d993bb7c8e660f6b5fdcdc076cb521d1bc4c99fc75c22b6f64dfa12d40c0c0a7

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c93c8e0deb1fff5d1f509cbf0574548_JaffaCakes118.html
Size

70KB
MD5

7c93c8e0deb1fff5d1f509cbf0574548
SHA1

b932b2d26e4115df6de5490ae72f905d3f297828
SHA256

d993bb7c8e660f6b5fdcdc076cb521d1bc4c99fc75c22b6f64dfa12d40c0c0a7
SHA512

b34b566f3d21d128c8b72b9637802db518577da2f4e8357bec8f9015b871710f89ff212ba8c9cdbee2e80d2c1d25ac24b2b2495b21d0ac2b856f01d220d551e8
SSDEEP

1536:eWw9+OuMxR9Vxl9Sxr91xy99xi99xZ9rxc9Qxh93x19qx69Lx09qxM93xgte9Gcn:eWw9du54

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
456	msedge.exe
456	msedge.exe
2276	identity_helper.exe
2276	identity_helper.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 1708	456	msedge.exe	83
PID 456 wrote to memory of 1708	456	msedge.exe	83
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 4768	456	msedge.exe	84
PID 456 wrote to memory of 924	456	msedge.exe	85
PID 456 wrote to memory of 924	456	msedge.exe	85
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86
PID 456 wrote to memory of 4452	456	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7c93c8e0deb1fff5d1f509cbf0574548_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa05d646f8,0x7ffa05d64708,0x7ffa05d64718
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,13111377828340791161,1517229890691804610,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,13111377828340791161,1517229890691804610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,13111377828340791161,1517229890691804610,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13111377828340791161,1517229890691804610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1976 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13111377828340791161,1517229890691804610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13111377828340791161,1517229890691804610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13111377828340791161,1517229890691804610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13111377828340791161,1517229890691804610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13111377828340791161,1517229890691804610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,13111377828340791161,1517229890691804610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,13111377828340791161,1517229890691804610,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13111377828340791161,1517229890691804610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13111377828340791161,1517229890691804610,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13111377828340791161,1517229890691804610,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13111377828340791161,1517229890691804610,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,13111377828340791161,1517229890691804610,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
c9d218bf19c1daf815b545568c43d830

SHA1
78f72d6718f5e28c28359430e06a6dead5424a29

SHA256
2266cf9389ab403872ad02599ed1c1a2ead66b324e45dc6358f1a05aea3bb06b

SHA512
45089a472a66c34d420ca8ebca30a97fab3528017aaca11d6327fd2caa5454b0fdc4c0d33eea5292d378f0d54f20c5c2411a89fd6bcb518e047ce732cac32131

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
497B

MD5
f01438f71cf0e368cb9ba89b18ef2ffc

SHA1
f47b6f38f79692ed7ea95251fbd381ed4fb46916

SHA256
66d876c30f9cfe26318ad3e107023c8fe6435f3d281ff045d31a719aa2ca55b3

SHA512
7b593c95d76b232c16c86103587bc4c287e47310086db336ebf73f05f3060b6cdb268cc0b629aea2efc2577492ebec661bd0ca7be01881aeda07d227dce3f53e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4dc950ae311a04f9bb27d3b11195ca33

SHA1
1290d09d50f251bdf98cbd691afe1dfafa86fc7e

SHA256
b16fae4ed62ebbb09d1b47c1c84cb52ce19a2c859269a17ca4edb75ad6ac92df

SHA512
379c38ff481cdaf259bbcb2391521b2ea4309568f277f43aea8c1cc6c65dc356df86934c6dd7c30997fc532e15e03caa95febc10debe5acc24560db4a5e62dde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9c2cc792d13ef1b24b11fc93412de970

SHA1
52cf78d45bfb89eb34662f7134e686bb0b1058d9

SHA256
eeaaea4d35141ca1bc98d6b1f0dd7940d61481fde0721b75ca4e04dade3a51a6

SHA512
3450c1f05168047facd513b8767af123279a2ad700d631cddd73e34c56a764631d4a8a002e58802c6da8bbd62ccae576ff4ef61bd8f1d7ba30536c9de01b4fa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
da1c993fbc628280778e52f2be3affd9

SHA1
c67a46fb373a0087d3d0e602ed2b77fd9bdb3af0

SHA256
b528cf20e7b81c63fef49fa460fa9cfee02985e207228555d2a4581120de6dc4

SHA512
aa01c4293b27f60ac5b6b39d78ebfcb10ba01d034788bb8b65007670d21bc50a58856f276bc74b657b3c88bf614508329ef6c861d4ff60e790a54770fff484ad

Download Submit