6317ad6d77d86ba3b6ee4f9b310790384374c916edc0de6b96478726875a68ac

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56834f6673f254c3bf96b14e46909565_JaffaCakes118.html
Size

16KB
MD5

56834f6673f254c3bf96b14e46909565
SHA1

b028037c8c7906c2c9cec9b3ada2ff1b7a850291
SHA256

6317ad6d77d86ba3b6ee4f9b310790384374c916edc0de6b96478726875a68ac
SHA512

41d821795ba8b5d30ed12693411e34f3e4913110a36d654e8af2575e54667a2d6d76b63b3e3d40acd346509e5c30e2e1fa6ccd502c2d5255b866e071c548908a
SSDEEP

384:Wwmcf3MVsE5ca9hL9bVqcRyXoiBNklmWX92V:Qcf3AV5hLmKYWXW

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe
552	msedge.exe
552	msedge.exe
2452	identity_helper.exe
2452	identity_helper.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4716	552	msedge.exe	84
PID 552 wrote to memory of 4716	552	msedge.exe	84
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1884	552	msedge.exe	85
PID 552 wrote to memory of 1792	552	msedge.exe	86
PID 552 wrote to memory of 1792	552	msedge.exe	86
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87
PID 552 wrote to memory of 3536	552	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\56834f6673f254c3bf96b14e46909565_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8983846f8,0x7ff898384708,0x7ff898384718
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2284,1659156003605141213,14256215249269055292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2284,1659156003605141213,14256215249269055292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2284,1659156003605141213,14256215249269055292,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,1659156003605141213,14256215249269055292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,1659156003605141213,14256215249269055292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,1659156003605141213,14256215249269055292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,1659156003605141213,14256215249269055292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,1659156003605141213,14256215249269055292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2284,1659156003605141213,14256215249269055292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2284,1659156003605141213,14256215249269055292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,1659156003605141213,14256215249269055292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,1659156003605141213,14256215249269055292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,1659156003605141213,14256215249269055292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2284,1659156003605141213,14256215249269055292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2284,1659156003605141213,14256215249269055292,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
215KB

MD5
1585c4c0ffdb55b2a4fdc0b0f5c317be

SHA1
aac0e0f12332063c75c690458b2cfe5acb800d0a

SHA256
18a1cfc3b339903a71e6a68791cde83fca626a4c1a22be5cb7755c9f2343e2a5

SHA512
7021ed87f0c97edc3a8ff838202fa444841eafcbfa4e00e722b723393a1ac679279aa744e8edde237a05be6060527a0c7e64a36148bd2d1316d5589d78d08e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
2f101873ed9e16b9a5218dff2544f246

SHA1
850db5f0889254deea3ecfb2bc7f0a8f494edb0b

SHA256
d37b1adc5f6dee9403db767e0067e82f164e4627bf31854b3982baab691834d0

SHA512
ec786f4af8c097e47e0341e0eaf3c060fd26474aef20a706e823ca227829e4999702581355b58fedd72d0d1a3ba86d7b45c694780497c9519d15adb2c343502d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4497b2f5889684075f8eb9c6d93585b5

SHA1
2adf7332af32b19ec6853762ba4626f3b4877f40

SHA256
08e6c4f95c14857b9bc736826e27a85526b2ebc69afeb6ba1a158ec20562928e

SHA512
52b25b151eb7a8e64ae6f97353c0d3d51224497f448056bdc540f78c45970aec87cf0ec594863c0f9be12010a4098237279983f42063413a00ba3fe6a02143a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f03f4bea566f2c0cfd8875fa6fdeb6cf

SHA1
76e95b943c250e87a7b0e2ad60573138549302e4

SHA256
1383e67fe3012e313ad2b263eb1d14c58d8f99cf8098698f81dde4633ea9a121

SHA512
71b8900b59db574ac5254ee7fba8d26a24137a8030920a93abe12193527ceb0b9fd16042b7335fd4b7dc01e5727e0164b381c396dc1fcff61f72de03d11a9b91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4661ed558cac110966023e20ca340759

SHA1
9239789aa096f149ab68cd106f5d40d15e009bbf

SHA256
f075b95100a705e03a01ef701e095d1daad07c5443c462a296f07b3d0736e7ae

SHA512
fe696cc9b6715002b1d2780ad0e930439550be301dc76c68a86076ad52a769d3b1fbb91c0838c7eb57ce73a199859a11466f1c85c3004d92d4cde4f60e9da20f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
68a01ddccad4f9077fa1400f4c76aab3

SHA1
9b915b0c22154d89a79015e417fbdfd47089ecf2

SHA256
987518df932dd2812a2aeee0dab4afff6c0dc74cee6f2af3d4255ecc21065a5f

SHA512
c870e7001e2b5b8b95423312c862891c2ee5eaa5e792d3d0c17264b8a446c27dc1a7f70d5aca7ed795f35859584c60648e463b7dde05bc394c4cd8ebfa9cdd6a

Download Submit