b4ef3ef2c594e23b67722367c5e35d9959d2d63f3184771804fc67eca9b74f21

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44ea31b927ba775d992ee42fca91cf75_JaffaCakes118.html
Size

19KB
MD5

44ea31b927ba775d992ee42fca91cf75
SHA1

10985a8ddf857fa696546248bc4be34ce4fc9fba
SHA256

b4ef3ef2c594e23b67722367c5e35d9959d2d63f3184771804fc67eca9b74f21
SHA512

a43c9e3bcbcf84eca559e000e6c083da6c2712c67576c69ae230fab1e2c896006eaf2c193d42ed865fbdd246a22b1d4842c001bd90056c9c5a8ce737e87c9781
SSDEEP

384:4+QfPFd9QZBC7mOdMoQtKfpC5IgSnbmFe7AcXq6u3LDPd:Zcd9QZBC7mOdMoppC5I9nC4+Pd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
3860	msedge.exe
3860	msedge.exe
3480	identity_helper.exe
3480	identity_helper.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 3632	3860	msedge.exe	84
PID 3860 wrote to memory of 3632	3860	msedge.exe	84
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2216	3860	msedge.exe	85
PID 3860 wrote to memory of 2832	3860	msedge.exe	86
PID 3860 wrote to memory of 2832	3860	msedge.exe	86
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87
PID 3860 wrote to memory of 4704	3860	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\44ea31b927ba775d992ee42fca91cf75_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff553246f8,0x7fff55324708,0x7fff55324718
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14933276147118411459,7971592293699903159,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,14933276147118411459,7971592293699903159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,14933276147118411459,7971592293699903159,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14933276147118411459,7971592293699903159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14933276147118411459,7971592293699903159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14933276147118411459,7971592293699903159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14933276147118411459,7971592293699903159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14933276147118411459,7971592293699903159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14933276147118411459,7971592293699903159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14933276147118411459,7971592293699903159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14933276147118411459,7971592293699903159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14933276147118411459,7971592293699903159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14933276147118411459,7971592293699903159,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14933276147118411459,7971592293699903159,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14933276147118411459,7971592293699903159,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
215KB

MD5
1585c4c0ffdb55b2a4fdc0b0f5c317be

SHA1
aac0e0f12332063c75c690458b2cfe5acb800d0a

SHA256
18a1cfc3b339903a71e6a68791cde83fca626a4c1a22be5cb7755c9f2343e2a5

SHA512
7021ed87f0c97edc3a8ff838202fa444841eafcbfa4e00e722b723393a1ac679279aa744e8edde237a05be6060527a0c7e64a36148bd2d1316d5589d78d08e23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
a226b7731f3828b8c4c7d77b143be979

SHA1
58fd22b5a43533311fb2faacccbfc5c511873f80

SHA256
6aefed6321f5478966d5b057d5f49c252a01bceb09b715238cf1cd5b7b02983e

SHA512
2fba8d820884e4ed9d782fd0c755653a47a995c735dd192399a8675bfeaa4964de2fd49fb1045bfba168555f752d015f5e2f231dda9e7f954c22e52da16a84e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4b548663c639642222a61dbdf3ca2351

SHA1
4bfb6492d5ca4a160746ad433c5f2b09fa69ae55

SHA256
1c95da69a1192528fa0c3d9e87a33238b74c60aadd18f2dbfa0f2de5cef031e8

SHA512
f95f5ef9eb577612de0e70b519f9a8cc1ff831fa08d11f66f56ba33d53cf951306e7c38728e936840906bf4608b858f608b2a0e611d1df038797b0d461187560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3cc1e21b5eff5a87c62f9323a4780ad

SHA1
1bc50c462e447ba6f43fad9c43b5540982e43641

SHA256
2b985206f64892e4bc0958e4fc7cf8f43e47d661676c6fb93804c80f6bdf9669

SHA512
a499786b5eaa3d61fb21ed8280c86f720ec0ecc944232502d482e29d74de55c7f30314f6a849daad3d802eaa592b01bd1d70301d26e034e40a3256b8336b9933

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce72bc113b68fecd673beac83f59a286

SHA1
e9dfa266a8ea922e88e81edda1587c9c7cfb2735

SHA256
17ae041d0e497c1f769cc9238daf229ed284ed455d06d4f1678e52cb1a33b71d

SHA512
8f886e87de724e014a20e75ff271ec72b500a86553164acaa5b4f00e5d34a4a7d17022e4ce01d3dbc0e9ab3481b5ffa2fdddf1a1d6f6c7ea2d8f44fc4baa6009

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d4b9e1bd2745fc266fe85a0fc43deef8

SHA1
05192e710c689390af36f33a0a39b4b63cd50b7d

SHA256
09c5b7f247aaeddc32d164929c1c8856f4585c80d844e24cc76ed546f24cdb33

SHA512
ddbd15c9be558f288a5f1b4027af8eb978da5ae473fb307693217ae88e66720ee4ab27b438d3df4b617a89da23d5ced6037dda30222762023ae795a1410c46b8

Download Submit