159ac8075f4ff022d33046c520885a50a172ef27e0695c1a2083d91e275d49ef

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2024 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d485e566644e66d6045d1e53ea71988e_JaffaCakes118.html
Size

254KB
MD5

d485e566644e66d6045d1e53ea71988e
SHA1

85ab712b872a4597d9813977f92a58b3e009ec1f
SHA256

159ac8075f4ff022d33046c520885a50a172ef27e0695c1a2083d91e275d49ef
SHA512

fc0b627acf455d2e943bd5f74867b9bae2d23b09ba527c262a0983a9a6259ed63ed7fc24dad5643cf3358abb4cc3cb9d123b8dccc8ca8a0a6f20fbc82110a2da
SSDEEP

1536:PvBHv7ynvCTSo0jW6+DcDzPLHio2cZU312ZqxR222kSYUvASin9h0vAXKMtD8Yn:3BHTGCTwj7ZS8YUvAtr0vAXKMtD8Yn

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
3016	msedge.exe
3016	msedge.exe
2092	identity_helper.exe
2092	identity_helper.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2308	3016	msedge.exe	83
PID 3016 wrote to memory of 2308	3016	msedge.exe	83
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 4664	3016	msedge.exe	84
PID 3016 wrote to memory of 1068	3016	msedge.exe	85
PID 3016 wrote to memory of 1068	3016	msedge.exe	85
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86
PID 3016 wrote to memory of 2992	3016	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d485e566644e66d6045d1e53ea71988e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbc5046f8,0x7fffbc504708,0x7fffbc504718
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,3217830321198837607,12360365930630473096,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,3217830321198837607,12360365930630473096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,3217830321198837607,12360365930630473096,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,3217830321198837607,12360365930630473096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,3217830321198837607,12360365930630473096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,3217830321198837607,12360365930630473096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,3217830321198837607,12360365930630473096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,3217830321198837607,12360365930630473096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,3217830321198837607,12360365930630473096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,3217830321198837607,12360365930630473096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,3217830321198837607,12360365930630473096,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,3217830321198837607,12360365930630473096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,3217830321198837607,12360365930630473096,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,3217830321198837607,12360365930630473096,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
1fd1e44b17e6081c52b302167294f052

SHA1
b74913161c9ea37c65dab40ddf5306e0762bb888

SHA256
06879bd9aa5bdcdb63dc2e59ac8e0e3a41f761247bd2ac7da4abea9f0ada0807

SHA512
9e595f5bb10b629471676afa05529009db2fd6f0655c64f68888088bac5913e60846192976eff35310ae47e6c555031d63295864ce1a525507ee5b65dcde016a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
903B

MD5
7cf9a7333ac1013d0281d1d7fd9d231f

SHA1
6bb2d3a89031379bce2fbd5887b6275a2b2b75c8

SHA256
b59763621bd5a74e7515ffb7c044818333d7aad2c74a7757d7ee6a50fb3f9f48

SHA512
7cf5c4034f33824f0e211b5250824755811fa55329cb078a6e6d6230ce9df6af037131a77b820134fa779ccb675a546023f3e4a45480c0f86ec7311ca9f7c9b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bd7572e8aa2ff407d63a19e3c619609f

SHA1
1f2e5b1690a0eeb2e50dd63d451940bc290b1174

SHA256
efa981e0fb0a32c3ff828c0721a229de57ff1c059574f8361b8c4a7ee96446b5

SHA512
80cdd9ebb92d685fa382734edbc0988eddbacddefddee49ba6744989eea45e0c66af4a78caa6008c878d459de7e5a473f57da3d8e1bdd0110f11182c592b27a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1c39eacf00f3a05774bf2e07684eca12

SHA1
da6cc32e112205ed07365a09f9793d2fbce8fbdf

SHA256
8b778dd494eda10958ef31843e405b9c5b60be8112467bc2066cee7dc0bbc5ab

SHA512
5caa3a06f3d04b16379f97a89b005da7348a9ffe2962a271134b910d667362499133ed37c377b31f7cfadba3762fff313ecdbf2aa90d2d43c110b4c5bb8e2cde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b6e0c061-30c9-45ca-b12a-5f8a791535d8.tmp

Filesize
5KB

MD5
fc6b49e7fc4ee00fc26afdd6013e5d67

SHA1
3d767889d4eb4043cddaea5eecedce2a892dae9a

SHA256
3806c90061ada2d30fcfd80c3ac73241c760acae33aa6f97f04b6340a0aa0d57

SHA512
5cf6798e7d3131454fd98c7a33c79a321178e254d8a8119aca32f8a98b9e86b3c93276545ad5e7cde48d5a01341f5080d68c786413a475e97e82306c5831e51e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dffa24696653fe29c561d2f4caec0ce8

SHA1
b60f09166e8c040c68b6ee0735aeb005c1563127

SHA256
bafb334a8de925ac295099aa51476649bedadc942a7f687178a848b62788a7f0

SHA512
daa63546db539915bba216dc5fb3037d7562d3589700ae8c1a3b1bd50862ee89c0831f37c6441275879c08731ed54c0ea08df92550e6576ecc07d6f0b80a56a6

Download Submit