58207d14c3d2fec4fab87f48b0a9b3799655526a590e1432dfce87b20bd7d0f7

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37d61ccc42048307a5ac74bc9ee81f99_JaffaCakes118.html
Size

57KB
MD5

37d61ccc42048307a5ac74bc9ee81f99
SHA1

6ec4412570b550f01c7fc546e42a8a84a00b31dd
SHA256

58207d14c3d2fec4fab87f48b0a9b3799655526a590e1432dfce87b20bd7d0f7
SHA512

93026126c6928fe6b3b3601849e23dff25ef7c130f011dbffc384164765227051d89352f8289bdc685e5e7d2407aaa58a78cbe20a79420537dec7fde94118c7c
SSDEEP

1536:ijEQvK8OPHdsA1o2vgyHJv0owbd6zKD6CDK2RVrolEwpDK2RVy:ijnOPHdsR2vgyHJutDK2RVrolEwpDK2m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
916	msedge.exe
916	msedge.exe
3884	identity_helper.exe
3884	identity_helper.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 848	916	msedge.exe	83
PID 916 wrote to memory of 848	916	msedge.exe	83
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 2928	916	msedge.exe	84
PID 916 wrote to memory of 4224	916	msedge.exe	85
PID 916 wrote to memory of 4224	916	msedge.exe	85
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86
PID 916 wrote to memory of 3188	916	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\37d61ccc42048307a5ac74bc9ee81f99_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc179d46f8,0x7ffc179d4708,0x7ffc179d4718
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,18221857110113462637,10252579818489760121,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,18221857110113462637,10252579818489760121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,18221857110113462637,10252579818489760121,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18221857110113462637,10252579818489760121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18221857110113462637,10252579818489760121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18221857110113462637,10252579818489760121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18221857110113462637,10252579818489760121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18221857110113462637,10252579818489760121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18221857110113462637,10252579818489760121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18221857110113462637,10252579818489760121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18221857110113462637,10252579818489760121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,18221857110113462637,10252579818489760121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,18221857110113462637,10252579818489760121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18221857110113462637,10252579818489760121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18221857110113462637,10252579818489760121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,18221857110113462637,10252579818489760121,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaaad45aced1889a90a8aa4c39f92659

SHA1
5c0130d9e8d1a64c97924090d9a5258b8a31b83c

SHA256
5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b

SHA512
0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3ee50fb26a9d3f096c47ff8696c24321

SHA1
a8c83e798d2a8b31fec0820560525e80dfa4fe66

SHA256
d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f

SHA512
479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\852d1a72-51d1-4d70-ac5a-acf163596551.tmp

Filesize
6KB

MD5
503afa1365dc032fcfb5755807acc9b5

SHA1
ac3a62e1aa0d98951e2dd743debba4db01990476

SHA256
ace1d2aeda72b73bbda019bd145675c96ed0fd8dee126e490d14243e6decaa24

SHA512
fbd5fcf0c17280ba766c9810e7600a76f0ec09ceeb3ab97804ba0b548cbbacf56e3cb045cb58c424f4b5f2642c0e11e78a76a1568dabd7caf059a9ba09f6d7f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
bd9d5e6e64c828b11f9f8f09654973df

SHA1
099630dac42628e7e4c14750fbf316c415603551

SHA256
2aebd74aacc5a657e754420599ec585324c7a97e6221fff6238db9b98a593c53

SHA512
72cbf6a461a173ef50fbe6a1266445969803fff61f1b4f1d4a345299106b2dabc0b69d72aea2d1686594492836685b1b808854f037331a35220e54f64e5a8db9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7d8c5d2e2c84ef325eabd0a9d18de3b4

SHA1
a7982928a75474661f8ef7d886130eff806aa7f4

SHA256
e679da57347f31b6b5f54a70c23705f0960aa4226ae54d390ae1448b4e7a7cd5

SHA512
931721f126a38046d2defa7ab20faea239fdbae3b1733c933653b7647014d6d89cd35e5a391978b640038fde327c00a21fa42f042a62653e76a3cb3b0c7aa3af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2374cfaf385f618f0a0dadbf9b3ee145

SHA1
fb1cc144aa20acf48c9cd8986e01a95106a24051

SHA256
35becc9aa03616486e56557c332d34caa476e6e709b69fa865be7d898b1f6618

SHA512
fe62e795e4ebbc554fe2a53c4adc3f586308c48cf3263a8b0a9d1b750c01dde899d19d62ac0d8a2c89db8804f03d2cc7d604781a8cc974697d912bdd4352a7e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
64683d9e258bb36aab17e9b9d5a5c817

SHA1
e40cf6b3df98efa13999481699c39c266b52bd87

SHA256
898a270b875345c4b09ff496f5b76712d661284d102d72705a4ae40b671d636b

SHA512
776eb12297451f9f92ee81cea94cb531cb050429cf81f756485710713f6a7b8ec165f2891e2097f34a0066ddd40a75b19f0c6842fd12852037d656aa3015ee23

Download Submit