17d816cd31c46dcef321feaa74ebe9c46f538eb0b29db8c0ad3452771fe134db

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69117cccfdc032d201c292f6870a8bb1_JaffaCakes118.html
Size

19KB
MD5

69117cccfdc032d201c292f6870a8bb1
SHA1

8351bbcd32acc2c9e416bac2a42cee08ba046933
SHA256

17d816cd31c46dcef321feaa74ebe9c46f538eb0b29db8c0ad3452771fe134db
SHA512

b2ee443d367b250168d0fea5c74d3ef17f37647f16775218107fc6df1537ddbb5bb735c28dce62df08a88bff8f54c84886f539d3cbd92e782e58ea7cc54dc96c
SSDEEP

192:9K/ypUhT3iqEWLLTgE9d3S28yQMEajQP7ahdymMlUx9V6cxjb79DX+OunQiFoiSg:4/yoT3icLXfuaQPmLp55OOunQiWin

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4408	msedge.exe
4408	msedge.exe
1276	msedge.exe
1276	msedge.exe
4864	identity_helper.exe
4864	identity_helper.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1276 msedge.exe
1276 msedge.exe
1276 msedge.exe
1276 msedge.exe
1276 msedge.exe
1276 msedge.exe
1276 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1276 wrote to memory of 3476	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3476	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 2888	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 4408	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 4408	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe
PID 1276 wrote to memory of 3416	1276	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69117cccfdc032d201c292f6870a8bb1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec5a346f8,0x7ffec5a34708,0x7ffec5a34718
2⤵
PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3381017904984245206,12033619379769895870,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
2⤵
PID:2888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,3381017904984245206,12033619379769895870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,3381017904984245206,12033619379769895870,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
2⤵
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3381017904984245206,12033619379769895870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3381017904984245206,12033619379769895870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
2⤵
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3381017904984245206,12033619379769895870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
2⤵
PID:1908

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,3381017904984245206,12033619379769895870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
2⤵
PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,3381017904984245206,12033619379769895870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3381017904984245206,12033619379769895870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
2⤵
PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3381017904984245206,12033619379769895870,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
2⤵
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3381017904984245206,12033619379769895870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
2⤵
PID:2532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3381017904984245206,12033619379769895870,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
2⤵
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3381017904984245206,12033619379769895870,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2364

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
010df157f0419749d5505ce065ff60e6

SHA1
d1df159e40316409de45c01ccf84ed5771860706

SHA256
1e25b6b3c8765873e329717f5b27ccaa4eedc88bd794ce95c0e0d0545fc19971

SHA512
14618c6a2b462564723d8bb332964968246df997a15f31609b3519ee71ef684dd60dc61ecbb3d853e13b8b0b970421e24c628b99df8d2b6371b87d8c88c5d4d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9bce654d4a57695d3fad642535edeb55

SHA1
f692cc7b0dea5e0810474c3c35cb3b7fdc43970e

SHA256
9652eb17ac62c57479b20340fefc25b33a5d696f09ac8f9528ee4c317347e802

SHA512
a6dcc2972d3e6b0870e5aa8c610b1b55ae6b65b7435b13f3717adfc46edcc73091242f59cb723adb72fc217ff0af21e54d0b92980044c151fefdcbb2e7d49925

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
0b7dd18005ec9a1301653ec1da6b7d6c

SHA1
9f4d027a2d2af3ae58d502a86adb3869cdd2c5f6

SHA256
efcd17a2012805121fafe52d54d8c02e158b8ebbf28090e242e3f25799201d58

SHA512
150366d66c07c5f4305e286622ad3cfa493b86fc2a0f51fd7889bff9024a1c7862f1f71f576cc0efabe5785226da4a19eeeec5619299c33731bcd7575552b943

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
64834b16122669f8b6f9ec0d689be0ea

SHA1
b70177274645f9c7de3fc12b4ac496ea23b11aa6

SHA256
84df6bea7542cb4f767696a678f50c2b631f764cacaabe9caeeb9aef4cee42e4

SHA512
c4fa39137a968372db08611d547269a6f0b005955b592c68e91d4fa71b7bf096d347c8c412aa526111504017c41be77ed85e10f199e44deeb6cd6a37a4a187ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
5353a4a9dffbdd11f393f86f21567c61

SHA1
8a0e336f5982a1d5dcf3837c7dd1866a5eaea3c1

SHA256
3482bd4ae3d84b2d5ee9dd03359afd9497d58cc73b6b6ececb633b85f0a81e0e

SHA512
928fef154908766a365ebfad4a051201ec820e75ae47c00300ae45ce1f8760404a7f533d9be4fdaa7574a03108986f4f22554c3f61d019c4f7940a6f6f05a63f

Download Submit
\??\pipe\LOCAL\crashpad_1276_TRROGXLANJVQLADB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit