a289f7ba01bbf054a9a3eb3c6ecb803668facf88895616edc82177e87b54e7eb

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 19:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

88266e16df47ee8b2fe8b9b003aaf904_JaffaCakes118.html
Size

76KB
MD5

88266e16df47ee8b2fe8b9b003aaf904
SHA1

3debf3d763c5b669aa181640e63b80ffbc44b442
SHA256

a289f7ba01bbf054a9a3eb3c6ecb803668facf88895616edc82177e87b54e7eb
SHA512

53a0e77390c31101013f1c3cff2fdb509a384be1c0095d3884732455fd16fe1bf28f56cb2471ebf94fbeacea7488f4c1e5a6d66dcfdbf444751063affb3bbba9
SSDEEP

768:IDjp/XmAMtSmPLL9MEewa/PqSsPiw2LQw4KgG0BhivvycRmCTzMdMhcZkP9fa9Gh:IDV/mAM7X7oCBha2s9XEjntsy+J1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
3816	msedge.exe
3816	msedge.exe
4744	identity_helper.exe
4744	identity_helper.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 2232	3816	msedge.exe	82
PID 3816 wrote to memory of 2232	3816	msedge.exe	82
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2956	3816	msedge.exe	83
PID 3816 wrote to memory of 2464	3816	msedge.exe	84
PID 3816 wrote to memory of 2464	3816	msedge.exe	84
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85
PID 3816 wrote to memory of 3968	3816	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\88266e16df47ee8b2fe8b9b003aaf904_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb533746f8,0x7ffb53374708,0x7ffb53374718
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9477848429875324682,1965694433410592762,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,9477848429875324682,1965694433410592762,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,9477848429875324682,1965694433410592762,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9477848429875324682,1965694433410592762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9477848429875324682,1965694433410592762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9477848429875324682,1965694433410592762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9477848429875324682,1965694433410592762,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,9477848429875324682,1965694433410592762,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9477848429875324682,1965694433410592762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9477848429875324682,1965694433410592762,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9477848429875324682,1965694433410592762,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,9477848429875324682,1965694433410592762,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,9477848429875324682,1965694433410592762,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
18bbca290f07326df5b61bc873887ce1

SHA1
2e9955704d11f33b323d2001287ef08b921ed626

SHA256
923e78dfb90c6f60d9f4c6c4f1e4b66bee7ba060ee4edde56d0c412f8d7a822d

SHA512
f29bef51e0e9eb02e06c4a31ca2d5a20befcc893d6315da15cb5c443e852667e6dcb46968bef2cbb3b71247aefb76187f62c497d55fc7c62dd714eb5c88ceb23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b8a16a1a02148b736df1914202374d0e

SHA1
d8530ed74ace55b8f20b911a6c6b56d78d001a41

SHA256
e31750f101d9f4345ff0594aef2db8457268e50798db93659d515a886fcce5e0

SHA512
1748771951a131cd0ab038323778b1996df390f33a0af59b3cd9a7927fbffc4b7b593d4e1ed8ed5d55a835d924396c67f192b96f640421f477127ddc9e418a56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5ee5a41409940713ca56f49ac3dec2b2

SHA1
1ba117fd471ee8435bbd8c2f3a0848fda256dd1c

SHA256
247909b1726853ba8a72f51ff9f0e3f3582e48cb4de9a2c1dc2c301e20894442

SHA512
434bacdef6658f8705822ed88f5f967b371cbf3644971e6f47402eb21a37e9e6672d460a5718751dd679c070d763dcfd15865080e6dd384e53746dd26c4283cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b5d681a1974400c824ded4cd7f07adfa

SHA1
38f7198529d3dd3655ed1af4452c2d2f9028909a

SHA256
c81b85a87143eedbbe8e417ecd13e22ec2973bf0e6877a1680380664571ef76a

SHA512
3960b84312ca52903cead15cca1fdf082ca657cb49b2a6e4f34775f9747688cc4f9bdf605280d61e6e6a83ddecbbded7b603215d419dda35806f6cf3b247467c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1a7e5bc8b0195c5112aad0aaa92d0b77

SHA1
a003e8b2e47e447837a9219788b1fafbfd980e31

SHA256
2a1c6fcba8f20b8c41108cd219ab8b4ecb6c1bb2eeb3a2abdd9dc502cc5ea4d6

SHA512
d90c67c7882f519ef54f1151f9c67faa9cf7d9697e7d20aec805438abb2cd4abbcab54bbc2b218fc3fec009a2b52cb1a68755a08822946f0fcc541e8ac0ed4fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
746c479b7ed8fef73c5b655f946da85d

SHA1
80f34ad31e3c7216b750ace92a59ae5748d653b9

SHA256
b10dc5ee3a3637d2486e3fd6997cf1288bcc2803f63a83415ce8f1502434e2dc

SHA512
4c7433f614dbfaf6d49d4f1a588ad7a8f675d9f036d56c9f4213df555f4fd54249ec43a3abca0889a387c1d65fe759add499863726a48f8df39c11b477ace13c

Download Submit