2ec8a9a14066c52e6bb76f4ff507acb7c67e7ff53a755f5ba9b7d85daecaa9b4

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b48e0b6335f48d48aec732ee84a02f8_JaffaCakes118.html
Size

76KB
MD5

6b48e0b6335f48d48aec732ee84a02f8
SHA1

52ec9c6dbb02016f90155d25e0cfc8d31111b783
SHA256

2ec8a9a14066c52e6bb76f4ff507acb7c67e7ff53a755f5ba9b7d85daecaa9b4
SHA512

c970a2d78cb7ffa196d0235d73124a55bd965c16d4eea7afc3a842ec41da5932cc4a5fb3929824eb737be7e48d06eb121057c4c8859958d8d506a7aca0f4ec96
SSDEEP

1536:WcIPGoqpGYWMOIlbBzx74auSjyXOkq28Yr9HnnoAGCimoO/EzkWzrXWiH:W5PGoqpTWMOIldt4aRGXXq28YrFZWzrL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
2856	msedge.exe
2856	msedge.exe
2472	identity_helper.exe
2472	identity_helper.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2748	2856	msedge.exe	83
PID 2856 wrote to memory of 2748	2856	msedge.exe	83
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 1888	2856	msedge.exe	84
PID 2856 wrote to memory of 4632	2856	msedge.exe	85
PID 2856 wrote to memory of 4632	2856	msedge.exe	85
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86
PID 2856 wrote to memory of 3924	2856	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6b48e0b6335f48d48aec732ee84a02f8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffa9e7046f8,0x7ffa9e704708,0x7ffa9e704718
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,13641151918813708188,2729558895855461799,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,13641151918813708188,2729558895855461799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,13641151918813708188,2729558895855461799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13641151918813708188,2729558895855461799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13641151918813708188,2729558895855461799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,13641151918813708188,2729558895855461799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,13641151918813708188,2729558895855461799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13641151918813708188,2729558895855461799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13641151918813708188,2729558895855461799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13641151918813708188,2729558895855461799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13641151918813708188,2729558895855461799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,13641151918813708188,2729558895855461799,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
700B

MD5
2f356c73288704c85df1fe9aab526945

SHA1
0b4509b7f45f09bd95fc4b34edbc8792c72bf94e

SHA256
7a96be6835a567655cc5a2492e1352ebc5036b31743150637a6da50a4bfc2c75

SHA512
444e363f6904c01c377901dd40bc7c487b26cedf18ff814093f21076decbab3231eaa562a0f7831b8789f7613178a62bab199bf7aa910f066ce17fb1363c21b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
41e97ea4ec7fc4579d4fb6852ea4af34

SHA1
d172be5da9c6b437affc399aed8b9b3dfba41713

SHA256
4c574d1f3bbbbf8f2a0dc661d61231d6f1bc555296ac8e782d4437e105c0f301

SHA512
61a81300236118d35ce7196bba29eb4b29ca235873b3606a100a60805e30999930a70e1738346648a82bb2d2dc8839cfe3bf3c556f95f33aae0fef83d3865ede

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d6cc2d66904c6c229e4c3b467e04b76

SHA1
03964548c3d71278a17fd1f6b8fa63a5232e548c

SHA256
ab90e3a09460b960c4c09dea6277825c5470bce638008f6ebc77be3f86623f36

SHA512
f25bf526f2c5602fb444296925155c73f09298a6289ed242e3bfeca6655d609bea45451f5a1bc8dc77441dfeb1a9c46ebdb0f2ccd5f3181e8ed14ccb09c7787c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b2499b176efc838cf3544a4f522a974f

SHA1
d0b0e629a325bd0664a607c7ffabe84ef825e941

SHA256
38aa50e691058843b1a46e666620c171b2297129fff5c9ff4c9dad6c17b2fdd4

SHA512
a65efae8b0c2c4832ff73b4db3eca86096f1622be01ace468ebdfd5008642fa76aa8c4c2052fde942b9ce16d2ffdf52dfe6f5b0547b4fb08e1b7f37c95cca94e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
365004f9268b27b1a1042cd5998e7918

SHA1
a72b0d323656da325068fcfe16a1bba2177746cf

SHA256
8746bbcfe2b027f588c301383d76b35739efab657dc885e1a1c5392c5ba91318

SHA512
da199d5024cc2b720ec402d899a53b627510d387262c54f495e4b8da6a5e355dcbdf61f0e715876b6eafcbd544eb3342d7ab153e499af6ef1a0163985b0c423b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582083.TMP

Filesize
372B

MD5
e55483d1e73e6e02b6b5d09461a8b70d

SHA1
ae89dcbf34b1185ec0cda1fdd2f84ecb22c0ac44

SHA256
c49af8e9e9323fb58246a527ab8da3fd717934759fe18cd4923534d33b85f94b

SHA512
3e04a0e7453a3792df8117279aff4e2ed32e8082a02d36d270993f2cbe4d6b8c3c3d47f632846920e3669a107309476c7cdb3dad003df1537fe127fd3e29f2c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4e089ba8a52971e3ff753c1e720bcf09

SHA1
7899041b8c7469ea9b6f67736e134ce1415574d1

SHA256
3dd690530aa0057c97c6e749f9268395f759a605fe947a4c2ff1d80803da8e56

SHA512
3cd78629ea5bb2392f63e74dc4746bb75aee5cd69a88d6e6d4df5d40f92e2713b9fe380145dc49bbc4bf18664c82557e7e75a87e7f5c51b45a16058c3c4ab287

Download Submit