651f9601f4a99b99f7ca0fb476ec2e4f6fc0d05366805b367af7c9446cb98b88

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4934d9c7b6dd0629fdfbeca7684f12bb_JaffaCakes118.html
Size

48KB
MD5

4934d9c7b6dd0629fdfbeca7684f12bb
SHA1

e7797f7e3c08393c745b9e23190f5c8b1cfec7d8
SHA256

651f9601f4a99b99f7ca0fb476ec2e4f6fc0d05366805b367af7c9446cb98b88
SHA512

7d1010ae8d1365a1164b7458190cebd4b0af5de3167ca0e54b3a380431a1ffc392d8447374f0499195023b5d7db73beb3c6042932b93fa216a54df4fe16db78e
SSDEEP

768:V/Vt97Rycy2aWzkHa3Z3M4CBTSaemAELdjqckF8SC0/ZuOU:Ht97Rycy2TD3ilZSaemAELdjqck0b

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
872	msedge.exe
872	msedge.exe
4464	msedge.exe
4464	msedge.exe
636	identity_helper.exe
636	identity_helper.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 1532	4464	msedge.exe	82
PID 4464 wrote to memory of 1532	4464	msedge.exe	82
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 4204	4464	msedge.exe	83
PID 4464 wrote to memory of 872	4464	msedge.exe	84
PID 4464 wrote to memory of 872	4464	msedge.exe	84
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85
PID 4464 wrote to memory of 3024	4464	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4934d9c7b6dd0629fdfbeca7684f12bb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8daf946f8,0x7ff8daf94708,0x7ff8daf94718
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,10249341366577483985,16484687808755360832,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,10249341366577483985,16484687808755360832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2584 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,10249341366577483985,16484687808755360832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10249341366577483985,16484687808755360832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10249341366577483985,16484687808755360832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10249341366577483985,16484687808755360832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,10249341366577483985,16484687808755360832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,10249341366577483985,16484687808755360832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10249341366577483985,16484687808755360832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10249341366577483985,16484687808755360832,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10249341366577483985,16484687808755360832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,10249341366577483985,16484687808755360832,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,10249341366577483985,16484687808755360832,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
473B

MD5
c0eb0f2eebcb5e193cccc880639221a2

SHA1
bb278fdd2a1c73e0138be6f7611a3b91906a6732

SHA256
0975f4254b14795f37c2cc3bac45dd95387792cb05ef6a86b80ef8893a360605

SHA512
ae5557116f8320ed3b0e417e0dba8148885deada0e48a6f3b124f189ec8f86aa08dde5a5f0fa8bda252802a66f662e520a7314cce0261908fd84e2db39931c4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ccb70f0fcf2aaee88d19fff91ff7d492

SHA1
f65a0cf97370c5847be6f973a115101b67da9e1b

SHA256
3eff447b2c044b791183a9311a1c987b6f236315b8237e43492758057fa6e518

SHA512
9e6b4c773082dfdf700dd0f58b09389091322390c0a08e0b7a93157583ae3e5dca74b295e74f474c1275ec6195a0303c009e40f1ccd70dde1705ec9cfb2ee455

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1972680040bacd1f19028af42f57aaa5

SHA1
468193eee10dbeaeee6432f875a9afe82f6d5dc2

SHA256
b2dbf63af6c77b5784b9600214db13d92f7d65ca67c46466c2335472b970e220

SHA512
c7bfd88d14e00b4633ab6e5aba6b6dffd73527e712bfbdaf2a45efdcc0f4825a56c9b36c587ab6fc6f088484df03c742a84cf38f98c14759366aa2739af48006

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d39d791a0a2b9707ae709fb43583b37d

SHA1
2d9a78c99d3c666d1e6d98ae5a75ff3cb0b7aaa6

SHA256
1b049c60ed90a1d4ff98e317456cae233c72f880f75b37ba8b9ece3fdd1ce66e

SHA512
76dc0aaacb42cc1c5a40024b9f7e00ebe5fdd446c02700cee7e2073034a076dacaec061fb0d80edddd09b4cd36a1b9d0bec27a32d0194cdc87489e0484bc0bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
70623416ed95fa5aa7434824d1d21136

SHA1
51baacdc76ec4b83b6b1e0507754c66850c5ccca

SHA256
8e7fddef10151b882189c7f06d35f2ba40ca9838b67153c3c49d18f70b690cea

SHA512
d22184034046198bfc26c5928c54055b9283559848397594ebc3603dabe8c1518eae56fd25e248a75c03f9e19e7329dabb85706dcf3a78f604330259d525bf17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c94b.TMP

Filesize
371B

MD5
84f4896733644371db9185831b49acb7

SHA1
bf439fb7cee8406960640e3116e4286d57160847

SHA256
6417bdc58f6011f7b9e7daf7c32bfaa670a2b9da0469d554401475fad8fa85fa

SHA512
b6fa891a720261d73f3ca2e28b5636b3d07d318a0e7c2a6b71d3af0254cd08438b24de3135e857aa9eca3156c12b9e355a0e3374a1046a9b04bd27b6a9ece28c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
691abfa27e1c227b0a590798ab6b863c

SHA1
f3f3b65819d5df6c3b71d6ccd3988e2016f4f329

SHA256
8c421af1e049cf1f3a096dd9ed4df6cb0538c35a48526540e83bb16f5751a599

SHA512
ad74b566b137e540fd4911bfd9783f9f37afa05ff8631adf050948c790b97553c2e8285e24aa7ea0d5d1369e15dfd1cc6fc8ac68dd4ee78668572c6b0f02af4c

Download Submit