40ef11bd59125964936632abff5167a213e1107f9226c94b239e9bb2746bed53

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d684bd30a891ef554138c921fefab47b_JaffaCakes118.html
Size

68KB
MD5

d684bd30a891ef554138c921fefab47b
SHA1

b0f123107ea1f3bf2a8d716952036b8a5ba8d4cd
SHA256

40ef11bd59125964936632abff5167a213e1107f9226c94b239e9bb2746bed53
SHA512

a8e970d9f059bbf0e28daa69d3fcf03de1086c90e6f4b56ad0c21de23174f4e2ff7209a548f0e1669db9b6707a8c61fd1de8fbeffdacc83deb2b3a6d8f1d797d
SSDEEP

768:JiHgcMiR3sI2PDDnX0g6QK8lgagWzWsB7gWbaoTy/ZwCZkoTyMdtbBnfBgN8/lb8:JfOEFgAjVgeDTaZen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe
4544	msedge.exe
4544	msedge.exe
4432	identity_helper.exe
4432	identity_helper.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 2556	4544	msedge.exe	83
PID 4544 wrote to memory of 2556	4544	msedge.exe	83
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 1120	4544	msedge.exe	84
PID 4544 wrote to memory of 4696	4544	msedge.exe	85
PID 4544 wrote to memory of 4696	4544	msedge.exe	85
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86
PID 4544 wrote to memory of 2688	4544	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d684bd30a891ef554138c921fefab47b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b7ca46f8,0x7ff8b7ca4708,0x7ff8b7ca4718
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7165503927150072088,10782260657917093445,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,7165503927150072088,10782260657917093445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,7165503927150072088,10782260657917093445,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7165503927150072088,10782260657917093445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7165503927150072088,10782260657917093445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7165503927150072088,10782260657917093445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7165503927150072088,10782260657917093445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7165503927150072088,10782260657917093445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7165503927150072088,10782260657917093445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7165503927150072088,10782260657917093445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7165503927150072088,10782260657917093445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7165503927150072088,10782260657917093445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7165503927150072088,10782260657917093445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7165503927150072088,10782260657917093445,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
ffe65e9c02a01ba4cd7b046f87aae19d

SHA1
c51e379874090369960ec9f4f0916763ef23a4c0

SHA256
ea587e9f76fae26d3ca8d6ab45d6f6fe2c8490a5a544dc4c63b1243bec57df86

SHA512
a465c36866d8a3e8eb81826f087c61de0909e2aab084e75f2cf4a0de206226ccb6b5329783bea60f5c0167411a887d6317197bf3851647f80656dfd0de369f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
163aec307f837feec9b1c6d737032455

SHA1
4eb4c9e6657b7cfd03a3c67b3d413ccd80f929ce

SHA256
f6007a8e15acfdf84ebc46a91df919bd0ec24b089d1df480d680a6aa19ef132a

SHA512
9fb0f910c64b2a6ae7e43be526a4a72175846829323f15e3563fbc89859a64a091889177a87fefdfe3fe49cab33a3879aca579af50f0403836a64d06ad90a370

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4056ff040c31f259b16e0b8472bc5801

SHA1
beeb9b8b64875d9974c59a260454e2a78d33177a

SHA256
2edab3dc0a2b69aba943563436eab1d4187f910ba9f90e90b1142a7a5adac839

SHA512
708eed1a230410cedc5323992768df709b43431d6c9de1079bc684effd13ed1b899df1696d3b5ef956b34da9c68b0d43fa36c3960daf34ee7b8f2c20e07b5cfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8372a7bac95162e4dfa979fdb4327603

SHA1
3bc2d0d972cec21242aeac2e65fe1f2339463441

SHA256
00d000d6abfefa21e32a13bcbe66f9fdca410093545d4971ca82b1db2d0cc1a7

SHA512
6a0f6e967090c4e165aa06186402ab46b82aed03def02ae94785bc02250df04aa8ef5f96b953e157e8bffaecd6af1fb92c9b8e68e70e6b76969422734cf94c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aab110f2fa7fd19df7e445557098e75c

SHA1
00f06fee6d5ad6f08fea70929418af1c51637dbd

SHA256
06cb99f9da7f9088f913749b1a0c6fad1c3ae21c7f9db154d9a24c0aa185999e

SHA512
08dd63b655ea1687a2d6928b00dcdaa111bbf0d89c6e294e1cbc9b0b259134097a91603ce5404bd6b66275f233d194d77b7b26b29806fa7298b5ced6db47d300

Download Submit