93152836f5141d729ceb70d2daa79b24fc3cfc846e0f3dc9bd25b50537ecbd1d

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2024 04:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45e3745b3551550f519e4156c116200c_JaffaCakes118.html
Size

22KB
MD5

45e3745b3551550f519e4156c116200c
SHA1

d2f42a89056ea3f79d34680be8db025c9f10d1ba
SHA256

93152836f5141d729ceb70d2daa79b24fc3cfc846e0f3dc9bd25b50537ecbd1d
SHA512

25747f60e2b4db0e7f82cabf5cab062b1e176f5885d135fee2c4e8322e4d1b11389b2faa8a4075740527deaa0912787453ad3fa4aacadfb2b1a0dafec1e21c66
SSDEEP

384:JiFi8sXSewEu4Wu7mONUyerZOir/yhIz2M/PcDwAs0/ez67+/tMVJYHADbIT+ZSY:JiFi8wSewEr7mONUyerZOir/yhe02C+M

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
4720	msedge.exe
4720	msedge.exe
4424	identity_helper.exe
4424	identity_helper.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 2252	4720	msedge.exe	84
PID 4720 wrote to memory of 2252	4720	msedge.exe	84
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 4780	4720	msedge.exe	85
PID 4720 wrote to memory of 1244	4720	msedge.exe	86
PID 4720 wrote to memory of 1244	4720	msedge.exe	86
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87
PID 4720 wrote to memory of 3500	4720	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\45e3745b3551550f519e4156c116200c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffded3046f8,0x7ffded304708,0x7ffded304718
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,18306329249581433191,8470179831164931747,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,18306329249581433191,8470179831164931747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,18306329249581433191,8470179831164931747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,18306329249581433191,8470179831164931747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,18306329249581433191,8470179831164931747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,18306329249581433191,8470179831164931747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,18306329249581433191,8470179831164931747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,18306329249581433191,8470179831164931747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,18306329249581433191,8470179831164931747,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,18306329249581433191,8470179831164931747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,18306329249581433191,8470179831164931747,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,18306329249581433191,8470179831164931747,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c8f604c-5734-40fd-a794-ed2894fef27d.tmp

Filesize
6KB

MD5
41559abbed7551e88887ec4747c8292c

SHA1
9ba638a84cd169f2f3ff34019f316dd870ee23a1

SHA256
8cce8d64c1b2c2cf46a03ca640eb7b31ca6caa5f405c51e5fbf11aff314de00c

SHA512
ed03b332e22f1793d04ccdb32653d8fd662ff751b5fc8ff2a5605ad27dc200d8b02c023f200e7ecc26084256fdbbe6b5d9e4b53796e0ca7fc6876de68db5e0f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
181B

MD5
837b62a8487f70ff230e2009df705002

SHA1
912aafc621db1587a5b07ba816a34d0f5e4bcb68

SHA256
209ab28b37211fe6b72ebcfbbef40f6b5be5e3311656feb06fc1562778d4bb24

SHA512
68731b26f9699fe81ee98566268a94c71c538acec987d16630c26fb8a48bfca005b48dfe3b2aacf636cf8d252a551e867df78d5792d1a802199a56586f7b52dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
75a4751cc7898f03e1c4a112a9451e1f

SHA1
f41f3dae534fbff8368edf5c8c819a0950693912

SHA256
a5a5a1e26c9db1d40662aa294bcb116a0512e0f0dfe503610451b83b1ccfa8ec

SHA512
434cbc30a5ccfb155573071a638907465c61e88ceeb4d18cbcd52cda8451ecf2f0333fdbb8f141a34fd6153a4c215dd521d0006f2cdff89a7a0ba2e809a05ba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34d595bd99935675d6264e035e729535

SHA1
b8f0d64d61e1d52633ef15f1efe8ecfab2f83b90

SHA256
d6e2bfa3761548ca85c9b7cf46de95873eed67bfae4f38a00c8a9679f450182d

SHA512
91754c61b438b7ecb66fa13387e55d2e6241451114133c6cb81d9b2f25c6b0c99d893b403243bf7793cba4094d6b99eefd6bf1bd481f2c8d3803ad556b76cd8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580d1a.TMP

Filesize
202B

MD5
85d6f71bc177958061060dd00a349d9a

SHA1
4e8e8e6c894089cddb8e531243abfc07a73eccb4

SHA256
eeed13b3c203f8e592ddeb9a0907f365168f6231e4e2cf12267858d592624485

SHA512
eed7cdf69787d939415f001de65ec285f5630c598b428d85752ca33e64d6e82cd4c47561c1ed7456646396b0c6912bce2f967cf724ed11518896341452740c7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a030b3a8-89da-43dd-a898-65690d7770bc.tmp

Filesize
202B

MD5
403d2b6fede0a07622db0db7f558edd0

SHA1
28513b68bc2c76dedb3449dfa96d7480faacc1a9

SHA256
277c8b91b3e7603950abde7d97c4503440ed6df1988845ccae4bad3a44e67017

SHA512
e2b1080d28656f36e6b9b03ceced2a772fa6c29ef9e8cff8c0f667f1e54036990151416a33ec17f9073f6b7029617eb1673fa24f622825176295898858167156

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b99645e58f94ee6d596b350e434d7a86

SHA1
84021324b095962d3249089f5c9bc977f07ada35

SHA256
f33a502847cb869cd8db4486ac2a515353dd03ab8da1a7170badc5af37026dc8

SHA512
d32866614395b2060944ee1849fb665c03d0ae9ca6637edadf6eea09bad9f3faac5c5e2da56632eddde7bafa19c8646736affa3239e25bbd03487289d7398efc

Download Submit