496aa84241992dcdb9644b671afd29975825cf72194687d2b561b553f7efe14d

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c5d5f2b59b5755b13f61c28f3044bc0_JaffaCakes118.html
Size

69KB
MD5

5c5d5f2b59b5755b13f61c28f3044bc0
SHA1

f3f4e23519fb4947fcc8448ad39c5e60f14d4f1b
SHA256

496aa84241992dcdb9644b671afd29975825cf72194687d2b561b553f7efe14d
SHA512

7f0adf98af3b73469bd421574d1c518a6c22f6ff3fea8718b605a825c5863e4d8479b2c1e8658673f6825e04d2aab98841a48c890fefb68e3130d14de0454a2d
SSDEEP

1536:gQZBCCOdH0IxCjKXgtQwVA3D2r8/iZDgK7lUiS4z9cHMN7DbXozgWmegVnqjrpab:gk2t0IxFgtQwVA3D2r8/iZDgK7lUiS4n

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe
436	msedge.exe
436	msedge.exe
3880	identity_helper.exe
3880	identity_helper.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 64	436	msedge.exe	84
PID 436 wrote to memory of 64	436	msedge.exe	84
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3824	436	msedge.exe	85
PID 436 wrote to memory of 3508	436	msedge.exe	86
PID 436 wrote to memory of 3508	436	msedge.exe	86
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87
PID 436 wrote to memory of 628	436	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5c5d5f2b59b5755b13f61c28f3044bc0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb39f146f8,0x7ffb39f14708,0x7ffb39f14718
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6091067747456171882,6306818248644444234,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,6091067747456171882,6306818248644444234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,6091067747456171882,6306818248644444234,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6091067747456171882,6306818248644444234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6091067747456171882,6306818248644444234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6091067747456171882,6306818248644444234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6091067747456171882,6306818248644444234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6091067747456171882,6306818248644444234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6091067747456171882,6306818248644444234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6091067747456171882,6306818248644444234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6091067747456171882,6306818248644444234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6091067747456171882,6306818248644444234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6091067747456171882,6306818248644444234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6091067747456171882,6306818248644444234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6091067747456171882,6306818248644444234,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
15b6b7bd95e99961792883cbfbd361ee

SHA1
e9284f71cb9db9fc669a6cefd985a218e5de74cc

SHA256
c7edab66902e87da6b75db75824fbcbf09fad22141fe3ed1168646822af5b568

SHA512
3ac2d53176690129bdd3c2221f34df5c5a33a962cb1ebc959314ccbad21f2caf6337f7302cc392625abfd77798ade628bc4a7d2c2471c9abaf8db577493c01ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
30014ab9c53329926e6baf500b17a857

SHA1
30edb1745a1a2850af2a86cc8bc7d9d51a4e1c03

SHA256
607b6dbc5aee3dfea3c40dff40cf53c7c806074f6b336da5a872828bec2fc4ab

SHA512
ebd7e7ca5e3fe1103c71c32475fda6a5d1df407393e4489a1172cc2898000c5690774b35f3f9ebae298846bb35c0f621930c6d7cc6e367349f5f0d491547c5b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b97c07201dd8ed0ba014317e8f50ba92

SHA1
06a99283f113a8f9ac4274892bb07a2130688f89

SHA256
527debe4d491b09aed8ee58e8b329541069d52abb16579d4645a9f9f4338985b

SHA512
bb4416f2741c47565e484b303744e630d1a00d1d8aa4861ed6c0a0eab99e61cef363926817acff7ad22386d97b5b571729621cc92da714d008f8b66e51008bc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
942d5aca8004ac94ebfb55003c3a87ee

SHA1
267defeabff6e3cfc65ec172ce8a3a968551b036

SHA256
30dd8b5fccfb226cb8f896b6a2b1bc2b8094f3c586c810de368dfc47dd17cc2d

SHA512
f1b3a5029a1f9c27e0fea7c25c0139edf855e772b19cdd3ef86b2d1bb1eaa2618373b1edc2f8cced4269fc04b04b93f045ebe87d1c1cd25f791951d6b5e2e20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
62527a7472346884ccfc17bd45cae985

SHA1
aca3d7efb556ce40afce521dba5b82ecda1013d1

SHA256
6a83add8225ba5f9bcc7dec0341b23a1558959ec758c2e77ac3696f6f56a66b6

SHA512
a3c0e2c3ba8d662359f9fd47c3cabbd5ff37de579a511cbd2d66232ffc7a22ee60165e381142c6ef9f69ab8e846ed4f4a730037e08416891fe9ba042e4a61902

Download Submit