c7192ee3940c71fc6d4e6d33e7a46bb2fa43e19e9abd5803688bbeee5ebb48f6

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e4c43a55d85f97981f01dc1dbe99738_JaffaCakes118.html
Size

29KB
MD5

2e4c43a55d85f97981f01dc1dbe99738
SHA1

523a7b59bb5280066fac21d66a7af67af2ce5746
SHA256

c7192ee3940c71fc6d4e6d33e7a46bb2fa43e19e9abd5803688bbeee5ebb48f6
SHA512

5d32e6c47ebe54575383b649fb3a922f2b941c094944d952283d00995b9044740f06eb0f0dca4bf599293c5edf0206fe9410ea7e9c0f4015734a84a7a07829ea
SSDEEP

384:gE0uqVyDgZmdRza70NDlxBsQuIJncryqNcND0jK:gEdZQ70nXJN0jK

Score

5^/10

paypal phishing

Malware Config

Signatures

Detected potential entity reuse from brand paypal.
phishing paypal

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
1608	msedge.exe
1608	msedge.exe
4484	identity_helper.exe
4484	identity_helper.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1976	1608	msedge.exe	82
PID 1608 wrote to memory of 1976	1608	msedge.exe	82
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 2408	1608	msedge.exe	84
PID 1608 wrote to memory of 4340	1608	msedge.exe	85
PID 1608 wrote to memory of 4340	1608	msedge.exe	85
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86
PID 1608 wrote to memory of 932	1608	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2e4c43a55d85f97981f01dc1dbe99738_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff825a646f8,0x7ff825a64708,0x7ff825a64718
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,9579189594123663158,5162390113083335514,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,9579189594123663158,5162390113083335514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,9579189594123663158,5162390113083335514,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9579189594123663158,5162390113083335514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9579189594123663158,5162390113083335514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,9579189594123663158,5162390113083335514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,9579189594123663158,5162390113083335514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9579189594123663158,5162390113083335514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9579189594123663158,5162390113083335514,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9579189594123663158,5162390113083335514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9579189594123663158,5162390113083335514,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,9579189594123663158,5162390113083335514,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5456 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
1024KB

MD5
7888c6276cc924fe3fcb577dfd5bf14e

SHA1
88b6a5d3de5857994cebfa494010706d5bc79e9c

SHA256
6b48449adbf6a455baa3f7eecf792ef6775c1450c4d48ed8efa9d9066bfb5afb

SHA512
b2b9db9ed33af2a335eeab3e108f95ca272a2c0edb0d19bc8219bfae825efa733283ba8ca34c40ebcf250b426272ce43f541d3c1699e945565a82df9d97570df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
189B

MD5
efd079652ad21c50d69ad30ccf61a40d

SHA1
000bc74057bb6ab42d2a160349e1597edb211bc2

SHA256
045646bc1a87f1ce57c87ba8a6ed5332e36f71e667ac712be1df2fef80385f8f

SHA512
35f643af8bb12bb445e3e6ce7577376dc69010ddf8d7e76752d703cb50f091bdeb9947b9718baa6e9e286d69df19a794522e446f29d58dc26dfea571045f51ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab09fca2e0a7fb1e8b5302d06976cd23

SHA1
7d48ead1fe4218b13cdbf0593b6ce51b4fe0d914

SHA256
1b8b77bcd7f80dba823b7397b7d3a64cb6ecaec7f7e51c67c7a46472dc2480b2

SHA512
98758e59a698d863b7bdd7ab80ba102b29b4410d30ea7073883248ff4335eca5efc2875e112828b73fa3579109254e0f260b1ad1637218bae909d1aa82e9282c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
01dfafc56720837f8c60b787aa5dd124

SHA1
6371fd355f0cab23f0abc5e7b93508a16ac01f23

SHA256
972bd5c54f7bf29da7dabe509f7c75a41b12c91143e5c1f251c616afbade70ed

SHA512
d3422d866ac8c02a54aa652c5b692829ee920e2a4c759df53076b81b33191ed7f3e623e52dd85968920c0418f97a02a3080e6bbb5553132e4b3db3f2951691d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
4c75286a6b3358aaf6f1c3809bf2437a

SHA1
e623aa3c9dc8044304b469b20ff98c28399850ff

SHA256
f9aec784e14ba11d6ffb3c4a5315f02dceb74a4f916988ee889ee6a071923180

SHA512
8235dced796677ad268a5cbe41f6bc1f2a565581152087dca76ef9748e07b64239cffb3345d9b137208543538ff41a34ddbc966a6d9b5a3983c1099b4f9be07a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c488.TMP

Filesize
204B

MD5
99517aeda2de867bfbe51c31b46c2cca

SHA1
56e42b529d57d0a650f848effe3fdd35ccec4dd4

SHA256
bd26efcad8d57ec7f7c54f906e1a4544aa913013d3302e90279d15528e78ed8d

SHA512
3142dae869458f0bef3574515fd8b32829a35104790db82baaf78a3596f137355dda8901976d0896977910f839a54239b385cc7717338dbd6cd2d86cd3dcdf22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d01388e9-57bb-4a61-a23f-47f7948aff85.tmp

Filesize
6KB

MD5
74f84dd3a185aeca792bfe6f3ccf6c54

SHA1
3ca60aa28228294fe48e39919475b570194805dd

SHA256
a32789eea98b8acd9d946d5b1630872805474a0d13d6cbe68cf642dab66c4040

SHA512
05da47dbd2c30d582bbcdf2cb5d58cf76fe54c027e6406109460ebfa25dda315944a28258b1b6e05502560c8d4c36e6c9d7798f00363bbc68debccc3eb18f698

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7a03702863206e7c54482454cce58f27

SHA1
96e05321824e2ff3a5393eae4e6bd453599310c5

SHA256
84748f7b502dc57c2b068273d0c3877397feaa03ff5284da2fce17d7ef5682f4

SHA512
48a3593343d7d2ef879869e5a45c557e0e38fc68a581823aa1f0c7e3bbe4ff70fab9cba960f2dac778a2ec12f58af1f5bfd5c87262f8656e36ef9aa38d483cd9

Download Submit