ccc652e4c9265b17a9a2358c4bc947bf546ad41280f4b678d83c701b9dd1f8ba

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2024 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9481c45562ed36eeca90d441c9b7066a_JaffaCakes118.html
Size

20KB
MD5

9481c45562ed36eeca90d441c9b7066a
SHA1

32d59732b204f12debc87b6f3b58134f3d2e86e1
SHA256

ccc652e4c9265b17a9a2358c4bc947bf546ad41280f4b678d83c701b9dd1f8ba
SHA512

57542fed9d4b0e43a553a802f74bfdfa8b18f0b26e621dde52a06384f1ef54917a54c4cc816f31eae26142c067d0e6dc869616b326998f9806a8307a7d478622
SSDEEP

384:xrGKde6u+7Ede4qoypD99vn4QcdvvSlcw:xiKdwddXqoy19ln4QoSCw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe
4524	msedge.exe
4524	msedge.exe
640	identity_helper.exe
640	identity_helper.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 1432	4524	msedge.exe	89
PID 4524 wrote to memory of 1432	4524	msedge.exe	89
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2564	4524	msedge.exe	90
PID 4524 wrote to memory of 2976	4524	msedge.exe	91
PID 4524 wrote to memory of 2976	4524	msedge.exe	91
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92
PID 4524 wrote to memory of 2304	4524	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9481c45562ed36eeca90d441c9b7066a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc538f46f8,0x7ffc538f4708,0x7ffc538f4718
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,12540207310907185090,2411449825414655956,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,12540207310907185090,2411449825414655956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,12540207310907185090,2411449825414655956,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12540207310907185090,2411449825414655956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12540207310907185090,2411449825414655956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12540207310907185090,2411449825414655956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12540207310907185090,2411449825414655956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,12540207310907185090,2411449825414655956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,12540207310907185090,2411449825414655956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12540207310907185090,2411449825414655956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12540207310907185090,2411449825414655956,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12540207310907185090,2411449825414655956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12540207310907185090,2411449825414655956,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,12540207310907185090,2411449825414655956,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
df503aaa163c13a80a8b9f9abcc1ba2c

SHA1
c3e514c4bc22b9f9161e1e0077ae24f3f3253efb

SHA256
da40fed54a8a0fb36a2e6d37f4d7b12f7949725fe29fa8c211023ffb0dd6e102

SHA512
3b0dad9257fe1cd606de1484658da70175b608f2bd32d34211fb95a4a2856dae235f840bf20aa2209653e7f25a7dcad25ef39b1272640aa97ffb8b810198edca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
05b4120c6be628dcf4755241a81392cb

SHA1
1aeed9b337f939b1b7a420c21f03179c3870acd9

SHA256
2554a9153a4d88b61793237cdb8b2a5c7a4fa6dd64025dbe32592c8ed5561eb3

SHA512
3ef92d571797ab223ac9061256d8f72b2a7037afb8e24bf9cc94125fe9d024e7923528ec5a082bb88cc1780c8625fdc4d1de17e503b01fa89059166c8d82211c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5dca41e4-b144-46bb-99ca-6af942f5605a.tmp

Filesize
11KB

MD5
fe95413aaca795e5d1d836e69e19d1b3

SHA1
919282dd1a29bcc668d7390e1a78af32a24e13dc

SHA256
397cc3c97b56f1cb3f5569d1eb70a3ce3a207f6a3757e631f2e5c8b236e7506e

SHA512
fac602fe74f05ce115ac95272a27fa3e9858a439e53407e2df6edcb0e98f1d08e72586f01bbc91cf8b3744937e554209905116a10e55983f33df9a47dd2cb6ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
928B

MD5
01511d255724b6e55d8be12dfe4ab851

SHA1
8fcdabaee00f6d77a94e5a757b82259bb69d19f7

SHA256
ef93dff865d6575d70af23a20a8d799747478461de46aabb588a889c9419a72d

SHA512
2581182dd640607d415f13d96ff39a76e80f8baea7365035c1b7cdb473b7602821e56999b2a15b76a5f3f490d8874097270a26323f05e0d3c74260547e3bf215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b89cac4d8e8f11c792602bb15b8fc1eb

SHA1
a5cea1092e042880c31f18faa229558ebe7b9012

SHA256
e8f4c5632f8bb169a3641def8afbf43259033088d636385d6b73eeb9f396f8ee

SHA512
72365bc347a2f9f37bfc4ead6ac11dae0014af18de4c4954623c87b32fc8cc230175f017947e4393484789e98b62182ba705367c91fce24f55c5e7c1f5ca357e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
37c031def4c2d643188f4dc3c6040379

SHA1
fa18b6e3ba400fdcbd3cf1d3f6341cddf3805a67

SHA256
97b9c52f8cb59c6e70f4919bc5edf6c8980119a6e59d643ffe8f9cb2d6cb63d9

SHA512
67a9da1b3e19ddcda189f8ad01b0cec43d917934dbce54bb63b24432ec1fc9375c5bd4a6180839eb4adc2437557faf25b7b8c831c78eaa9e5cc513aeadff9eb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit