ecb05a9bddfe7b18472888960911e5d4a691900fbdbdefff53d63069709424d3

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-08-2024 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c21c38c302abe27c89595082d2a9b9eb_JaffaCakes118.html
Size

68KB
MD5

c21c38c302abe27c89595082d2a9b9eb
SHA1

fe4c3e657b8dfb0609c86682e44d17df4bf3715f
SHA256

ecb05a9bddfe7b18472888960911e5d4a691900fbdbdefff53d63069709424d3
SHA512

0cc96e1733f45569b2bdf6b9dce71b6076a0ed2f585c76b42fa19de67cef7a3839fc79129ed814926698845956e991aa2d0e821da47933922359c4038fed8914
SSDEEP

768:Ji5gcMiR3sI2PDDnX0g6M+FninFTn3oTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQV:JTkiZ4TcNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
4020	msedge.exe
4020	msedge.exe
3440	identity_helper.exe
3440	identity_helper.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe
4228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 4740	4020	msedge.exe	84
PID 4020 wrote to memory of 4740	4020	msedge.exe	84
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 2084	4020	msedge.exe	85
PID 4020 wrote to memory of 1980	4020	msedge.exe	86
PID 4020 wrote to memory of 1980	4020	msedge.exe	86
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87
PID 4020 wrote to memory of 5112	4020	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c21c38c302abe27c89595082d2a9b9eb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b8ed46f8,0x7ff9b8ed4708,0x7ff9b8ed4718
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,6120494461910150161,598070588047753774,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,6120494461910150161,598070588047753774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,6120494461910150161,598070588047753774,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,6120494461910150161,598070588047753774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,6120494461910150161,598070588047753774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,6120494461910150161,598070588047753774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,6120494461910150161,598070588047753774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,6120494461910150161,598070588047753774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,6120494461910150161,598070588047753774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,6120494461910150161,598070588047753774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,6120494461910150161,598070588047753774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,6120494461910150161,598070588047753774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,6120494461910150161,598070588047753774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,6120494461910150161,598070588047753774,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5304 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
212KB

MD5
2257803a7e34c3abd90ec6d41fd76a5a

SHA1
f7a32e6635d8513f74bd225f55d867ea56ae4803

SHA256
af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

SHA512
e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
f6b79e69f4455a65d82dd59fa89b46b0

SHA1
6513e882f4729e6fbf5e515dfd8d9cebca35c0c9

SHA256
a2c452384373c28c6557e1c7eb2e7481792181920d788e43b44f5ba61f81b6c0

SHA512
0dbcae0f8581d7b9b5bd2690ce5a27188cb4b70b9a17e1809c1c36639d5ff192bfc280e2051d0be48c594c77046ba1b83c4cdc112ab29621e9d8c22c28db6338

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1af8194c47775ba4d27961d8dbdb99c6

SHA1
cfc48326dac8833203d331a7b1e66fe83d72e952

SHA256
d1c52e5731ffb4dee5e802f6fb13d993471c27a014fb792015b079c550d2a0b1

SHA512
da45066756fb24b09cf139d8aa5ced22b1a739c463f2f0a87ea48ee21cc448a0cc62f222928f89bd0f2da118ec50856cf87881f5c15a7f3ee5326c08a0bba66b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3f3010a5bb00d7bc7c8c1fe304e4bdd

SHA1
62a82c541b80168cdf3e70e47f7972a8110c0f23

SHA256
e6c3af7110536bb5e05fe06c3232986d7105b66c56165ba73f7902f60e0a16de

SHA512
63e5db7d9d626ea535211ebcae049c9ef18ed4b2ab9dae4300c45889a6d4cf9bde2c5d39ab799e2bfc3b314217a410b08518ccf5abfbb74ef1dc1a346b770570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9ab722182aae3929cb220c6f86d59c65

SHA1
28224fb565d03032223de98f9b4f1a40c6667e0a

SHA256
12ff60e7cfded81958833018d85bcc8e184d0f0ac6d7f9037fccf5b0d23864cd

SHA512
5714c2fd98e5e31dc4938ae419b9d27bccb63d814387b644bb2b9544f20eb924c9203887b9507bf6ef03f271edb2db6901cc9577c91b2da66df31175d5f98060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ff44d55d95ff9418a30e933205dc159e

SHA1
c93ec5d9620cc94df9d4a676540991659a313728

SHA256
cd82cd1bd3f1ca468352b39dd17ac23813a48f4999db27f832b20dd918cb3e70

SHA512
28f6848eb403f9516fc06a856b1268a68b7381a8d216649b2536a55e7073a1fb23d595dd5da970696dcfb104224cdd772e085376fe818684ffd10e11a33ce429

Download Submit