2073524cc0b87e38d32a7917cf3103109a3604f14d03ebc1dcf91dfa81b10b8e

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ced42c933af7fd2d7d8c63edf734039c_JaffaCakes118.html
Size

31KB
MD5

ced42c933af7fd2d7d8c63edf734039c
SHA1

508fd0147d7da993d57ef14b5792323958a70e10
SHA256

2073524cc0b87e38d32a7917cf3103109a3604f14d03ebc1dcf91dfa81b10b8e
SHA512

8db92e58ec95d0a103b1b273eb9194d1667bd6390a37537f379ede9c6f346040677354c6d800a709cec436c5d2ad80e70e3a2a7e8be2fc342941b3e948c2a6d4
SSDEEP

768:N9yb1uAXPMq5NijOcgrV8pKGu9JatPpyZaVpxK/RfKG3C/TxfoK2MW:N94PMq5NijOcEV8pKL9JatPpyZaVpxKJ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
4312	msedge.exe
4312	msedge.exe
4376	identity_helper.exe
4376	identity_helper.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4068	4312	msedge.exe	83
PID 4312 wrote to memory of 4068	4312	msedge.exe	83
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 2440	4312	msedge.exe	84
PID 4312 wrote to memory of 1664	4312	msedge.exe	85
PID 4312 wrote to memory of 1664	4312	msedge.exe	85
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86
PID 4312 wrote to memory of 2076	4312	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ced42c933af7fd2d7d8c63edf734039c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3f7f46f8,0x7ffa3f7f4708,0x7ffa3f7f4718
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2320,16757405646034489317,15598286376442301021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2320,16757405646034489317,15598286376442301021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2320,16757405646034489317,15598286376442301021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,16757405646034489317,15598286376442301021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,16757405646034489317,15598286376442301021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,16757405646034489317,15598286376442301021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,16757405646034489317,15598286376442301021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2320,16757405646034489317,15598286376442301021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2320,16757405646034489317,15598286376442301021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,16757405646034489317,15598286376442301021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,16757405646034489317,15598286376442301021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,16757405646034489317,15598286376442301021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2320,16757405646034489317,15598286376442301021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2320,16757405646034489317,15598286376442301021,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5380 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
3db20fa60cb26561a62cc76c02357e52

SHA1
cad68595a286377641326ff11a253685ef0d257b

SHA256
1f3aafe6c0b420333f580eac5f50b7922a4ae8be45aa8433966faa62724c47b8

SHA512
757e28a00e0b308b4ea903704c527e85b1fe6e253c9dc7566812cd7e00cd1d1b056433ac297b17a9406365b7474503e8245e66aec87be03bdb61fcb8a7ee34e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3bde677ce565b5e6a1158573d7b92555

SHA1
fb0781ddc0a83fbc3ee9849e833b1e5eae87dd5e

SHA256
6ce6e264fe4a17ae2f1661d07cd97cddc350f0b411b16bc4d225711bb690302d

SHA512
f7009a7a905ec6b010825439c24074296d64ab25e122658ab7feb90c7b4fce25503dac70f7ff498e498dc53455e9ad37a7ba839d2fe9785adc5a7ea6dbfc9370

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dd3a7a869a26518e7d013cb29405c8be

SHA1
80a7196069dddc81f003a3ec40ee0922479aa926

SHA256
0e5d6ecb6a86403dede8ddaf0a66a85f7843352617b5f95ee73113ea2d25b292

SHA512
fcbad27a1fa022d98c7b356eb86610fa1716ffbfa5e3e1c3567e383e192e93aa7ca81f0099c8967194e6b3637a0fbd96a822fe1706a69d71eab7ac5bc11ebcde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1ee5a673471931d0ee07df2b498b5bdd

SHA1
aa74d9cc831bdc7e18113edf69dcc7d37e4c649e

SHA256
4d816fbf4c46952e8fa14ea9fa81e44b78f3572d98b689fc60406fe502604b63

SHA512
6987de1ad849a3db47faa7acd68ee825ac401d50c31b260a52c181e04368273c9704d6207e9f134fe5d69ceda28f12d1b1bfe390e68047c3c704802c228fcbb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6501d2c0b3ae0512212dab3f0951d0a1

SHA1
2c8904145cb46185d848216b58125b18d05d4238

SHA256
dca41a3fe0fc5dbbf38dbf0e38c27c66c43ea604ee9e90021fba3d172585a8ba

SHA512
9db75c7891881f79ef91a19c574417a53c3635e49b0a3a0d1278b7ba8fe08c26cd4513386d8381ef273ebd2ffc75d144c6d95a722b448496db8d9e0cf51f3eba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2dba5254b32b1abe376e530cd9ce7c9e

SHA1
e54a398bd7c874c6433593694d1a861314415881

SHA256
ec9b7501b46ee92c1e77d8af9b4b65628d3b743772da329dbecc685a8fc59911

SHA512
111bbe60c15c01a39e03eb85b45c1b0fa03f629aa90df4d8f069c689b64803486a04c0668c16650785b315d6103dd10362b33e7868a1c4ba5de54b52e752207f

Download Submit