c0a1708d9e6bab2ce00b832649820d6428e630f06ebbfee002bcb30c9ab5d952

Analysis

max time kernel
148s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63a298e9280a438ea380ea542f6c900e_JaffaCakes118.html
Size

28KB
MD5

63a298e9280a438ea380ea542f6c900e
SHA1

65d986678f96e057d95842fd92f5445d9a19b5c0
SHA256

c0a1708d9e6bab2ce00b832649820d6428e630f06ebbfee002bcb30c9ab5d952
SHA512

06c5f61aa307dce1840bd509a650cb408d632a95821b9adf479a0eee9504d512651de75544d4c2819286b2ec9ead14d4a2e86402a8c8f98d564d5a1bf47a4331
SSDEEP

384:TC+BMxtrW9WyV+4bmKYg+PbxktHeqdOHb/0Q9VWQVu+23cCMCOishPG0uIvTw:TC+CfyFb2g+Dx1XbB2sCMCLsxxw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4912	msedge.exe
4912	msedge.exe
1572	msedge.exe
1572	msedge.exe
1240	identity_helper.exe
1240	identity_helper.exe
5448	msedge.exe
5448	msedge.exe
5448	msedge.exe
5448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1572 msedge.exe
1572 msedge.exe
1572 msedge.exe
1572 msedge.exe
1572 msedge.exe
1572 msedge.exe
1572 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1572 wrote to memory of 4416	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4416	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 1412	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4912	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4912	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 4236	1572	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63a298e9280a438ea380ea542f6c900e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffb042146f8,0x7ffb04214708,0x7ffb04214718
2⤵
PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,7914285262203405993,1231293089783315755,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
2⤵
PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,7914285262203405993,1231293089783315755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,7914285262203405993,1231293089783315755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
2⤵
PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7914285262203405993,1231293089783315755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7914285262203405993,1231293089783315755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7914285262203405993,1231293089783315755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
2⤵
PID:548

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,7914285262203405993,1231293089783315755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
2⤵
PID:1640

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,7914285262203405993,1231293089783315755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7914285262203405993,1231293089783315755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
2⤵
PID:680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7914285262203405993,1231293089783315755,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
2⤵
PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7914285262203405993,1231293089783315755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
2⤵
PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7914285262203405993,1231293089783315755,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
2⤵
PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,7914285262203405993,1231293089783315755,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1212

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
72B

MD5
44435b792485186491979f161e395e55

SHA1
c8bbe65d678ce9eeb15f98e6cbfd3c81383833ce

SHA256
16d594fce0c4e5ef06e921023cc024c5d83ed985bf39e386e650fa2c521904c4

SHA512
a7102a576acdc6c33055a7660dfd62dac30be85dc545441835352ccfc2e8b97b156b0d97aa8f8afa88e1fda872debca4f773cd010e6b236388d14c7068bdc077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
714B

MD5
3de9fb3419a183a1353a0350ea9b4526

SHA1
11c862ef8b1554f0d2949babbdb96ad65a8c1070

SHA256
715299e08f0cf00794f40f0579d3c334f6925c9c9a65f4890a919956557ed9a8

SHA512
0d23a48fded02ad9eac85d23ab72532f59e28ec25c91a36290f1df22e4c33f70c313d3b0c2df13c921f845929a9ea1197ba8c675b14c493c06d1444bf7f8b798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
a56341de8d9c5ecb1f0461308917599e

SHA1
cdd04dad6386669384c8f12f7f3b7b3985214075

SHA256
f8504ee25fe3e346f17103600b8f41fd351426cc549706055d5f646e2746c704

SHA512
de5dc28887a5f72a918d7e5f4f37361a6f364d524710e8c1c998544591a262663fe2cd868b8aa292f8c946d9d1fca41c811dd3538484f8aee76c5be3b98bbb1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
bcf8cf438b72b1b9875fde79240db645

SHA1
4b81b5db48248a81595dcc301c541245cebfdbbc

SHA256
303d30866cbe4f04d42ffdfb80da0a4c49ed4e09067da92ee8b4d532d6f742c1

SHA512
54e194ec0004f1aa44446f46fbb52adb199f59df1db92b47073fbe525cf59878344f6ff2da96cb54ab526e1f399c6c90babc0c071774da73a1c8ce88420f89b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
e17ee23c3ec114cbff5789b58754652d

SHA1
cc4ac07f7ccf06cad7dbca188bc822a79bd832e4

SHA256
daacea058179d4dae5274262a1aa57cde648d64c303127fc62b8eaf975963518

SHA512
400f01b587ea50187c0cac3a6b61568076c7bd278876495a7039ef9fadad3bd50f95956054bca1adc7113a135e33dacb55118e00cc95d57b2cd05807b591f6e0

Download Submit
\??\pipe\LOCAL\crashpad_1572_KSLRNFRVTUHCYMRT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit