193fe255f507b0feca84ad7176842764750e1fb366f91a568a87ceaca87e9ac5

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65d52bdb915d1cf81989f5fbc35b246e_JaffaCakes118.html
Size

19KB
MD5

65d52bdb915d1cf81989f5fbc35b246e
SHA1

a2da7f9106d94037c8b7e7ef187d284a0ffc0658
SHA256

193fe255f507b0feca84ad7176842764750e1fb366f91a568a87ceaca87e9ac5
SHA512

eaa6dfde7282d8524f885d4c98b9ca442a3eb92c87ed06055bbe8dffb9debc877505fd276dd053565dec5e0c577b8102f9615c2e1f7e372159e35ee20e083105
SSDEEP

192:9K/ypUhTSZiqEWBLTgE9d31R+0O2UgcQq0OQMQYQujQZbHEI65oZVhERoIQq0Om8:4/yoT4iSLXflMQpBbp55OOunBizin

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4824	msedge.exe
4824	msedge.exe
2780	msedge.exe
2780	msedge.exe
2836	identity_helper.exe
2836	identity_helper.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2780 msedge.exe
2780 msedge.exe
2780 msedge.exe
2780 msedge.exe
2780 msedge.exe
2780 msedge.exe
2780 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2780 wrote to memory of 1552	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 1552	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4804	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4824	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 4824	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 372	2780	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65d52bdb915d1cf81989f5fbc35b246e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8354246f8,0x7ff835424708,0x7ff835424718
2⤵
PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,4703010868161976882,2643745722521112646,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
2⤵
PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,4703010868161976882,2643745722521112646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,4703010868161976882,2643745722521112646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
2⤵
PID:372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4703010868161976882,2643745722521112646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4703010868161976882,2643745722521112646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4703010868161976882,2643745722521112646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
2⤵
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,4703010868161976882,2643745722521112646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
2⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,4703010868161976882,2643745722521112646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4703010868161976882,2643745722521112646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
2⤵
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4703010868161976882,2643745722521112646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
2⤵
PID:816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4703010868161976882,2643745722521112646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2296 /prefetch:1
2⤵
PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4703010868161976882,2643745722521112646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
2⤵
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,4703010868161976882,2643745722521112646,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1944 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1652

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
28711e563ce52f2907682afa6036d038

SHA1
b84818cdf15a1cdcbec2923f1b7ee9741244b364

SHA256
da51beaf11808dc87d744100be3be41ccbd32fb56cb1dd6a3edd203aeed17387

SHA512
dea88d2c11f5396ec92de9902d8138f08aa22613ac98348e32dc9727249a53dde7438b2204431ed560d03fd8a167315c60ef0783b6a6e78937943674dec2fa74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
096e997aedc2b793c68e392b842379f2

SHA1
3ca23ad27e743a6e5628b3a722c6942af0901042

SHA256
27722e6cf419feac4abdd3eeb9548a7f222ff4f77afc016c9364a80ada9ab353

SHA512
fe7d20b05f7f13f8a70e87bd901c7407b02782f9ed81f906c384b41fbe601fa9dce0390c0203f082746ac613a955d6c0ffb4133e9a19392ec720b74196216a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
35b1b1ce0d067048d5e287ea62d0573a

SHA1
1bf0b1f4fda609ebb127896bd8861d834e19252b

SHA256
85a01d4506a241eabbc133de2b7e7ae8efdfef3129b34c21014a284877ad8d0a

SHA512
573abac5e80b2656e9073f0500d723d584e28f4656feb1f951c9c93c14926a6518e4bd021bbd190b020698ce4c063fb5d67779ef9cf6e4a547d60e2cfb0a2ae0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
951ccc07f6a7b9d7a92c31005eb69bfb

SHA1
e8dca41423d8066d7d6c3950345b5ca27843c82e

SHA256
9097e423bcbd960cc3b7f878ebbb02c74cb72a3101438822ed66c81dcf389f59

SHA512
d77ec63e7d993f53590b783d244b47ee846a489018b0ab9c623fcf5dc19f2b627445e1ab78733788de79afca8824a5768981603eaea3185718398bba819f0277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
12ae06a264719d979e29684778000611

SHA1
e034330c96ad8517e8b10d12d6e48450a20985e5

SHA256
da336486d47173b33f20d920d3e00d8fe8ea90dfbe7d208b19d7f4dc5b6baea0

SHA512
0db03a25e94355621023b3d1059e79c1e5cdc2d689b9a1ebf1c95f3f2f8cbaf583a32ff80055cdbb8a674f9b9ea0bce5c859941342dc6a7b19856cdadb582130

Download Submit
\??\pipe\LOCAL\crashpad_2780_RFVTYDFLRMRSHYHG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit