df46b0f2717c3ad2d417c26005de25b0be34598ef5a65d8934e2ea40a4ede704

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eacaf1dbbebd5e670d73124debbf04cd_JaffaCakes118.html
Size

403KB
MD5

eacaf1dbbebd5e670d73124debbf04cd
SHA1

e829227a3059df3c297b8e999032325d41bf127d
SHA256

df46b0f2717c3ad2d417c26005de25b0be34598ef5a65d8934e2ea40a4ede704
SHA512

2145b16bf91374f0bdfbdd4a44b7c7842335f390debc576c51c9bb436d9c9cb12839558c6ca0b01f83e65e1d969dcb5abc0ad6fc1ea60ca4844a8adfeee037f1
SSDEEP

6144:nK9YU93GYUCNECNPCNms/CN+C1x1Bg3PeF:varUCNECNPCNhCN+C1x11

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
1376	msedge.exe
1376	msedge.exe
2388	identity_helper.exe
2388	identity_helper.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe
1376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 436	1376	msedge.exe	82
PID 1376 wrote to memory of 436	1376	msedge.exe	82
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 1420	1376	msedge.exe	83
PID 1376 wrote to memory of 4968	1376	msedge.exe	84
PID 1376 wrote to memory of 4968	1376	msedge.exe	84
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85
PID 1376 wrote to memory of 3932	1376	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eacaf1dbbebd5e670d73124debbf04cd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9b8ed46f8,0x7ff9b8ed4708,0x7ff9b8ed4718
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2781086799765757559,1456393503725256091,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2781086799765757559,1456393503725256091,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2781086799765757559,1456393503725256091,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2781086799765757559,1456393503725256091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2781086799765757559,1456393503725256091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2781086799765757559,1456393503725256091,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2781086799765757559,1456393503725256091,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2781086799765757559,1456393503725256091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2781086799765757559,1456393503725256091,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2781086799765757559,1456393503725256091,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2781086799765757559,1456393503725256091,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2781086799765757559,1456393503725256091,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
453B

MD5
96db126da0e78add79f3fd7df9e4f570

SHA1
578c85bb96460340e54c3756fec921c37971e4bc

SHA256
8bce01884369429ceb2c89eee974a92fc4de54293505f61115b5f61a9042bbda

SHA512
9f31ab5df53dcb17b1efd145b5bf9c86c05262f4439c46d3fe188248599bb94edbfef26e46f819acfc1fc3c9c2549f444a0105ec219080ac8e54eb8828e5a24e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
629cf1caf352a146e64d6faeb786843e

SHA1
22241d72f24f8bdc30388c1e1db56a40bc94e1b2

SHA256
49a3318594d7823da1e4e51e0b669671c9061e92cf9232b0451f3f641c7dbef3

SHA512
2a73435b8980fb93e6eb73e2f8cc61b2c6a598b29d997b001395a746989dbc21114ae469a57c49af12415a2077c3b95bc5053e554bee6c94d8091205b2ba47c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
59ea8a29d343e4d1f0de6531a72badbf

SHA1
5e0fcdc8709cdb1bc6c3fe2e93774de84c25c867

SHA256
f4b26b455043cb0ef5aeb65d2914b6fa95b17e9dabc75ebb914ec6669b62fddf

SHA512
3362b7999b8535215d507ed17554dc03e01dda33a3d735499431ddfca4527992d5f24f2c867abaaacf11ae6b298ff0591f2a26d69468de21178070d38bdfd0ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57cc48b5ff48f60968e90b237303a43a

SHA1
5f7de8e6d2c1f547b19fe4f4462c4bed25dc11b9

SHA256
693db80b25edfb5b9a9b88367fb25fa0c5939b53702396e1fc7ce0e472bd1340

SHA512
f47c6265e5ace68e0cf328a40e1e3bc76700206de38c3f44956f4e902b0f0b87ac2211e3be261cb6b6a83fdb9f35e2376e28f9c63cf44c6958efc6e6f87e95c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
540B

MD5
bca10d24e8f5a6655370d51e355e98de

SHA1
31d5f28bb098642b06050284879d7996e001fbdf

SHA256
d2a7b55ffc5bdc92b78dd0a6d8d14da3dbcfbc84cacd7e2a0bbd894e25dd918b

SHA512
fafb7e99f12a80b0b482929fe0af8776936c54089629b479ac7368eeca56fcfb8b0d09c3a4e08e49786b495a617ef6910f9cf51ee031bbfd5b8a9f8640c365ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
540B

MD5
0687e3524b8d605f5f49d924c9455c4f

SHA1
da44cdc3d9f6a1770b25f38aa3de54b62a4619de

SHA256
b0254b1dc5fe6440043fbb865e10e375148ab13d6bb3fb8e98ed5ae5d42cc9bd

SHA512
177212087333a5dfd36c15f5a681895941cddb72e130a0074fe78a277793fbf0734f99e945049fd351b01359ce6392f12d04c92f7affc8f7a7a1b60ccc41d18e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585ce0.TMP

Filesize
204B

MD5
76d29343cdcd4f8d8e6b5e35feb80f88

SHA1
5ed6d681519c2ec0b5a8beb4fb36a6afb2a9a6bd

SHA256
9c92f196f80e03b2266b94948533b5d74d9c7dfab621c3e677b1a7546d6c81cc

SHA512
f558ce8829471ef40531c6b13908aeb65da214544bab75dbe820524bbc5b31186b4d8ccd5952be58e0f4efa37a44ef1d0b1a0c59d9a20738ad67923c1e0e8a79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d88a054db2bb94fe94dbfd598c5f2556

SHA1
bf2f28989c0c8152de76df08b152a48f63ce0e54

SHA256
39a9dae79f0408e0a7cee6bd4950bca0b4ec9ed1157d149c555568563a071c84

SHA512
61faa1c616a97355e2da35c14d23c7513c22512af8195e8f3c5084cd1777bcd30b524e8af72b7e9fefee7182fd75e149a4fc05f96952b118f9b687a0fe8cd9dd

Download Submit