47961c394d3b03bd1670e702b2ac59071dc54535657c82772e08e0a2d767b7c4

Analysis

max time kernel
1158s
max time network
1167s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10/08/2024, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

mineways/docs/index.html
Size

13KB
MD5

48e4e0b25120615cb469b8b9d2ce654c
SHA1

d14d2cbe0348ecd84b2547a20cdf190eba94bbd6
SHA256

698f51f1879248471c5955188cf06bf8072979246cbffc360c6bd1d0657c7e08
SHA512

f0ae47afe2e3ae8496bf7c8097d0c74c1891de874ce3e79b7973e573ce415de8ba65ffc8e776f3f9335470e696a3ef9443229677661c2bb7e624e9f830324b15
SSDEEP

384:3KwM9vnQqChUfLx0kl3yu3puF2bcduWZ3c4:bCs2Lx0s3ywM2bVWBc4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
3460	msedge.exe
3460	msedge.exe
4900	identity_helper.exe
4900	identity_helper.exe
652	msedge.exe
652	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 2264	3460	msedge.exe	82
PID 3460 wrote to memory of 2264	3460	msedge.exe	82
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 3132	3460	msedge.exe	83
PID 3460 wrote to memory of 1600	3460	msedge.exe	84
PID 3460 wrote to memory of 1600	3460	msedge.exe	84
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85
PID 3460 wrote to memory of 2952	3460	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\mineways\docs\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdfd683cb8,0x7ffdfd683cc8,0x7ffdfd683cd8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,13272666389384265061,7122633176812109214,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,13272666389384265061,7122633176812109214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,13272666389384265061,7122633176812109214,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13272666389384265061,7122633176812109214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13272666389384265061,7122633176812109214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13272666389384265061,7122633176812109214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,13272666389384265061,7122633176812109214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13272666389384265061,7122633176812109214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13272666389384265061,7122633176812109214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,13272666389384265061,7122633176812109214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13272666389384265061,7122633176812109214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,13272666389384265061,7122633176812109214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,13272666389384265061,7122633176812109214,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
302c3de891ef3a75b81a269db4e1cf22

SHA1
5401eb5166da78256771e8e0281ca2d1f471c76f

SHA256
1d1640e5755779c90676290853d2e3ca948f57cf5fb1df4b786e277a97757f58

SHA512
da18e7d40376fd13255f3f67a004c3a7f408466bd7ce92e36a4d0c20441279fe4b1b6e0874ab74c494663fb97bd7992b5e7c264b3fc434c1e981326595263d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9efc5ba989271670c86d3d3dd581b39

SHA1
3ad714bcf6bac85e368b8ba379540698d038084f

SHA256
c2e16990b0f6f23efdcecd99044993a4c2b8ba87bd542dd8f6256d69e24b93b3

SHA512
c1bc0dc70ab827b54feb64ad069d21e1c3c28d57d126b08314a9670437881d77dba02b5cca57ef0f2aa7f8e7d4d163fbd2c6f246ea2d51ce201d61a89015e8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
e0a8200551e50adb3aa666ee648f199e

SHA1
9e03aef8e73646d70046fd9acf99ad9cb4a37609

SHA256
f5c3e7a617a707641307ca8660c318142f74eb53c7dc7fd54a16e6e720f4f001

SHA512
d998471dfbebbf6261cd71d32da9fe876863498ef5358344fc1f27a758c88f5fa3ab2bcecc47288203de2ee26bebb1f2f2efb2b0b38d444f5dfd299508e84a48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
983B

MD5
dde57923da84230369a670a23527b4e3

SHA1
83b4c03215c008844fe780bf7f5d1685e9098ae2

SHA256
f3a8a593e0be4d470661e19ab64a37e2713e0dab30d47b68b9bfab26a0315e04

SHA512
f93cf635e6dc0ed9a6bddfdf69cca10169b0cd455ebc6b48bb48ebbb3a0e4b9917513c6c2641bcb9d8b303d7b8a35fc5704cef862517393174623af939b2fa14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
77f89ae2040121bd6a7a45fe4f52db94

SHA1
5e422a0a2c20c0c9abcb8b82b1690e8815c58c56

SHA256
4dc4f02b73c9a4543690f117d46e0cf672c2387ad336bc29a33fbea375fbbec1

SHA512
0b71ead84a3686708db504cdcb85696d20e1865f548ff5b5d9f02c8e80f60d83fbde38ac89790f8417c484a1eb54e83f04a4bf1ae2da61c3a364b01f78ec6f58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
60ed5b80f9fc85a2c6f48356b466609b

SHA1
f82d736d9a487ae9e94f1bee3d13d74076b4a544

SHA256
8960b3596554d19bf1f8c0d3e9bd2e29b5dfa06195a37b103febc3ac46179cfe

SHA512
2dc47916c476025a7bb84123c5f7ce0970daa8f23f61388f17165012ffe5deb253cf9a97be3851d1217e40d9780ad7079fa1e09ccfd09f2fa9a8ed29d3b93477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0522e3a72d70061a51a65c82465f7596

SHA1
d8cd0ea6e982bc8bd9f65995fede6dc480f9f887

SHA256
fd4563aa19555e3eb203eba423509a86d99fd12d79a2e15c76a6c716067ff321

SHA512
fb92ac55919c773b39d51d182af5916d7ed17931af2daad73ffac53dde703ef7c7a62abd65faf12b280b4bccb41db8280bddb20ff27664efabc526939e3fb7ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
924fccfe17599300287e23d41d40dd5a

SHA1
b2cd0e6e58ffa7a1b3b3b6e9de00016a3429bfe5

SHA256
97fa627f1a197edde52b8f4b4e82832f8b9284b62a65fbae7cd9f73c0892f52e

SHA512
1245336f6f6713b0bc3d5c710bbe90bd1ecb9249371852949e18fdc387821c302aef938031b5c4ccddcdc49b285a5127b96f3394307fef2e386c2e94a2e77f21

Download Submit