4a07a74c6d36dbde62dd108929c659b932876ed907bdc3e1e7455a16499b1bd1

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 17:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

014dd225a4501f32c50db531f5ca2510_JaffaCakes118.html
Size

251KB
MD5

014dd225a4501f32c50db531f5ca2510
SHA1

3bc9d7d22280c1b4f345b5bacb409b765889d505
SHA256

4a07a74c6d36dbde62dd108929c659b932876ed907bdc3e1e7455a16499b1bd1
SHA512

59bbc8dc15d21bcc8cfd8a8e4ef31a7f67f4a290ff7a91eba8fd1ec04a8c32dc9b068828f344903459c15888067b9388205d61edfe52f086bfdd8d9bd89ff052
SSDEEP

6144:LNPOhwsNW0/SF9ALaN2wiPuBJgI+U3xWPPWng:LNmhwsNWCSLALaN2TucI+UBWh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5840	msedge.exe
5840	msedge.exe
5088	msedge.exe
5088	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
1236	msedge.exe
4384	identity_helper.exe
4384	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 3020	5088	msedge.exe	79
PID 5088 wrote to memory of 3020	5088	msedge.exe	79
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5012	5088	msedge.exe	81
PID 5088 wrote to memory of 5840	5088	msedge.exe	82
PID 5088 wrote to memory of 5840	5088	msedge.exe	82
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83
PID 5088 wrote to memory of 4072	5088	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\014dd225a4501f32c50db531f5ca2510_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc634b46f8,0x7ffc634b4708,0x7ffc634b4718
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,14210977368909177391,5835186822908087099,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,14210977368909177391,5835186822908087099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,14210977368909177391,5835186822908087099,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14210977368909177391,5835186822908087099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14210977368909177391,5835186822908087099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14210977368909177391,5835186822908087099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,14210977368909177391,5835186822908087099,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,14210977368909177391,5835186822908087099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3104 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,14210977368909177391,5835186822908087099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14210977368909177391,5835186822908087099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14210977368909177391,5835186822908087099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14210977368909177391,5835186822908087099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14210977368909177391,5835186822908087099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\726fe4cf-3b9d-4c8d-8354-4c09a1a7154c.tmp

Filesize
6KB

MD5
97301edba94376c4657b8437b5463106

SHA1
a92c65d0f3922fa85c5c96d492b4d24ad14e1c9f

SHA256
99382494fba84abe07bc1521c1d2e1749ca42fd73acce3639ca70d68ccb2765c

SHA512
ffd3cfff161dcfeb592bbcf0c8ff14b02afaccc0ade872bc38272c412f50d3c026882abe2eb814cec883e3b8233359544a9c6b87c975c7034008a2d5600837d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
0f07338dd09a2054a1805f0464042645

SHA1
ecdab137da44b29d2eb1387652746d5851925bef

SHA256
60f661f62e8038ed8049486c17f2f58534f056fc1aee2e380014902af7a16fda

SHA512
7422ddc742d45c7fe9dca45973cc180e3e7c4f5250391ccd8d48c4dc077b06d099d0cecac9bb8e81f21f10058fda9fe0cd8b67d2e05c281ae39c9af42c96805b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cec928c8291c016e10cc928536e0df42

SHA1
8a53b989f8fe89d7f2a9f0d65ef808e7aa531526

SHA256
853045cfebd649848ff13b0997490bf55c7fbe5d36ed52df260ddd29bd928827

SHA512
e4a0ca267398a0853b6bde8e4d18721ec057f09be35220e1695f8e2ef3624d52cad5510a425fb0bc101a73143f3d2df6c3c029c9efb3752586b3dfb83ad5cea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1946e410645f1236b90b5e812ffac2af

SHA1
18395dd566850df2b3f4f2bc2083c2d90632d26f

SHA256
8851acfc8bae39c7c11528d371144dfd51139c029a19bc0662a5bca6c58a7411

SHA512
681cc6663c70ac25bddbdecfb5fb2a57f74e9eed17a03aeda5be07ecbb2a59000a9d88ddffd55d56f731c182651fda10159aa6a702f6d6a93b08eb29573a20d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
26087ac7f97e0181001eb7857c935c59

SHA1
aedc906dbef75465d3374bedb7a17c6781c1f3b5

SHA256
20d5b5344dac1a172e19954ebe0ed22c8f9f47c77591e67d840d5e0c3145147c

SHA512
1a773d009c9dfc2bb4cee1fc8beaa3b62b3b68a62fb4fc6693f008f5b0396df1bc563d40b0fb961f852e0cbc04262ce4d9178b81385ecda2ccaa9b34528e03a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1324882d6cbefbc1bd89210140b76529

SHA1
4029ea0aa85713161bb3e9cbd12e393092c575f4

SHA256
637d62a33ce9ef0010d44a4be75d1ba8ce22e0cd38af9ad25f8111279c12bca1

SHA512
d5899afd21bfaebb5578c44ac7ebd03787059a0b1bb4473d9d54b1ff3d478e08ed7e2a1a3d665bbc0365241e518ff4ea3cc5648254ddc583e4267d9ae592ad59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e12bd820a41ff8bfd5735cd7a1d022cc

SHA1
902775099fe3e0f159ba46a5535657a9caf56098

SHA256
ef0bac7485a4146c03206787dd8452f25277bf2175022b7c345cde2ec9a28fe3

SHA512
b8ea7756d11031c1255c0fb867dccd817db48e1d2e0461b51326bcc9a4d9cc6644846e87ae780b5b53bed712f8fcb623ca08b4f64c4322c162432cf6bbbe27d0

Download Submit