bd134ce98f2304a52104b0747ebb1c1da3efe2921af0b934776df1742617287b

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2effc1380661550604212ed8ef10526b_JaffaCakes118.html
Size

43KB
MD5

2effc1380661550604212ed8ef10526b
SHA1

a6940e190eea05448b765d13af1298916c764d60
SHA256

bd134ce98f2304a52104b0747ebb1c1da3efe2921af0b934776df1742617287b
SHA512

6c9ea4b71776e9e61447636b4e8614e414d35db1d189518e75388326722ff4ffa86dc3fcc90fde11bfda3df5babb4305df972b733708fecf00ccc931ffd3adb1
SSDEEP

768:rvacXuYy/LCYZpnhGoRbF3GhRbpfG+RbV9GXRbW0/uIKm9aenjljHcjwvns8Lhz1:rvDXuYy/LjpngI5swvns8LhzCXcVV/oU

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4616	msedge.exe
4616	msedge.exe
1800	msedge.exe
1800	msedge.exe
3836	identity_helper.exe
3836	identity_helper.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe
1800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1964	1800	msedge.exe	85
PID 1800 wrote to memory of 1964	1800	msedge.exe	85
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 2312	1800	msedge.exe	86
PID 1800 wrote to memory of 4616	1800	msedge.exe	87
PID 1800 wrote to memory of 4616	1800	msedge.exe	87
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88
PID 1800 wrote to memory of 4476	1800	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2effc1380661550604212ed8ef10526b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb77c846f8,0x7ffb77c84708,0x7ffb77c84718
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7616844868740812357,4673059601850501726,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7616844868740812357,4673059601850501726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7616844868740812357,4673059601850501726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7616844868740812357,4673059601850501726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7616844868740812357,4673059601850501726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7616844868740812357,4673059601850501726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7616844868740812357,4673059601850501726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7616844868740812357,4673059601850501726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7616844868740812357,4673059601850501726,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7616844868740812357,4673059601850501726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3260 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7616844868740812357,4673059601850501726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3260 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7616844868740812357,4673059601850501726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7616844868740812357,4673059601850501726,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7616844868740812357,4673059601850501726,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
d327c50c3774cc2000f8d15e4ebc5059

SHA1
ec048ced0c40419800c7039db4a56823de549004

SHA256
be40c65529a7b0d71435600cd13447bd4af8f2dbfdbc211ffb3e088d4fd16bb1

SHA512
0a8d4d8835a19f3f8d26f12a2fc8dd01a037ef25115f76975cc7103e7e4c08a4d594539cb162e10b2ce345aaf21bd2bcbabab6f0ddbec7d3652b8b8499440366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7bcafb7a474ebad8475ad33528dd9c01

SHA1
bd623573f7807de14d22fed7140a0e317e71b5ec

SHA256
02f831b8c6a33701686b2da40a11704aca6254e8f20a9e6e2d06798d442d08b0

SHA512
06853329db33b819355601a21e4b1f4e059b4c1b0c698503439190b1427c41ad8f2a518b54705bace9a71ba2d10d0515973f38fa89295ea0f62dcae4a0a218ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
976efd701caafcca80feb58502ab8397

SHA1
d8efa05fd3d9d46deda0eeba4e4250e7800b86ff

SHA256
f3144cb094f9cb6b0ed92dd3dbd44da4a1a434e16c2ed2b1007d4256132eb1e7

SHA512
4f3e6a49db8cec0c0d7c5b3cc0c57ded6cca935123e54ba87663dba2d06d6fb0ffcd821b364ad9c6770b109d055ad6ac09cdb4bd8bce87fb9043005163513467

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a5b14f5951ef6361d30cd777d49f2fb0

SHA1
7543b9fc75ead2a2b5fc275e16249ccba73dd197

SHA256
a1d8314a3d260b07920fdccc76513c23c0b6662671a34936bb43d956e497bf66

SHA512
1865f3d9e33a4542740e6d362079db54b2de520c14906daa7474f4a30c2de0c655ac6dd74cac9dec1a3c6cde64454d28f06f2ca6a8f53308ce7deda478aad78f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
511906770389e7b12fc0cf8ca769c7f5

SHA1
ba6f1ddaf5069392581cfdf5d8fa6bff5da67fcd

SHA256
22c9d8cb323f6b24c06e195525cfdaa804dbfdd6506a66122e9d6b28aa9fa043

SHA512
e6ad90658c705cd048edaa7f23f48413cea993c670e63b53dc6a509f8f6430ce54b640a1f91bd287e96d2ce68bda3e6b6d70d10442f37d026866b01ec2ff664d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1cfd64d3806af3fcf1be8ddf33bed7cc

SHA1
686c464e8a0be18cb1d9f773037b9c0a794aa692

SHA256
e0fd4ffc4d81da07837fc6b96ce6705e6d5cdb26ea67f0ccda9c57faca1dea32

SHA512
b335d762140221809188a4ed5336bd13cda24d77e3b684a66b45b65b97a88634d23d6f940c7e9bca258759748d60ca20a59619dd2403638b3f119f36b6a0236a

Download Submit