97bd140cf48c2d35c87c3f62d7056c0098102fe9d558a30d6ade62b1acc859c0

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

658fc6af90489a075d77f981d1b4570e_JaffaCakes118.html
Size

22KB
MD5

658fc6af90489a075d77f981d1b4570e
SHA1

f4498fe023f3d84510a24a671d74946478d56704
SHA256

97bd140cf48c2d35c87c3f62d7056c0098102fe9d558a30d6ade62b1acc859c0
SHA512

202b637dbf52b387fffbd701968001b99111e1107b605a9ea8db7ed166fd248b67261b2524b450bad3b961eb8f4533dd7ab4550c9c1eef5547279029ceff7791
SSDEEP

384:SJBzgq/THjBa7e6Aw3jBz8FYd7Y1DvfY7WW6iX:SPzjBayOt0mkNe

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1892	msedge.exe
1892	msedge.exe
4928	msedge.exe
4928	msedge.exe
1548	identity_helper.exe
1548	identity_helper.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe
1520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4928 msedge.exe
4928 msedge.exe
4928 msedge.exe
4928 msedge.exe
4928 msedge.exe
4928 msedge.exe
4928 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4928 wrote to memory of 3816	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3816	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 3892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 1892	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe
PID 4928 wrote to memory of 2372	4928	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\658fc6af90489a075d77f981d1b4570e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa05d646f8,0x7ffa05d64708,0x7ffa05d64718
2⤵
PID:3816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,11804708079458316750,1003340673082566378,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
2⤵
PID:3892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,11804708079458316750,1003340673082566378,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,11804708079458316750,1003340673082566378,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
2⤵
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11804708079458316750,1003340673082566378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:2768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11804708079458316750,1003340673082566378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:1288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11804708079458316750,1003340673082566378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
2⤵
PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,11804708079458316750,1003340673082566378,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
2⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,11804708079458316750,1003340673082566378,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11804708079458316750,1003340673082566378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
2⤵
PID:664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11804708079458316750,1003340673082566378,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
2⤵
PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11804708079458316750,1003340673082566378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
2⤵
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11804708079458316750,1003340673082566378,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
2⤵
PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,11804708079458316750,1003340673082566378,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1268 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3780

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
408B

MD5
2fca0a1f683558a4762b4d71e1d87048

SHA1
aeafbfc605a70fc6552744cdec9166369545bcc0

SHA256
9aaf34f84345870dd51233d23b805b4f8476365ff553aa5674733597ab564d9f

SHA512
3afea2592b8261d26d1d74a19a2fef2881cd8f0c2f7236e8abb815505d5adf6a87e4a6978e053be9292fc6ae98c09a39695d9cf7716ac1afafeef30ed2482853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
7791c1c96c95e0f35108b50e75460b55

SHA1
3c1ce3c529029ffbb204bc80cfaab7f594a56b13

SHA256
1a26bf444b81aa052b88d45c8ffdc84608356acd5aab873cce32bc442a013c43

SHA512
ddcda24f62694b965492fbfe5f97ad2906aaa20f51ea9816ad83caf1573e34a9e18ee4b758a954a70756625086c5f1d81c663b3e9aabd035a42deaba38376240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
18e1df4fdbbd8236a0df4ea3e910d5b7

SHA1
951dc01776e07c3b07d2de97f6c656c960e84873

SHA256
7290fec8d93b8aeea83d7c64002d240590aa080a48a50e7beedb86f73f42001a

SHA512
96b24cf4d559881116930efb87a415edde7d00bceeef1470bcdb8b2ec1f691896154766b46829ceaf1ecd025fbb631edc286f4961a1b80bef9ba44be6e2fc9c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
04b31707de6393b88bd82a7eeb288b8b

SHA1
8f98cd43778b4612730f46270865ef597e51fa4f

SHA256
ab2883126e3b467d9e251ead8bd26f324d28075dc562c0eb772515637eadac4b

SHA512
2bdfb54f0757c04ad1e4fdb3ca97edf0da750c68ac04230abe328f32e1d588ef32381ae99ee7e37402e3f35b7abe6ce7afa6a08b037f7d07663e04dd940733db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
ab4ed6dea8d390f72b6187a392bfa16e

SHA1
2ace2471f7790d23bc1ba110bf6ad9a0eded7bd0

SHA256
78b5f01c26871e9f1220b8d74d426f828e3125a4a46ee2db1abe349dfb1dd4c0

SHA512
60079f8a26d1f2a74fcebe0c8e12839fc5688313b7ce7c95abff1f5d02daf4b59cc7832090bdd220790e8dc2d383244e325f75ddc013f052c6f1f28817dc5a96

Download Submit
\??\pipe\LOCAL\crashpad_4928_RYGKTZYYURPGXTCU
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit