305f80c7408b67df6e4338a32d3c4dfee2cebd565e6d6167fb82ef847c946f96

Analysis

max time kernel
93s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
Size

488KB
MD5

eb859a82dfde6f43dbe1cd97897db367
SHA1

18130a2463452fed079902362b21fe2bc6aeee85
SHA256

305f80c7408b67df6e4338a32d3c4dfee2cebd565e6d6167fb82ef847c946f96
SHA512

7a6d3ed1f68212ecee5e638df4591c5428e01fa190ea77572d23902c546e4114e607d90a469ceabb564a243f030e802e4661a8b7337acd76bed2e92f445142cb
SSDEEP

12288:xeXr/Cm+XQ9i8aMVkUet7EwBI+APu4UjU:xGr/Cm+X18zVkUetVI5u4+U

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image"	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rtnohmqy = "rdkynjlc.exe"	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe

Drops desktop.ini file(s) 48 IoCs

description	ioc	Process
File opened for modification	\??\f:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\k:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\q:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\t:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\i:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\m:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\u:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\w:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\e:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\m:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\p:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\r:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\s:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\y:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\c:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\e:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\g:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\i:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\r:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\v:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	C:\Documents and Settings\Admin\Application Data\Mr_CF\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\c:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\l:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\u:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\x:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\g:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\j:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\l:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\o:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\x:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\f:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\h:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\o:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\q:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\s:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\w:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\p:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\t:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	C:\Documents and Settings\Admin\Application Data\Mr_CF\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\h:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\j:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\k:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\n:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\n:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\v:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\y:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\z:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\z:\Desktop.ini	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\j:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\p:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\t:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\z:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\k:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\l:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\w:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\x:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\g:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\i:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\m:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\n:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\o:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\q:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\v:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\h:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\r:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\s:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\u:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened (read-only)	\??\y:	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 47 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\u:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\w:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\c:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\c:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\e:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\j:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\m:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\m:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\z:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\j:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\k:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\o:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\x:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\h:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\h:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\l:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\q:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\r:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\v:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	C:\Documents and Settings\Admin\Application Data\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\g:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\i:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\k:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\q:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\r:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\x:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\f:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\n:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\o:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\p:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\s:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\w:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\z:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\f:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\g:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\n:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\t:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\u:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\y:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\e:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\i:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\s:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\v:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\l:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	\??\p:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\t:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	\??\y:\Autorun.inf	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msvbvm60.dll	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\rdkynjlc.exe	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rdkynjlc.exe	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Negeri Serumpun Sebalai .pif .bat .com .scr .exe	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3132	1188	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe

Modifies Control Panel 3 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\Desktop\SCRNSAVE.EXE = "MR_COO~1.SCR"	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60"	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image"	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "JPEG Image"	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\ = "Princess Document"	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1188	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
1188	eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb859a82dfde6f43dbe1cd97897db367_JaffaCakes118.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 856
  2⤵
  - Program crash
  PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1188 -ip 1188
1⤵
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Autorun.inf

Filesize
97B

MD5
e0b7531a87635a0a11dbd9edc02c7bed

SHA1
74a50849add50351da332164cbf0ae74a43ce8fe

SHA256
20e16cf8b48b2bf3adc59251e7dc293c39eb87922d267a768a403fb76f13d765

SHA512
e6cbf6e11ad29d17c219ca44ebbcb43adb76bef3d688f38e43520faded492caff162e249bd477f5441858a26eb567c3f70be3cf3cc181a2fb62aaae4efd23c67

Download Submit
C:\Desktop.ini

Filesize
212B

MD5
ca815edf2e481dd83bd0cff16caaf7a7

SHA1
523fa767fac1b4061762c0262d4bc09a1fa7dddf

SHA256
f2566afa47cadf4017f82ee80f11355989fd722fbbbbed1954392bbe2aa2b352

SHA512
cef1cf04432326393cd700b6c9c4d3d816a61505a3ba99bafc935ffd52a78635130a752d091dd6511d9781ac9458a404bcfc69ca0cdec55da418b3b8bf9dace2

Download Submit
C:\Folder.htt

Filesize
631B

MD5
5313060d847a33c356e4e8e286e3de73

SHA1
d2b5e89f1fbb96895371e1cde7997ff76814ea9e

SHA256
ee482ee2540efc03f1cba611170096f68e14fd4d39bdc8650f3ef6900799fafc

SHA512
8c90a8fd5372dadfe95df1deb07bbd14355620dd067b2cce58f76230e2f99129daf65ddc056cab0902ab2b70a4b838a484f62f37b0436e21a963dd1156f551b0

Download Submit
C:\Mr_CoolFace.scr

Filesize
488KB

MD5
eb859a82dfde6f43dbe1cd97897db367

SHA1
18130a2463452fed079902362b21fe2bc6aeee85

SHA256
305f80c7408b67df6e4338a32d3c4dfee2cebd565e6d6167fb82ef847c946f96

SHA512
7a6d3ed1f68212ecee5e638df4591c5428e01fa190ea77572d23902c546e4114e607d90a469ceabb564a243f030e802e4661a8b7337acd76bed2e92f445142cb

Download Submit