eecd5a0e7baa24ec670e16c6a6fac5ce9f7e7e3a90238649dc771cd896a6858d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

db56edbc1a485eb92c540d28b9586331_JaffaCakes118.html
Size

62KB
MD5

db56edbc1a485eb92c540d28b9586331
SHA1

92c29159586df04c82113b23301c0614d9ff5f81
SHA256

eecd5a0e7baa24ec670e16c6a6fac5ce9f7e7e3a90238649dc771cd896a6858d
SHA512

157462cc6c103baa71114343fa7520d160997485d2e04270ac6ac5d3643ee9e933143d0534a4f926b2a006003b4bd25e84d8f7061858cc702b08f7abcc1c678a
SSDEEP

384:3gs/TWhzcLB63idlOZsrER+ozZ1QR1ZS1Axzk1rzF1ytH+5tH+gQ2dnhwIghDVUv:RyhzcL1+GYwxRFOlGL0tpyibqyN

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
5084	msedge.exe
5084	msedge.exe
2428	identity_helper.exe
2428	identity_helper.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 628	5084	msedge.exe	84
PID 5084 wrote to memory of 628	5084	msedge.exe	84
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 4320	5084	msedge.exe	85
PID 5084 wrote to memory of 228	5084	msedge.exe	86
PID 5084 wrote to memory of 228	5084	msedge.exe	86
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87
PID 5084 wrote to memory of 4796	5084	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\db56edbc1a485eb92c540d28b9586331_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd73946f8,0x7ffcd7394708,0x7ffcd7394718
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11401080810642922227,5486874009128433357,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,11401080810642922227,5486874009128433357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,11401080810642922227,5486874009128433357,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11401080810642922227,5486874009128433357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11401080810642922227,5486874009128433357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11401080810642922227,5486874009128433357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11401080810642922227,5486874009128433357,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11401080810642922227,5486874009128433357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11401080810642922227,5486874009128433357,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11401080810642922227,5486874009128433357,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11401080810642922227,5486874009128433357,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11401080810642922227,5486874009128433357,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4788 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
753B

MD5
a6bcf544061305dcf3c6a4e04efe5fbf

SHA1
8c82e3aff1c65c3af1e45f39e61aeb8a00d72b78

SHA256
1421aac1a6982ffe556a2f5b62840f369dc1d9208958be121a97a2fe1830e3a2

SHA512
64ea4722a73d7d674112b06f8fabcb01295ffe2186af31ef611fe94f0a74e8cfd55f89bba670af2b19b8f2834e5cf31f55e1abbca5d1023aad2620b96d857b7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7953c9e43a72165d50fc78ce8a24fc9d

SHA1
94e9646246c7c02afa030cab1a534365b318589c

SHA256
763fcdd76d29fd3e4efede168bb2c6496cdb32643718f774435cbcbc88ad0f03

SHA512
706955111b0d124d2cff687a4adc624b53f6d1508b6e88fe98c640057f2ac83e3220da00fbd0371f2ce048bc380e19235f57a9ec34f0cd2362146e177bdfd476

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6799c02e080919b34ea9a35b68e1ea55

SHA1
b57efe779b4e6e83e67e0f4a88608b750a45d9fa

SHA256
cc9d131e75f28fe3be3b26a79cb91804d88968405b46a213384928a571e5162c

SHA512
a45668f7ff4544c677c4cc38559f58d9411df8cde43ffc735d5437dd4ef65ac24a52d98aa387b770f86985bd615d85189f968189b223d9a5040413171d68aba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f186c7d279202d51451ca1803e1a3446

SHA1
a829632f3da0df0d75718caa9b578b43e407e98d

SHA256
af82230c348d6dc29844b5701bee2825fd1dc3229fa3eea153bf1541282166a6

SHA512
f4810db4c494d5760c94abf626fd975284146dfb3af8bbf3185f5259dc266f1bb8813926c16deaebfe86ba1299405af686b8691a20de4bbd9807c1b184f16574

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
b3ae91da876a046d758fd29f75767cbe

SHA1
1d0968c1da48257431eddb554bb759424c74148a

SHA256
3c647550adde436e7f679a98b0b9c41befbedb20565867586d3b1d4c55e35a4f

SHA512
832ee35dee03b7fc48912d9e095858ab7dcac1be37c67826fb039b8455bb8c7a4802e4b0c6c021881d6a6d10b76bc528fc3163834463959b9af4a9fefadddaa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584b9a.TMP

Filesize
204B

MD5
3c4d41b883813a3cea648f016407ffac

SHA1
105dd509ae791ab801025108a4e6646eba45b9ae

SHA256
693c30adfff40dc4acba69db4bca031eec190575f607d13b6598a4967e5db3ec

SHA512
e45f2ac95f635ffbd9965163760935a01d2746f5d802b8faca71f12dcb7da4a849259db3d47a5b2ce04242c8d12b775ef26b216e33552c0e3383125cb71cf458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d03c802a280513fdb037492101ae5eef

SHA1
dc66b4d24e7b679e5af5ca49636d0219dc1f3315

SHA256
a84aea69762db7e7b4394dbcc0bc09ae7389f4bb2130044aa72012e025cfd5d1

SHA512
725459f7c73ab876ef8f87cc2639a1fe90231c0259e53672cb342e9012cca5fd2b9a49dde0e4209070769f3db78a3d15ff8978b0b45c27b99b39a22ef628229d

Download Submit