7b03901d2e9e4361b30fcadbbe0a37204868dffb3e9f2b89c3fb48579e795723

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d5c19c05d4bccb99c804d5ec496ad6d_JaffaCakes118.html
Size

513KB
MD5

3d5c19c05d4bccb99c804d5ec496ad6d
SHA1

c67c6265094b8b8a5b0fd01115311290c8a0439b
SHA256

7b03901d2e9e4361b30fcadbbe0a37204868dffb3e9f2b89c3fb48579e795723
SHA512

abb132afaf9261e4e1a73264e5a988538fbf508093dbd289a660486b8d660c900743972e9fd9d1c56f13ca98d8047e01c2252c1c378610f15e365c2294c1d8e4
SSDEEP

3072:wr+IpBxYUVy9zfs49PwVeL5AmPTmBcM24qE1B:wr+IpBxj4tLT2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
716	msedge.exe
716	msedge.exe
1884	identity_helper.exe
1884	identity_helper.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe
3924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 2420	716	msedge.exe	84
PID 716 wrote to memory of 2420	716	msedge.exe	84
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 3012	716	msedge.exe	85
PID 716 wrote to memory of 1904	716	msedge.exe	86
PID 716 wrote to memory of 1904	716	msedge.exe	86
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87
PID 716 wrote to memory of 1456	716	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3d5c19c05d4bccb99c804d5ec496ad6d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9aa6646f8,0x7ff9aa664708,0x7ff9aa664718
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,16040819821240555567,2808603904223928642,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,16040819821240555567,2808603904223928642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,16040819821240555567,2808603904223928642,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16040819821240555567,2808603904223928642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16040819821240555567,2808603904223928642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16040819821240555567,2808603904223928642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16040819821240555567,2808603904223928642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16040819821240555567,2808603904223928642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,16040819821240555567,2808603904223928642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16040819821240555567,2808603904223928642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16040819821240555567,2808603904223928642,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16040819821240555567,2808603904223928642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,16040819821240555567,2808603904223928642,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,16040819821240555567,2808603904223928642,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5196 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
c6009abdbff4eb95fe7a255f224b9cea

SHA1
51676e6f33a7cdac90115dfd0cbc33f2f88781fc

SHA256
881dae0fe6a2d11f4f276f823221b1d00bd2c19513fc9a36b79033cf78280c88

SHA512
1492487cca15478bc6e97aae2182f1ef7000d1f2398b82850841f2dc9ea9265e8128069bb6c65b76b947c69a966b573fa6131930548f6e26bd82a31c7cd01fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
910B

MD5
4fad3bc699904b72246b1f835cd6464c

SHA1
c76616a65b9a06b9ebc1f8d8b7629a074fb9620e

SHA256
e23f011861fcaf6e08d039669f0069d49a3819887e1eb8fa77f2c59476345700

SHA512
d9c696a01ec9877a777aaa1293174da87470260ef81cec3a649152a903622c67ced61954e2681f48fa70609bea5b8e1c7059668659667a91c7baf0030e27be56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
970B

MD5
b93585ca5420c54a07fa4e4f16031d05

SHA1
bb5c2696caf13276703c8a427626eadd35c564b4

SHA256
6ec15ed02c6cea528a018f009afa3235a0d572cba00c9b3fe71603f2f5d855ce

SHA512
cc27201813443218d3a4b246a34c42352ef5b6e469fe6c40adc1e8b9f5385be4ef06f0bdb4e978849d91f38455231f2757f952f562f386edb890afa577c4cb34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
254e3623c50da3644bb353ceebc5b0ed

SHA1
e8de7fed9a9fc332b89d746729b161fcbeb5c8ec

SHA256
41aef324635a91a696bae962d33ce6e43043f4d2020b6fbf65e224da8b2d327e

SHA512
999630223c0ce384d174518efa8eef0c3c1d39d153dde86065ae1c67132c74e55c3d6fc1fcc035ccc90701b4f54f181642d048874f477dbfe4c69dfa36c92049

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a422bc79d6fe76b0098d612340cc80ea

SHA1
6631c2ae828ab8205ff50d0698f3519343943bbc

SHA256
38918223764d3bf54ce00733f4e0fed69d1ff74fceae5485d8bc7317306f67fe

SHA512
905607d13d1fbc82de76ee4bcc1355501cd752ca5844264d924a7743a62c5ae48ebf71f141789b720c396ebd2931b4585bd2259614b5279216e7fd79e6d2f7b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
29ebf7ad137f3e3165bc5d9555080371

SHA1
20881431b0b7201ab998d59b5de377fa0c017bf0

SHA256
c90e95d4ccd853a72406ec1f8e73af00d0d922a995c680f90be3a16e53a6a176

SHA512
031fa2f991b2f3d1e996926816720f558f7a78ae34764c4e11ce378816dd3a5c9bacc4259b8cc1197a4df2977cc86e91df75865bf794f305c739001053313b40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fbe128ab6a5e71cf03ce205040e2153a

SHA1
90dfc644176a7211a1e435c6e2c1f39dd8c1d659

SHA256
04c955528c252fb1c42babfbfe50c86a5f5a03ee93b58cc54c0ec382b57f5d95

SHA512
12ba680b11181b2824b665da86a6c9ef01d50105a01f9aae745963a330fe6d148945c30da08bee19bb942b12c4b9f1805ac2631b3db6d2aef11c83ea09a98be4

Download Submit