92ed3a3a2608e1f2f910a375c4f8d3aa12e5eec84f3e1bb749d9a0b78c24c6d3

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b758d1fa68b2e837bba512ed0d260a9a_JaffaCakes118.html
Size

82KB
MD5

b758d1fa68b2e837bba512ed0d260a9a
SHA1

b4f6c8c0e3116e2d750c0c539f8d23110952b1d3
SHA256

92ed3a3a2608e1f2f910a375c4f8d3aa12e5eec84f3e1bb749d9a0b78c24c6d3
SHA512

9c8054c99aa44c0cbc579e21c6eafe580ba6fe9d444cd2f1d0b8ea898f6cfc9a8428a7c8290c830b428468f01fc132252199c862ad7cbe8fd67176f964520d91
SSDEEP

1536:8EspD3uUdosuFvoGJvLHRvLHsdxkGSCrC:8EspD3uIo3oGJvLHRvLHsdxDSCrC

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4076	msedge.exe
4076	msedge.exe
4524	msedge.exe
4524	msedge.exe
2552	identity_helper.exe
2552	identity_helper.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 1576	4524	msedge.exe	87
PID 4524 wrote to memory of 1576	4524	msedge.exe	87
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4024	4524	msedge.exe	88
PID 4524 wrote to memory of 4076	4524	msedge.exe	89
PID 4524 wrote to memory of 4076	4524	msedge.exe	89
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90
PID 4524 wrote to memory of 3776	4524	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b758d1fa68b2e837bba512ed0d260a9a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc538f46f8,0x7ffc538f4708,0x7ffc538f4718
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,11639390217487698534,11653686537748274830,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,11639390217487698534,11653686537748274830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,11639390217487698534,11653686537748274830,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11639390217487698534,11653686537748274830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11639390217487698534,11653686537748274830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11639390217487698534,11653686537748274830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11639390217487698534,11653686537748274830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,11639390217487698534,11653686537748274830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,11639390217487698534,11653686537748274830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11639390217487698534,11653686537748274830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11639390217487698534,11653686537748274830,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11639390217487698534,11653686537748274830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11639390217487698534,11653686537748274830,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,11639390217487698534,11653686537748274830,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5324 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
16e66bd644d1913de48fa541110c8062

SHA1
1205cc96abfcb137537b05fc8a5f23e05892df1e

SHA256
a1139a9a5bda58e071fc914f82fa7c899c26f74c9deca4168f28bacf0fe30694

SHA512
df15bf751554795a6fab0870935e59dbaedca08ef0d7d7d2a3ddb61c1c7d282b864d8e3df6606b3eec95493233db7cfd6443d1773014ff0bcaba9c72b43533be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9081b06d2ab8686fe50b4a209f5d981d

SHA1
198c699a1ca0f619a6e9b5a06ef1902ab83aa055

SHA256
247a326c16e37ede436c1e2450ba580f6156e981d5826b920f5739ae26d8d550

SHA512
29cff3a368ec99bafa9930dc29657f9900a22704975022dc10e8ce847997234f4f2cf8e6041b656f2b157d16fc3df766baa53272a6d7f7b64b16921b564c0e88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5183e648a084680f601d1ea5a3573e96

SHA1
4c58bb65736dd8aa5cd44887b2981dbba92f0d95

SHA256
64631af1ed059bd5660b4fbe3663cc0565b334cdd285d1f3016a2faa28a59f10

SHA512
5ac8841375f32024f3f7c1fb48f5b5ce3816b503cbae4dde01f4ba1ae0782a560936aab55ad1c0c1c1067b53f4be9eff2ebe3af9ea74864f56e1faec68086380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d37f119d4681b4757a0dfcc7a57248c

SHA1
7efe7621d759567c139bb6239b2c946ac459c11b

SHA256
76f70f7abf9452ac05ec960a5ae956ae33c70d66058b777b1bee727b08c024c5

SHA512
a0d8d74a4ed086d74a9e922d545652632a54d98d8ee704d293646607c9907eeb449109b76d89dffc8aff4888ac7475e511b41636323f757582f48dfb67e5fb16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
11ebf6e98b6c0023d39931f9a85462f1

SHA1
b2ea0b7950ef52a40709268511dc5087b5c30d3e

SHA256
4b17cac9518557692b7ac737d65681c9c22f85ca14a70149bb2d9d66a1720e2c

SHA512
e7f4a61a8ff76f9c5d6871b6f4a4dfc9fa6b8b1aa872a014fa9e502e500762cf8ca12c14373503a7daee7179ec0b6e157cdcce58edfb2803aa0d1dea5b152c2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b9fca449c16578377a7bc5993a5a4f09

SHA1
8774df88d8d2512f00ae96598555da2fe1ac5437

SHA256
df444b1976ba9f31e99f75ff311ee62e0981d1bcfea76950a2880ee7ce3e8a96

SHA512
7a9a881daf1c0c4541ce8daff88687c386365459fcd93ca969d883eddf70023b2741d602d55c8a29ee6e80fe1053884a98835c270b425cb074eb7a26acda0d9e

Download Submit