FlbAc:5+YyXSvi2v2ICvOb+Fuc

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	cscript.exe

Executes dropped EXE 1 IoCs

pid	Process
2892	installstat.exe

Loads dropped DLL 4 IoCs

pid	Process
1372	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe
1372	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe
1372	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe
2892	installstat.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\EditPlus\kk21.icw	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1067357776"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f03457b9455cbd409827dac7c6413b1d00000000020000000000106600000001000020000000e45d4e4f53398bcf93b0c576d7780472fb015e66d90ad7091887b3e86bbea30e000000000e80000000020000200000001a868f4436cf9d4d49bd4e7e702ba21d01ac7e7bf57d740a3a756dd55300284f2000000072d03c774349dfc346a64043121755d6f638be52e18da9a597f453cadc57fc96400000005448e83f67f4565e7b9a13b88a42610adaa73155d1463468839144686c6ba9d4769948e78a6bbabb178d81b3870603ae2112750e23b661a2ef4480d1d812e69a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31120575"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1067357776"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1068295951"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f03457b9455cbd409827dac7c6413b1d0000000002000000000010660000000100002000000036138b42e1f23b407563be9a61cb050b906244b28fcad90f0f4bc9df9babfea6000000000e8000000002000020000000bc48dc0ae46225e7148152ae3c789e5b0302885e47130ed42e78e4d6a03da7fe20000000b7894ce3ef23270d28c14a07a23d90b3fd97c162edd82789c97d80b34fed5b714000000008df6f4bf67dac0ae15a77910e67c9ef23be943e9ed880b4a9abd8eb31b261fa85c8924572db6dce4a8ed12b4fced9ac055fb3b87cb223cb156603a52bf3d0a3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31120575"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31120575"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70711a40bfdcda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428476635"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31120575"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1068295951"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90fb1040bfdcda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6B2DE3F8-48B2-11EF-8B18-C2C4E1CFEE77} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open\Command	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open\Command\ = "%SystemRoot%\\SysWow64\\WScript.exe \"%1\" %*"	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open\ = "´ò¿ª(&O)"	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings	cscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.icw	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.icw\ = "icwfile"	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\ScriptEngine	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\ScriptEngine\ = "VBScript"	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2968	iexplore.exe
2968	iexplore.exe
320	IEXPLORE.EXE
320	IEXPLORE.EXE
320	IEXPLORE.EXE
320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 1572	1372	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe	83
PID 1372 wrote to memory of 1572	1372	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe	83
PID 1372 wrote to memory of 1572	1372	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe	83
PID 1572 wrote to memory of 4920	1572	cscript.exe	86
PID 1572 wrote to memory of 4920	1572	cscript.exe	86
PID 1572 wrote to memory of 4920	1572	cscript.exe	86
PID 1372 wrote to memory of 2892	1372	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe	90
PID 1372 wrote to memory of 2892	1372	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe	90
PID 1372 wrote to memory of 2892	1372	661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe	90
PID 2968 wrote to memory of 320	2968	iexplore.exe	91
PID 2968 wrote to memory of 320	2968	iexplore.exe	91
PID 2968 wrote to memory of 320	2968	iexplore.exe	91

C:\Users\Admin\AppData\Local\Temp\661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\661b15946b8eae5a25c91cba3d2c369d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\system32\cscript.exe" "C:\Program Files (x86)\EditPlus\kk21.icw"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\SysWow64\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kk21.icw"
    3⤵
    PID:4920
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2892

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:2308

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\EditPlus\kk21.icw

Filesize
132B

MD5
e058cfbecae7b18539fe0e001ac9155d

SHA1
58eae38055c4da25db4092d2dd921257c3c15ad2

SHA256
80551877522e3e1ed29a0ee2085700676a2a1f037fd183b27cc36e265f3b5d11

SHA512
01193f0e457b993557a0d3ecf96fa2d35a16d748001f7476f118d4ccae392b547696806908ca955d62e48cb85dc4b0c018120431abbc96a0d78d97afd9835be4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
5fe1d5be97aa5a4b444680410010b626

SHA1
0b747d5b13d5745fcc81a5819b2db8e11543ab42

SHA256
018bb27ecbb368115c6dc85539b5d24b0f7d548a3cc81ace6f7fbdc2a5aa55d4

SHA512
b3baa42206a9866e37dbe747a04d82d49e51e8219a8ac51170498cbdb98430a6b3f591151d3dfb133b1734f6fefc62b90efbbb907c800f45e93eae998c009fbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
dcf8844643508d9dd113f712b559c4a2

SHA1
ce31f38745a3eb6a1a2bbc11cda6fbb45b4611a6

SHA256
1361a85ba5ad88a9e330a13c3e45d1300621b434e556e782022c7b3c3bc29262

SHA512
6c32729d83d52058b262abcbd72f631005a20bc6a907524f96c9da7464cf09a26cfa86e2b93be66bda0dc08f738e999459dcb67c069b0632ddd8b1e765e0e3d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verFD4C.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9X9HPJHY\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse8425.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse8425.tmp\nsExec.dll

Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe

Filesize
44KB

MD5
7c30927884213f4fe91bbe90b591b762

SHA1
65693828963f6b6a5cbea4c9e595e06f85490f6f

SHA256
9032757cabb19a10e97e158810f885a015f3dcd5ba3da44c795d999ea90f8994

SHA512
8aadb5fd3750ab0c036c7b8d2c775e42688265b00fe75b43a6addaefc7ee20d9fa3f074dd7943570c8519943011eda08216e90551b6d6a782b9ed5ce20aa6bab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kk21.icw

Filesize
840B

MD5
da4d7cfde3c2223ae1fab9c8dc6d4fa0

SHA1
f3def0894a91f8201858414add0fcec8d9f9ea97

SHA256
1c21b15befb53c4861ee4bf0893b8070a8b58fafe4bf527a938a91f5c4763131

SHA512
c2e2dbd7ac0f2890a7a09f34d8c91dbcdb9ba6e62933b53e5cb62ead6e24b0cfb98ab1cba4caae378609158815b460854a2fe398e4193b3b2210573cedc7cf29

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\statistics.dll

Filesize
80KB

MD5
b485de47dfa038e4fc1b6f1782d07ad0

SHA1
67b68902d56bb7cf1d3292bf152f85572fc53786

SHA256
74ea2288ae1fad84f215ab40b0b9fbc0ae50996fe751fa5d615ae8586d1f4121

SHA512
5558228f6fb0f92eba5035d4ea75e722c227566a4d71a523c517628d1cf4b0e2cfea94495cb09423b21276e0ef568545a3eb628daa7f94a258a8659ed5d6cdd7

Download Submit