b45b5341a2b8836b3152ab4a72e36b1f75e4b9f942a4866201157079317e0b72

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6843db70ac40c871b402ee69477ca2fd_JaffaCakes118.html
Size

201KB
MD5

6843db70ac40c871b402ee69477ca2fd
SHA1

fdb7275a18c5452141093ccbc1d91d0db4d82b28
SHA256

b45b5341a2b8836b3152ab4a72e36b1f75e4b9f942a4866201157079317e0b72
SHA512

9bc8fc9f05dd58c6b70af63bf394a9f36c7fcc73276d2760a6e18d767b051ddf24f8cc49fb2410e42bd7fe498d9f9bd333a4b357b1fd3a3ac2f8523d90c5de83
SSDEEP

1536:kaGLr0ukMaod8aIrNhQGYheOHjw/GybVPy49nF08GvM:dG4Vj

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1908	msedge.exe
1908	msedge.exe
2736	msedge.exe
2736	msedge.exe
792	identity_helper.exe
792	identity_helper.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2736 msedge.exe
2736 msedge.exe
2736 msedge.exe
2736 msedge.exe
2736 msedge.exe
2736 msedge.exe
2736 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2736 wrote to memory of 2808	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2808	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1348	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1908	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 1908	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe
PID 2736 wrote to memory of 2440	2736	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6843db70ac40c871b402ee69477ca2fd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaef7f46f8,0x7ffaef7f4708,0x7ffaef7f4718
2⤵
PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16334858613020287986,1486705434543989325,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
2⤵
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,16334858613020287986,1486705434543989325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,16334858613020287986,1486705434543989325,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
2⤵
PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16334858613020287986,1486705434543989325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16334858613020287986,1486705434543989325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16334858613020287986,1486705434543989325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
2⤵
PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16334858613020287986,1486705434543989325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
2⤵
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16334858613020287986,1486705434543989325,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16334858613020287986,1486705434543989325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
2⤵
PID:3776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16334858613020287986,1486705434543989325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
2⤵
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16334858613020287986,1486705434543989325,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
2⤵
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16334858613020287986,1486705434543989325,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
2⤵
PID:1560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16334858613020287986,1486705434543989325,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5056 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\54ab9cb9-a3e7-40e0-be15-992b892ca8ea.tmp

Filesize
11KB

MD5
7575d4e7957c9062aff6e40205109b0c

SHA1
7c033feaac81ed23ce58ec3473cd663810e0fe34

SHA256
fe53f0c65c2f913396e4cb93063d2aa858d8df132e4db405125783425fab099b

SHA512
f0e53ab51d55ca575d5b9774e49c1518869cf3ef8286979620eebc9d5636f9461ebfb99f965fc3670edf2cbad425550580437b368e6480679efd83dd4bdb06e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
255B

MD5
6216a07695629959bd035d0fbbce1706

SHA1
1b4849422fd2d05b90c95b79af525ff7bdff2f9b

SHA256
d5f4ff7858e246040cb1f2e5b11eb2310a483a398a7e361936b02457a00b0702

SHA512
0e46fc6091473e812a6b084ae2960e5721a69c6a7fbb32807ea4db735292b0de4cfb0c047593874fd0f07b56b89efa288596747d9978e3f625bcd39297e0b41b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3e81ae1a152df1e937baa591eb0cfec

SHA1
bd57bd05a09cda590f04961c5383dc99452cbd6a

SHA256
b05dd8e0adabec5aeb7d68984cfb26cc60a429675afe967aa6905fef96898c33

SHA512
d77f47de31e62f25f6ea3867413decf578ec2ec828db7f43a5ee1149f2e1c8ee36e68400e7203bf50e49cb44131dcb47abd3ff4ce9b1554bba7c7e26782710bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
503597f5bbe69430879828dbf46f20f4

SHA1
4922096e5419171553f83309ba0567780acf3415

SHA256
8884b651679e8976df405ecbbb5884eda53d9491933322811c6835ab0c67ef6d

SHA512
e65247279da49c889375e4055415340609b7ef70e2f93c019d08e83674737801e2416a24d3552ce2e70829e55a74a095def276943479bc2bb5d61263b550aae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5337efa525a1edd6ca1181703d377590

SHA1
84e9d12ad7151c7584479158a658739f8768e4ac

SHA256
8807213c9e889d5cf59ba4ed8e866fd35af871fdca4ac92f810430db3a78109e

SHA512
7f8792440175d5c91a5324ca7878ba36e732f2c7d7c1bd2a202faefd71a7f5b354747522f4c931547202656e1bd92d5be8fa86642e17b8d50e97a96aa8d097b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
\??\pipe\LOCAL\crashpad_2736_FVOPXIJJFCOYSMLN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit