1265546b52a8beb2cfdda47229c66a726c2bfe94188c4a8ea40bd7838923b647

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6923be78c930bc53303908ee7b5468b4_JaffaCakes118.html
Size

71KB
MD5

6923be78c930bc53303908ee7b5468b4
SHA1

a83465f3ea303fb242dc6fa595da59d24f9ff244
SHA256

1265546b52a8beb2cfdda47229c66a726c2bfe94188c4a8ea40bd7838923b647
SHA512

93252aa6591bef24cbe4aea006d627fc0dac20b00c28cc9ab0718b8c7460a1f7b37ae86bcca0735f0ba97d62dc1e88fcbdc23941d57d1588e8c785d237eb524f
SSDEEP

1536:MCC+yfE+tPrZJaviZ53aPaFG5RxKyTmHbY1ER6HarlSYlJTjhZDkCpv6VVlrjLSW:Mr4A+c63J

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
760	msedge.exe
760	msedge.exe
3240	msedge.exe
3240	msedge.exe
1352	identity_helper.exe
1352	identity_helper.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3240 msedge.exe
3240 msedge.exe
3240 msedge.exe
3240 msedge.exe
3240 msedge.exe
3240 msedge.exe
3240 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3240 wrote to memory of 5024	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 5024	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 3468	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 760	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 760	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe
PID 3240 wrote to memory of 2080	3240	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6923be78c930bc53303908ee7b5468b4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3ad546f8,0x7ffa3ad54708,0x7ffa3ad54718
2⤵
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,9663535019290747154,3657512356439690556,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
2⤵
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,9663535019290747154,3657512356439690556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,9663535019290747154,3657512356439690556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
2⤵
PID:2080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9663535019290747154,3657512356439690556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9663535019290747154,3657512356439690556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
2⤵
PID:3736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9663535019290747154,3657512356439690556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
2⤵
PID:544

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,9663535019290747154,3657512356439690556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
2⤵
PID:2956

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,9663535019290747154,3657512356439690556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9663535019290747154,3657512356439690556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
2⤵
PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9663535019290747154,3657512356439690556,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
2⤵
PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9663535019290747154,3657512356439690556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
2⤵
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9663535019290747154,3657512356439690556,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
2⤵
PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,9663535019290747154,3657512356439690556,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3692

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\63f978ad-3c1c-4d1a-bdba-fe4d32b2ba67.tmp
Filesize
6KB

MD5
9097d76b72cb179710471bc5c8b8552b

SHA1
a98dcaefbf4d15d548887e00c640e363c6835012

SHA256
4066b844ebd5f599fe16efe187bbce0ccec9eff6d8bd7514e23e2154d02957da

SHA512
2e58b50ad5c62b70a1ba326daf0408315150a87664b29e5ae7c3bbc1e11a94d3a7e0d14932a680b004d47e8a76d48969afb3bc937ca16d6f13c176244824545a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
9e335a61cf4602a1c1dd6b2875248de0

SHA1
62bb5899291a950cb9c6b25138aad65159a6a554

SHA256
adfce92e29dff623d761a6e379b25f8ea3fb2901581488c7c8801a882c0005db

SHA512
66cc19f2e8df0799b85aa0642923cffcfe2cf646bf64072d7bc97dd9600aec6fc45179dfcb68435797b36ddd3f1f16bd9df67c922ec9361ca6e80c9f8843ce07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
b86cbb3da81645153072bb411f72cce3

SHA1
f578cbc555897ce9ef288d1e08ffcda2b9df1f86

SHA256
8deb6898fd178f5d8ee744e520c5d5124a463a57c220438019609ab27f226c69

SHA512
31c1109c594e05a73cd3e2120acb5bc547479ab0eee30d9ab3a9fba08806b9144b4d29d92a5994b35aeccb7d2be1bf92e551ac03275b5ab76b40cd3535ce72aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
7f03f543ba407ee513f01f24903b028d

SHA1
23a1db5fa2a6f6b39b00a76339edd5334bf34772

SHA256
75759a2f792ed36334a2f6598e00e5d14737ddb041dbb3590fcf4027e5453376

SHA512
340b479a8bfb5915b3333a06d3f954f146c74a9029b77d3a2fb43ea7411a437895d9cf2af0fafaf7819c946548b1d619b74fba8489445bb6c8623c209d07de04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
8f65c2847543ee5440e608bbdd0c5572

SHA1
98d784e053bacfaee919c3f211d415fd63cc101c

SHA256
66c802065fc8ce8562940fbf29797d3942fdfb87cc24b99e477fbaf62cdbbac6

SHA512
e7da798c920c2e8c90cd6be9d0b50e382245e5fbb9f820b2897c09d1f85e8cdfb850deb97effddc430d2765667311d7236b1c515662b0e5b4fec2be2bde4a75c

Download Submit