e24947a913a4050c7361d28fe412ab28f433bb3a28f6fc4007b2104450955a6c

Analysis

max time kernel
147s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48028e99e670d33ddc0e93edc674395d_JaffaCakes118.html
Size

40KB
MD5

48028e99e670d33ddc0e93edc674395d
SHA1

30dd354f1c6e36a40cbba08b841bff13baa787d2
SHA256

e24947a913a4050c7361d28fe412ab28f433bb3a28f6fc4007b2104450955a6c
SHA512

178635d9a9580a11c3b96033c80fc24d0c284733fbfff82b52dffd7533a4ba8d3edb69466d23174de9e741c9012b57d1c327855abe8f4773041d69d3e8562fcd
SSDEEP

768:z/QLJ7G86uiHHKR8iwzOu/Hbpq1wkLKpyBvX:z/QLJ7G86uiHSwG2NpyBvX

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
1908	msedge.exe
1908	msedge.exe
4380	identity_helper.exe
4380	identity_helper.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1604	1908	msedge.exe	84
PID 1908 wrote to memory of 1604	1908	msedge.exe	84
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3568	1908	msedge.exe	85
PID 1908 wrote to memory of 3480	1908	msedge.exe	86
PID 1908 wrote to memory of 3480	1908	msedge.exe	86
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87
PID 1908 wrote to memory of 116	1908	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\48028e99e670d33ddc0e93edc674395d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c93a46f8,0x7ff8c93a4708,0x7ff8c93a4718
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1083435767111759222,14787393981238175114,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,1083435767111759222,14787393981238175114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,1083435767111759222,14787393981238175114,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1083435767111759222,14787393981238175114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1083435767111759222,14787393981238175114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,1083435767111759222,14787393981238175114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,1083435767111759222,14787393981238175114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1083435767111759222,14787393981238175114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1083435767111759222,14787393981238175114,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1083435767111759222,14787393981238175114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1083435767111759222,14787393981238175114,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1083435767111759222,14787393981238175114,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5468 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a37a27581f8e9baee106f73649baea8f

SHA1
2a7a28eff58c0e1ffb3e5bec955c496a0736ceb3

SHA256
9f8645d2ba6b07e53c6cc4ab6805177f448ae7e8f053702482fb96b95371b28f

SHA512
86462449dbedcefe71f59bb6cf0c9c90b2e309e6017bc3a5659bcadb067446a612aaca4878facb5fdacfcc6a911801a8a36fac5080c4cd014ac00caa921a8b09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7c75216935a83fbe25011e1ea8c65382

SHA1
fe953e41742c32a9a36e4ce30b043e5773a80d10

SHA256
8ecadb55491f6c50428ec62730f1c4a148fce339a5f6818420404b8997ba3aaa

SHA512
701c695374b54ee87e1701d925d4056f8ea0249ea3d34f1e24c9f651d3ade5388eb33003bfe60fb652d54a61be60317dbe876faedadef95b9bbcf58acbfe3746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc8202ce9a3375ef422a486ebd280f6c

SHA1
df8c54c457adf00fa95425bb41fde4f36889369e

SHA256
1d2e820c9a0ec96c7240a7901364932d7d254d2d537753aeece2ef98641c4d54

SHA512
2576db208f675d3e5a65c031bf09885fe056dfd2c24a586f4faa274b96aee935cde2ef93d5579367a7eede6b1fd42d6b8232fbf872c88fe8b9f6e1bd50770fa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5c9219cef97c49822420d0f96e9e8ced

SHA1
328d78351fb6dd8d375cbf7a9b8da37d26fa2af2

SHA256
c0f8c3084b7b8422659c958d5d342f3ebaa4cfb1b5122485415c00983fe7ae69

SHA512
851d171781efb85cbcb7cc301ee5b757163ccf82bd311b9b9cafffb0112058c3e62b93a2d3ac6c1a85341783ecf2aab4fec1786e159b725ad2a49c0edb080cde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4fc40f68bd65082f901714ea4342e4da

SHA1
61a777ecea53e1fe7b5394f08a3841525dbfbee0

SHA256
5e9227a4c8e3e9bceb8789b0b8ec4126d4c182128cb9abf16c65fa7aa27e179f

SHA512
27f81150a11159ec3595735ffe1a385e7a72fa649bbc1eb5a5d04afb81efff85a4ba7f85fad4c4825dd2e253a93832fe6a3edab61606258a0906feedda9e01ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
3562f209590e2654e7be9ad3e8d0e3e5

SHA1
b239d053428f8d50288d887641670fadbdba5040

SHA256
aebb73830e08a643ed3190dc066dc66cb4d6f8b6db67a959ae375d6ade43c0d2

SHA512
f2e29bb1c781973693fabf589dcfc2a21768861776fb10927c71d17e2ef1e5085320460a8e1eb6fb5a27a67e0639e2679c91920598d3410506f20c0cdff4990c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581921.TMP

Filesize
204B

MD5
fe3cc92c6c9a4d248932bcf3695ff266

SHA1
82be8cca45939889563ae49a9bdf7e62e0891928

SHA256
81ae99abe7d3b55300ab376070297de3f0df9ef3f14c85a0a9d39b914a52fde0

SHA512
f77d582770edf2fb42784c602bda7100df8c9f914c9cb35672b5b7cefb134067312883ae4d6e6cba1c66689093554abec5718776529af7dadf5b3bc3f2d5e6a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6a4da98463abefc6e4052f5a9f1251cf

SHA1
35864e5e97ecd878cbb73725986a49a1efcaf7da

SHA256
97b091fa86312ca5510b2f3d56ade51e0fe780fc1711f597b18ff7229af3c951

SHA512
a42f005d38ca97974b4a1de078abac0c90b6c24214d4e572b1ed03a733880cac04dfc68dd2b2d6990e55920d66c837cbec8919916019c5c648ee5a22e89ff599

Download Submit