38517be43c6c5dd01b6980d2cc58e9339d28c8127577d484c8d61d24e4d5176f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8891b8994c504f09df501ec2e601f81f_JaffaCakes118.html
Size

130KB
MD5

8891b8994c504f09df501ec2e601f81f
SHA1

6a6176417a0bd22344f7ec091e30c5038fd01245
SHA256

38517be43c6c5dd01b6980d2cc58e9339d28c8127577d484c8d61d24e4d5176f
SHA512

d783f98a8e20980eab2cea9d4f949c7a9a88e37c8ea93b8a175ba292abdfda674aa17cc9bee5670b2d00ffc3807d1073fdc9419af32ab5373af4f39395642ae6
SSDEEP

768:Elk1ATx+Bw24Tp7IogTnhKBgkPwnO6oa0/OPrSe0nwim8Qx8bWfMaYNTdVwXCLDU:ED+ogTnZi6oJ/e05ZWXCLDDNcDOwgV+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
2560	msedge.exe
2560	msedge.exe
1648	identity_helper.exe
1648	identity_helper.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2408	2560	msedge.exe	82
PID 2560 wrote to memory of 2408	2560	msedge.exe	82
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4540	2560	msedge.exe	83
PID 2560 wrote to memory of 4576	2560	msedge.exe	84
PID 2560 wrote to memory of 4576	2560	msedge.exe	84
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85
PID 2560 wrote to memory of 976	2560	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8891b8994c504f09df501ec2e601f81f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff54f946f8,0x7fff54f94708,0x7fff54f94718
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,2373459406717944495,13273909472934582834,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,2373459406717944495,13273909472934582834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,2373459406717944495,13273909472934582834,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2373459406717944495,13273909472934582834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2373459406717944495,13273909472934582834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2373459406717944495,13273909472934582834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2373459406717944495,13273909472934582834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,2373459406717944495,13273909472934582834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,2373459406717944495,13273909472934582834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2373459406717944495,13273909472934582834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2373459406717944495,13273909472934582834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2373459406717944495,13273909472934582834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2373459406717944495,13273909472934582834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,2373459406717944495,13273909472934582834,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
de397fd8085049bc042a0266e904ce28

SHA1
650966702396b288d0f7e128a63aa017ffca25f9

SHA256
9f668e63698f21308701f313f69013b6139d9797cc69b100d49eddefc73efb8e

SHA512
beb13fc02aa68026e04bef2d96b51ba1d6b35922cf038241cff84562ffe5c2fd95964f9ac5e96b640d5e1d0717baae35842e24cad822ee114188767846c0a2da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
820B

MD5
94f6a9659f97a399e87f6872e913a1be

SHA1
2b5809ffe8fab5361b67fc47551b74cad21d60d5

SHA256
43fa59542ab6f7031f4a84e0394b54cd4e7953dd3ae894ff5e0a19e4a03d9cdb

SHA512
48434105c84568c016eba82cb819a2aa187878e8949a79c9640a55ffefa8aac7383e067ac5303823ab3c90a1b2f05f0d28e32db5de579c23d650a5d0e620830e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
deaa0f4dc7069b0161a6b2702995606c

SHA1
086a8ec54c029b61ab6b29c373a0b3f8a3b3fd1e

SHA256
2ba55d7c77de0ece154bacf37e1d87274d083fa625f35436034937a5402dc965

SHA512
49b67d9c5d490ef40f3b462968d53ebb6c814390e9e891aa41364935c7667d6a871cd3593653ef16a723015fda0e974404661c58d4dd7bd09df7d5399a7220bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b1e86686ef9087888d7c61a4017f13f

SHA1
fa4471fbf9fd3c988450c90c3b62e6f1b071f55f

SHA256
6418054e1ee8363edbb82ff59f5a82d5ed95c7d336d32e0c8ad447c65346f6c5

SHA512
14a2f56acda11b8627c15f146288fa001ac164f861bfc65224d603244042b0c5eee175b437f94fac2047154787ab819b9c7eb8c7103e81d0f1740d62c88ce550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97b26fe074e2e05464f286ef3bd2275b

SHA1
2de911914114324faa94b25b1f3aa648ea01354d

SHA256
e1bddd710348ea820e550680fce234443d3667cd1a9fb5b05bdbda679a9c35d1

SHA512
cdfc82fe709dbdbe78292264f4174b61b52d36a9f0ec824a9d0b1479fbae93a867d1dd06905d2fca0ad270989c5ba90bd7a4ce9ceba5e480378f3dc4d6f084d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9e6889ffc837e1cd65860991c344cf73

SHA1
03c6680115271c0608488c176db089ec301d49be

SHA256
7c0733b7c6b52cbf8441ba5cf2d7de74247688a4a83cff57ad0b749058050054

SHA512
14b42a452dfb18e3dfd8db2d42bb56a7b42dc53f72de423d2ac1240677812da6756098d9b49f2d7d004656ee5f8e087e5dae8b929fde87a9a74ccb6cf6935d1b

Download Submit