0585fa60d346f967d9150d303e4437bd3bd0650fb9f967cdaec796d7ee5adcd0

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 05:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bdfa7ad6af662c397c4ef193458fccb0_JaffaCakes118.html
Size

45KB
MD5

bdfa7ad6af662c397c4ef193458fccb0
SHA1

ff6f724fc7af50fd2a563fb6e663d605b6736e81
SHA256

0585fa60d346f967d9150d303e4437bd3bd0650fb9f967cdaec796d7ee5adcd0
SHA512

ee5c53bb5acbc1bb1fe982febda08108ed16845d951fbd7c99c2619ef73ca8a8516101fbf90a4e25198d409e533bec197f5874a342926c4f4bbd4d5ee169a38f
SSDEEP

384:WJd3vMiky8FMHIq4atGtU4mIqIKI2Y+oKoygRhl5KJK:ud3Cy8FMdg0Qhl5K8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
3632	msedge.exe
3632	msedge.exe
1364	identity_helper.exe
1364	identity_helper.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 1672	3632	msedge.exe	84
PID 3632 wrote to memory of 1672	3632	msedge.exe	84
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 4560	3632	msedge.exe	85
PID 3632 wrote to memory of 1008	3632	msedge.exe	86
PID 3632 wrote to memory of 1008	3632	msedge.exe	86
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87
PID 3632 wrote to memory of 3708	3632	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bdfa7ad6af662c397c4ef193458fccb0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a90f46f8,0x7ff9a90f4708,0x7ff9a90f4718
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,14363302659528160060,11879640859107171923,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,14363302659528160060,11879640859107171923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,14363302659528160060,11879640859107171923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,14363302659528160060,11879640859107171923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,14363302659528160060,11879640859107171923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,14363302659528160060,11879640859107171923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,14363302659528160060,11879640859107171923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,14363302659528160060,11879640859107171923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,14363302659528160060,11879640859107171923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,14363302659528160060,11879640859107171923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,14363302659528160060,11879640859107171923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,14363302659528160060,11879640859107171923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,14363302659528160060,11879640859107171923,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
97cc53fee917cbab257fe90eb9db12ec

SHA1
409fbaf3010f9582cb5d84d94623430f1a8225b3

SHA256
35e4c2bb55a64f8d0af250d5d21221c99766ad17dd0bcda66fec87ef6b7f78f2

SHA512
cbcf0a8a76700766088e842ab7d45432dc3a419be38578d97046a1c6bbf283a90fd536f9238c2ea0fe41dfb37cd36d68269ffbd7969650bf79000ec6b3eb75bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
97b5c71c210a1dca4f9da7c5747def04

SHA1
4b4d8929a6ac16b06e2656d429651a5ec3cbf453

SHA256
5ae8fbd22fab6e31b37df7183a936e12776892d14c7fa20550c7a35db2a438bd

SHA512
d5341d252840049695d8697eb785ae8474dc8790edd6bc982f64770dd8021a48a9bad5de0fe379833f826f926c50547d0422e2957c203e4df05740d5ddc1b698

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dced1bbb7e629de62a177cbb9711d4a0

SHA1
318c21b8cd346b0bb17931412bac9001bcb2359a

SHA256
4c55124e6a948c693a200a065873f43786eb499241f45bbe2a7836fd5cebd1b9

SHA512
64e46ac9da4d9f0b689c5dd15aae4381237a8d13176b2ef37fd4aeef0492f275dea2419ef759d7a2ff42a53aa10f2a00767b70cb0f2e91629f8cf2373c2a3754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e018de2c456a7f7107cef8346fa60a2c

SHA1
1d66873cbdf1fce5a2ffa3afdf8d3dcfda213b4e

SHA256
8e5b71683b0365888448cbb9ae681d936eb27b3dd694bd4e68f5245a0c2e7145

SHA512
e573f9881ba7a35433333bacb30f23c9353e1848fcab609d81391abcac4176207f3b18b25c95422e1035dec49f49fdc3eeeb001db0b7225ed76c595b39f6e17d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
4fb2d5a14687bfe159431b7d7e4e93e6

SHA1
3548707c3918e1d10f28d18ba8d8c6b252a446b7

SHA256
b4a14ab58241bdc1a2d74511c746f5a3363f151162a0b1029c58789a777b5be9

SHA512
f98baa76d9ea2723507adde1b52999165259628a8e347fe08a9d25fde5c3f97f0447910adee0fac08979542eba845ac7b0cb24b4e5d1d8b09e458055101059b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580664.TMP

Filesize
372B

MD5
a50ba8989a3200d68c5d85bab259a4ef

SHA1
d809a244103e0b464d72e4192f7b0cd5234be99f

SHA256
76c823c73bc02d35fee0d6792f2d3e9edcf66add176de9c76ce5b44c9948bfde

SHA512
ee43f742d0a8d608a7999ad5a33f13759d539e773228cef32d16b1d1a09774bd5e10cd9fbda130992f5cd5700f26240020a2c038c1bbe34e982afad6391a1601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
582dc64a729b2b8463287c087b7f5585

SHA1
0101efb6d00c4edf67d0b2be3ec2fd0cdb166e85

SHA256
898bcc75cafbc8bf7065086a8a92d2b7fb1d0a7926a1457462cb9ba560f66a11

SHA512
b5da5425e923796c8c1e39694b97af5bf318ba9b94d355bb6d5acef024d26a50e228f94af4fa4d25f6ae70263ef2f916d11a9b9834b86ab3225ce9196a2e97da

Download Submit