efe66032569c63e25448130455ab38205a0c7abdc9f0bb271b3ec17fc7345cf7

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c89675b741ce4a76fbd668405a1894d4_JaffaCakes118.html
Size

20KB
MD5

c89675b741ce4a76fbd668405a1894d4
SHA1

53c8abc4662c83ad9bd35daef9c4744c41bc8e0c
SHA256

efe66032569c63e25448130455ab38205a0c7abdc9f0bb271b3ec17fc7345cf7
SHA512

d8a6192f2e8bd4219179f89ac531f4c86d0db4ce8ce1805e4ac0fe8bc46b4737f0a1b0a40e860a3501ac22019c9b5969b6140719fcf85b3fbf420d9cc08b708d
SSDEEP

384:zie6KcRAa5r9DIiLVBD8ckQ3RiIFn++Qdmd5WScfIk9xheIfzVc9F:ziwa5r9Dlgc334K+JmNOIk9eIrqF

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
3412	msedge.exe
3412	msedge.exe
3568	identity_helper.exe
3568	identity_helper.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 1240	3412	msedge.exe	84
PID 3412 wrote to memory of 1240	3412	msedge.exe	84
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 2676	3412	msedge.exe	85
PID 3412 wrote to memory of 4600	3412	msedge.exe	86
PID 3412 wrote to memory of 4600	3412	msedge.exe	86
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87
PID 3412 wrote to memory of 4496	3412	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c89675b741ce4a76fbd668405a1894d4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff40046f8,0x7ffff4004708,0x7ffff4004718
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12417472716034828299,19004233528889218,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,12417472716034828299,19004233528889218,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,12417472716034828299,19004233528889218,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417472716034828299,19004233528889218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417472716034828299,19004233528889218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417472716034828299,19004233528889218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417472716034828299,19004233528889218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12417472716034828299,19004233528889218,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,12417472716034828299,19004233528889218,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417472716034828299,19004233528889218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417472716034828299,19004233528889218,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417472716034828299,19004233528889218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,12417472716034828299,19004233528889218,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12417472716034828299,19004233528889218,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
211KB

MD5
e7226392c938e4e604d2175eb9f43ca1

SHA1
2098293f39aa0bcdd62e718f9212d9062fa283ab

SHA256
d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

SHA512
63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
83b157c77eb73c6c39905fb69831df76

SHA1
14a379a082b225fec438bbc2ed9cf91fd557bd55

SHA256
44e683f70195729c9191b247c3a3ca7300334b502c558db3ab44f555d73eeed3

SHA512
03be46409024cc8fa84d464518299031047cbcca15f3c45be40afba8996be1c7bddc4146e390d6e97dbfcb31333784a5e53e011d0f559e5cbd4da9672127851e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1015B

MD5
a92399ad25674ca2e3ee5cd82c400b48

SHA1
0810c2358b49901b0d525085efbd8c578aaac9d5

SHA256
6be490c82f6d9770b9920c1d6de9e1975358f4769f9d628e8f0b1a93452dfead

SHA512
23e7d3304752b35565e9b29013eb7109eaf6560e5f9cfdb03b7d99caab94e6c6b8b7c50e3e8e626571c8d2b6f2c91950329fab308dd3c16bbfbb7465ffbd1b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1019208eaeaa1b2958c8a94febf77c29

SHA1
fc54388c1bfb91d9eca09e01f02a38e9aeb2a7e3

SHA256
be32ba7c74f5c01a9f6b8029d2b37999cf9b16934b9d60f5301d395710255929

SHA512
e9ef80c757e88d49a5cba9d3a32c3c53e89623f002302641dfc5a84142fabb738833ea350f888884d07372ccbfeaac6e988711da9badf0b7cb8d9502b3f59e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b390fb3beb001718f82c0a14dd48ab2

SHA1
44d83de0ff1e1ffba5ca494e8ff3cb88760a11f3

SHA256
6b68f81f9e411fa47c7737a01e8d52c580fba73fb7df005b161b5171c0a186e9

SHA512
0c0a38967109ae49c1444ffe67a4a9af66220a782c40160a99f122d0932edd7471f430e86000650a275bde47fef6b74531475b018910cf9fad8e2dc5f1f7d85f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4b14641fad1ec0b696f8563c71b5d625

SHA1
268a9984b3da3d6733b80cd5e0cf14679c524b32

SHA256
235e0bd25b70d9bc49068eb619e136cb133006b713734460e9e0bf0669e8e00d

SHA512
518e97fc529b3f8f00aa4163d8051961035491c5fe2faa14dbfd0627cf9473d8ba89a39e7d4b32eba2c22e8d2a9a6ad3debd840d6463133c8d05a8093217df7f

Download Submit