7aa1f0a2d7a8378341b748ae0035bd6454b55b40de5552f0ac5ee0b7d3c77aca

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 21:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f6a2db40c21d666dc24d77733228445e_JaffaCakes118.html
Size

23KB
MD5

f6a2db40c21d666dc24d77733228445e
SHA1

23b0fe4088fa392ea60befd03b312555439a394e
SHA256

7aa1f0a2d7a8378341b748ae0035bd6454b55b40de5552f0ac5ee0b7d3c77aca
SHA512

e2eb5ddb5adeefadbcc75fe23684c2db6b72ddee1f7bb60434be7250ba0f415a65902a2bd350d28cde431de129f831fcddd7e3387e7aeb96c6cbb0c0479422e1
SSDEEP

384:GWlKqTXznMrUGsi96yCPxtIhbmm9ap8+bb:GwnTgImgzme8+bb

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2756	msedge.exe
2756	msedge.exe
744	identity_helper.exe
744	identity_helper.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 4128	2756	msedge.exe	85
PID 2756 wrote to memory of 4128	2756	msedge.exe	85
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 3936	2756	msedge.exe	86
PID 2756 wrote to memory of 2168	2756	msedge.exe	87
PID 2756 wrote to memory of 2168	2756	msedge.exe	87
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88
PID 2756 wrote to memory of 2308	2756	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f6a2db40c21d666dc24d77733228445e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffb9046f8,0x7ffffb904708,0x7ffffb904718
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,17503848834052507898,12174426352058923997,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,17503848834052507898,12174426352058923997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,17503848834052507898,12174426352058923997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2988 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17503848834052507898,12174426352058923997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17503848834052507898,12174426352058923997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17503848834052507898,12174426352058923997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17503848834052507898,12174426352058923997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17503848834052507898,12174426352058923997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17503848834052507898,12174426352058923997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17503848834052507898,12174426352058923997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17503848834052507898,12174426352058923997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17503848834052507898,12174426352058923997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17503848834052507898,12174426352058923997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,17503848834052507898,12174426352058923997,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
839fc49f0bc2cef5083715d2834567b2

SHA1
72629f10536aa808a9b0cce361b3624d4a08b40c

SHA256
9a51c0d8aabab8e8b9961ed3e27d8f87ecef2db27f358a3e395397cf72b3cbfb

SHA512
98913468779604d06d8063d28fffe313bb0c80b753ba7b71cc7513b2b5701900a40d8dce3dc91cb39df531ce05e5dfa3701c0497b89eb23511ff60e91c90f29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0e623bc8c027f5ad5563f5632a2c8f0f

SHA1
1222d2be5a303d66cc1dcd481de7dea0547c1f3a

SHA256
d6cd769dc4bcdd426980b18a25228feef7e8fcf333ec26ee6c0504937809b0ae

SHA512
7999142ed4d2acad350345d489b449d25ca2fcdbb8abe2617e58d59d07a5dff964a4321f6fa3f39e6c8e8c9dca811aaaeadc60de591d06d3dfa10a4d971a10a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
847d4f0d2b816766de522fe06cb3ffb0

SHA1
ea4ef43747565a250af3bfad1aae51109fda44b2

SHA256
3cbf9e39a7a7ad7bc1f5defa2cf5c381c22069af9964aa361c35bbab396c2010

SHA512
d443f4ba5d4a6a7c2897ee961a8de5eed1715f0256be4d1858562b0cdc1a028bf56e295972ca38e62ddadf08d62753e8762140819c7d845612800030d7b5a3eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c3d82c7598e8a0e4d007b64e1053b9b7

SHA1
9db3283a10255feab01c1f4d95b3f24a6c707ed8

SHA256
96cc736c2ae2f0e331838e647c0bbb279ed2b27062a4fcf282b8ffb96b6d6236

SHA512
1a3d3bd65e4bbfaaed805d160b7a6af4b6715f25ea40672bcb440849646e59ba43f67778e7b12a9437009f4918df4c6d233322f88c4b50129c226965f94b45d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
173b6864f4dee3184b94e0aaf85f4a8c

SHA1
d687e7c9e8f3e04c4b1d22aead08160c5c9ee10f

SHA256
2cbbe3ffc7bde1e2712d89b30055ce7b7c007badefa45512f360abdf59bcbf91

SHA512
0be3d692179ae5870ea6648fe461f8bc821a302c993e094063340e5831f6beee4f6ea43f1bb2861f49e6d5d39c69563dfd94d96cef61d0cd9ec0fac470a3756f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
434797c9d6cff6305987178b2ab7048c

SHA1
cf5e9cb3db5ac7ca166a8e7d272e95718370bae2

SHA256
3fa81580e2cf43c09fc8848c9353f3214bccd9e07c020c5dfbbebc7bded29c23

SHA512
4a21d2347eebc50a45080c6eb5df477fa0170b85daf2618ec9fefd633e1d08c704ee4134e3d86f30e340aa680046f06e522e5dc608a506c2f88e47ab466aa28f

Download Submit