hxxps://github[.]com/Just-Taco/tama_lootnpc/tree/main

Analysis

max time kernel
25s
max time network
21s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Just-Taco/tama_lootnpc/tree/main

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
5108	msedge.exe
5108	msedge.exe
2528	identity_helper.exe
2528	identity_helper.exe
5340	msedge.exe
5340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 2212	5108	msedge.exe	85
PID 5108 wrote to memory of 2212	5108	msedge.exe	85
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4024	5108	msedge.exe	86
PID 5108 wrote to memory of 4476	5108	msedge.exe	87
PID 5108 wrote to memory of 4476	5108	msedge.exe	87
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88
PID 5108 wrote to memory of 1828	5108	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Just-Taco/tama_lootnpc/tree/main
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabc4646f8,0x7ffabc464708,0x7ffabc464718
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,7805239813131344561,7433038471799438633,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,7805239813131344561,7433038471799438633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,7805239813131344561,7433038471799438633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7805239813131344561,7433038471799438633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7805239813131344561,7433038471799438633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,7805239813131344561,7433038471799438633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,7805239813131344561,7433038471799438633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7805239813131344561,7433038471799438633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7805239813131344561,7433038471799438633,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7805239813131344561,7433038471799438633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7805239813131344561,7433038471799438633,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,7805239813131344561,7433038471799438633,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7805239813131344561,7433038471799438633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,7805239813131344561,7433038471799438633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\13b7df79-0162-4336-a2fe-b015ec3208d8.tmp

Filesize
10KB

MD5
680a0e051a3d5abfbedb2004520bbf90

SHA1
4d28365445f9611aff0abc1ef751819f8462e91e

SHA256
f6bb9249e930660f680cc5e61a57f92123c0b126acc403cdc2dca33717704254

SHA512
c380fab22c230d50598262b8f69ec07e6cfad23b9662ea1f63daae85df43c1b8fcaa7193ae2105160be2c10a339170b5fc545b764337f89b37a1f077d193156a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7a83815fb18f1e52e74ecddbfc90571a

SHA1
d2395f29478b090e4b4e95ac18f026d3a5f3f5b5

SHA256
567536db638ce360ca3d0bc5b5b10b0938d97342033dee81bd194d6538c3d483

SHA512
051724024ba9750547f026e78bb0df2eab718cbdade16303d186f0487785f29cf90a637f7f34d97dc80c4130fe86b8ed20cfbe1ce974e11de4a015d2aefa863e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a0d75be826102712b6618606c0fcd9c1

SHA1
fde4dab1c0300517be5f3cf9e4bec4e6503997d5

SHA256
a59b6722c42fc8312dd0ae2c21e4e90a260cf80ff721014d8ead0fdf524f1f74

SHA512
2cbaa9c0c8b76ac8c342342b7372eec02f53bcadde6fed2a36e2c6812165c327c423c69ecfdb05699b4fe7b402e2213f307c7fbe32ae999e3b4f28490dacb793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
75bc36c9bf3fc0fc3203ddb7cffde655

SHA1
891d030037c25935dd89fd9866d02d34174f118c

SHA256
d68170083767989db38603aeb54651e4836ac8922c10c2cd6389d58ec25d26f1

SHA512
9789e00e6e4fd13c58e02ea33cc94af806c0b03ed65fea663137dac5ca64326f97a298666262a7ccef1ce184b4a5e33c6b728b7f437576d8b8716ff5b8863225

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a61bd1d6c4fa4cf29ecb2f26589816b4

SHA1
878f551a5b2b5f2004dcf51ae3d70ca2f1bfc673

SHA256
b91658681e65c0f9137d3377c4c1e485eee7d285e64074df47a0ac021cdb92e6

SHA512
8e24b47df4b527768db1e056dfed54c9455e1034cc038ad60fa688360f6ae8b006434898b8d4ded43d261d5c27f0a2ade41ed2793fdb69b3add334f96aa34b2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5825d3.TMP

Filesize
874B

MD5
2d6eb3028355cec9c09de90be2b728a7

SHA1
978c122dcdf4f952dbd02e66715687c11bb95d6d

SHA256
541a0a364c9e0239271fa248c367cc483db3c38bdf2bc6f51fe348621d5b560b

SHA512
77930583ca62bd18b7df01716ddad2595d37ade12e1fde362549dee5ae72f0400d70d3876a83cca09c3433a628bf46b2f782acbf5af1382656ff50af3ae96abb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\Downloads\tama_lootnpc-main.zip

Filesize
4KB

MD5
2bb84e207776dc96833605cd8914fcb4

SHA1
b32f2956606a066b4129710abf1d39c44b4a957f

SHA256
850a181b630f4fd3323d54272da710cef7b3d01afee1f352e007de9e51fc5f5f

SHA512
6166809fe24c02322f6f8734f91e7f484386fac4f249071c46aed77884ca6876585f8b29b674eb2ede52e174a8f57c26e75a3fb532294e0804aa293f2f0b1c90

Download Submit