341810e3e157cf32a6ae55fe790ef38f4b92016ba2bfe02cc71ad1b5eb31fc60

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68bd9454772f06dbd9cc0eaf2daea332_JaffaCakes118.html
Size

202KB
MD5

68bd9454772f06dbd9cc0eaf2daea332
SHA1

24bf41aa45f76e5118c4e7347f500fd3f04d137e
SHA256

341810e3e157cf32a6ae55fe790ef38f4b92016ba2bfe02cc71ad1b5eb31fc60
SHA512

f95a79bae28e09fd071e139684268951a5225f382cac2316709ffe9bd18034206641ce66dd782a7a08b150d60b0611905f529948c02f5376ebef303eb030c251
SSDEEP

1536:kaa0xoCIWVHpNjeWamR7AN8OeerC1QQ5jKB8QkzEGvM:daRPVV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3224	msedge.exe
3224	msedge.exe
3128	msedge.exe
3128	msedge.exe
2020	identity_helper.exe
2020	identity_helper.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3128 msedge.exe
3128 msedge.exe
3128 msedge.exe
3128 msedge.exe
3128 msedge.exe
3128 msedge.exe
3128 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3128 wrote to memory of 916	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 916	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 2164	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 3224	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 3224	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe
PID 3128 wrote to memory of 4424	3128	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68bd9454772f06dbd9cc0eaf2daea332_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc284846f8,0x7ffc28484708,0x7ffc28484718
2⤵
PID:916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14102857114178076571,4255201596228036139,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
2⤵
PID:2164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,14102857114178076571,4255201596228036139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,14102857114178076571,4255201596228036139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
2⤵
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14102857114178076571,4255201596228036139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
2⤵
PID:3984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14102857114178076571,4255201596228036139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
2⤵
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14102857114178076571,4255201596228036139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:1420

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,14102857114178076571,4255201596228036139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
2⤵
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,14102857114178076571,4255201596228036139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14102857114178076571,4255201596228036139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
2⤵
PID:3164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14102857114178076571,4255201596228036139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
2⤵
PID:2972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14102857114178076571,4255201596228036139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
2⤵
PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14102857114178076571,4255201596228036139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
2⤵
PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14102857114178076571,4255201596228036139,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5084 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
255B

MD5
84b28e8ffed9fa0b8f6a91b5b31b308d

SHA1
efaf4dff37c34966c481eef0caf7dacee9e2a78c

SHA256
cf81f066b1ba1e869f5551bbc61c497d91035e2afcb750c3e63d5c7644b0b29c

SHA512
a838f81d13c5ecf02aedcdc60159f4b3f6e22e1f14c566ee3b2765e5645fe0eebabe24124ac018ea64986261c904e5bb50512708babe39bde76d7a5ab9280ea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
fb3fd55d142e0bc9a413ef1318e0df7e

SHA1
4fe5fc153b1ed34df101b37b3b1b90a54c72ddd4

SHA256
c2c7db85ee11f9fbc82facee3555c6320beaf366e84c89719eda8fafbabd1fba

SHA512
c98c479d681da715794484476d1f865f30616e013f30de1ce6d8d8ecbc75389d7f256071274ef8cfb5b6e37267e3ab5e68eb10dfaefee2b927a589bdc6574c98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
fd865453d297d54cfc45f8443a897d8b

SHA1
df9144a59356a019223a7ecc70c5ee1ffcc51185

SHA256
2e98e7afac2970d995cc393a266b18929f58691d78bf5ddce552d3f52c028af7

SHA512
15ed6a5419174f8025cb4068f7743b1e88ae26622c2aebfa742b74d26e732a7eaa9cbbdac7a17a995a683cb68a5a960b4440c7767c0eb96274b3a409b6ce0894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
1ab7d3a15a00406e6b23f01f573aa368

SHA1
6cbf589398b97b835735a857c6eec615687bac66

SHA256
fd069c42419542ba54dd2853c33506e90fc9e1a3c4f94f1a3155dc03c979891d

SHA512
1f7cbb52f2d7135e5aa6850b181fcbae54880dd502d3720a8626edf316ca9ab8ce768644ca42085dfc49ec8fc7c94ece4ba8be3fd5dd42f574246bf687d12b71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
9f2a082a798b9c63fdb670fede4e74bd

SHA1
ada2dc847a9b3809d363bb0e74947613b13234f8

SHA256
af87e1ab5a8c702d2d103bf7607f1b416471d36cf1f0138e3b61c195e004750f

SHA512
be3210e2de7c9f756a07a624d7493b3b1f51611ca70c401ba5bcc065b94816fc3353fa215d3e6daa67d78868980033e806808d09d49e5f0726b6c854c92df3cb

Download Submit
\??\pipe\LOCAL\crashpad_3128_WAXKLXPKBCKTVPQT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit