1c476eba14acce076ddceac0f21810fa1f6cb1ca4f3806d4eb05fadc7d2cbf95

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5777afc93644de97505424901c875728_JaffaCakes118.html
Size

23KB
MD5

5777afc93644de97505424901c875728
SHA1

5e5994d7f694fd06fdff624b283f955ee29ac717
SHA256

1c476eba14acce076ddceac0f21810fa1f6cb1ca4f3806d4eb05fadc7d2cbf95
SHA512

5277fbb654ad7dc50ea1959159384cb7edba145adf582066259f97c11e664c42ec3bd358dca6fab13d1c0f829c509c3de27569db647b847fb69755914f516d9c
SSDEEP

192:3VVbJkMmzN2epeY8wHZYy2GSGvBTGRqDJyjXIRKDvo/nymbcGjcPdMyIGJeGK6VC:bbJ2TzA0DUFI1cPdX66NqLUDUFIo

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
2648	msedge.exe
2648	msedge.exe
2620	identity_helper.exe
2620	identity_helper.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 4264	2648	msedge.exe	84
PID 2648 wrote to memory of 4264	2648	msedge.exe	84
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 3984	2648	msedge.exe	85
PID 2648 wrote to memory of 5028	2648	msedge.exe	86
PID 2648 wrote to memory of 5028	2648	msedge.exe	86
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87
PID 2648 wrote to memory of 1176	2648	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5777afc93644de97505424901c875728_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa99af46f8,0x7ffa99af4708,0x7ffa99af4718
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,3671791346818553147,14851691808482146305,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,3671791346818553147,14851691808482146305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,3671791346818553147,14851691808482146305,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3671791346818553147,14851691808482146305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3671791346818553147,14851691808482146305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3671791346818553147,14851691808482146305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3671791346818553147,14851691808482146305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3671791346818553147,14851691808482146305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,3671791346818553147,14851691808482146305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,3671791346818553147,14851691808482146305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3671791346818553147,14851691808482146305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3671791346818553147,14851691808482146305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3671791346818553147,14851691808482146305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3671791346818553147,14851691808482146305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,3671791346818553147,14851691808482146305,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
9e7ff5c2cbb9e7c6cce9f75bc845ca36

SHA1
451f5f4e6dc2343ceb8b0bb349a8fd13917f158e

SHA256
fc8c5bc61bf18d78dd54365c9a9904a5f02a127305e0fd4a459b638ebf84cf9a

SHA512
de15255fd2cdb1f8382b78c719f86bbd6a2aaa05fc0948086415764499d8791ee662586c5754b59af51e7b883aa0acb1a2a557e6e328e45f830be319a2023e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
836B

MD5
de8788458e7cdb31df800ed207b67162

SHA1
b1614045a25de5066dce8085018b2bcfaf9761cb

SHA256
2325b3c06ce7418984553ceedfcaaca43929bece608d42c4d60fa3a17133c097

SHA512
3caa6621dd2a7e67adf8621fb4226f5271025f512cb5a20a85fe99e14075448ac85f7bfa32abeb93b00c65aa7ac811720a7840562e19a45e03a61d083c399e95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
742d5d487b67fc98b70b21f8ae2233bc

SHA1
1996417d182c1b2a35ea3dd25913a2638a246aee

SHA256
a58d47116b0568418ee9dd7bdf68ca6c208330ad7582be12f10c5c557715069f

SHA512
c1da9061431e813c80ad9977ad2665b77c447d8805f8553a47dcf0ed32ee2ad7d748bcee7784e42f565a4311ac2b7a4cc3d7287f1bb30d1e055f519d0daf74f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f20927bb28f5b47ebe1ac9f55f94c604

SHA1
4a9fbaff89935584512b9e6aab82f837ea385ca2

SHA256
18f6792619b1b9363029ea4a4fc5443d6dadc5d8ef0d6d4b6deefe477d400683

SHA512
5da058dbacc5761cdd366ed0fb6b89d2222503d7ba3dd820e75e93a8e0304480a4a47deaed540d42a4b4601eb40e32e519b76a375cef0a6c1e0f6dcf6e3748a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cf7cf0fc800d928d28555fd6c4c4cf5f

SHA1
c1e0150e05ab02ef6888ebcb22a2757cd8a2d532

SHA256
8e9d6d6d589f61189f94d364bf1c0877c8b6ade1a09f1c7232b6491550aa0140

SHA512
06bddbd8edc8824a141b96b0c6d7f553650834ac4c883a3c99f0f0aca004e2d8d468783c2f2755fd135d503befaba1b7cc6ab8ef9d46ff14b64631f639a424b2

Download Submit