e307a70becebf9160ce98140a02aa33aa6ffaa66293fd7fd4b494add53e5b1fd

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 00:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fe7cfa84c318044fc91de44933a5447_JaffaCakes118.html
Size

316KB
MD5

8fe7cfa84c318044fc91de44933a5447
SHA1

9ead6f3bf201941dcd3527f2f10c20e05bbfd9b5
SHA256

e307a70becebf9160ce98140a02aa33aa6ffaa66293fd7fd4b494add53e5b1fd
SHA512

20d665d86f1cf46bf45a6cd29252d7fc1e670e24c1f948566cd28ec522998c4c6c1ffaf4ac37e5000e3ee8e9c8e6a2ba8b2514fd65f3fa911db6f6ed1bc40c67
SSDEEP

3072:nlB5FVSnOk0zD9ZwlvPu1EMlBccmzouBBQf4x0DU1870WW0G8a3:f5Rk8MlvGOBmwODiy0WWj

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1348	msedge.exe
1348	msedge.exe
1860	msedge.exe
1860	msedge.exe
4508	identity_helper.exe
4508	identity_helper.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe
2844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2780	1860	msedge.exe	82
PID 1860 wrote to memory of 2780	1860	msedge.exe	82
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 3444	1860	msedge.exe	83
PID 1860 wrote to memory of 1348	1860	msedge.exe	84
PID 1860 wrote to memory of 1348	1860	msedge.exe	84
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85
PID 1860 wrote to memory of 1400	1860	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8fe7cfa84c318044fc91de44933a5447_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8797646f8,0x7ff879764708,0x7ff879764718
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1508,5350254634707668701,12662206994426663017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1508,5350254634707668701,12662206994426663017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1508,5350254634707668701,12662206994426663017,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,5350254634707668701,12662206994426663017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,5350254634707668701,12662206994426663017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1508,5350254634707668701,12662206994426663017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1508,5350254634707668701,12662206994426663017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,5350254634707668701,12662206994426663017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,5350254634707668701,12662206994426663017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,5350254634707668701,12662206994426663017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1972 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1508,5350254634707668701,12662206994426663017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1508,5350254634707668701,12662206994426663017,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
89f4835fed8501fb632877125cc799dd

SHA1
d31d16ff344475ddacb01297b1544bd4cf5cf7ba

SHA256
219ea56d7db6fc849704a6195293485d3c1beadefd101fa1c5fec5a390bc7a0e

SHA512
39d3ca7ad6bb5276261480762bb147335f4c0882a168dffbea5fb67b3b2e9cc9d8870150022d99bfef26dd2c6f3e2814fba92281d383683dbfab1eeaffb8ddca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c96a8d06ee22208585aa4c69a86af842

SHA1
a8eeca64463b57683275f8f7345a951296063b7c

SHA256
b86fe8ec01ef1bb46da9e2965b91222e91415a500ae3ce89347e5c78673daf96

SHA512
59d4264be6dbd36e1c85ab0f41229927e87555f5f230ef6863a925244fde787cc6bc5af791eaec643f195bbaa2af53e68464c9fc11259b1bf3efdf73fa011497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a0bfd6458fdf0b8b6296a36c8db45749

SHA1
bc8345eb31dd489c23ad7864c98d61bf79f39636

SHA256
380b0d491e5f15be1430c645cc29e25eba801079b0e38990682416ccdb02b152

SHA512
de2d56da84bb2c845a3341c2f4a66a73fe126a3cce46bba5f1c0161037509ec67ed54bb0a9be0f5d5375cbe3c8afb323a058eb8507d9872dfc3527c6a0007aa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c1649b055e6f7f2a14680501559fead2

SHA1
0ecca405c5b58eefb2264a58cdd2d50eaed13abf

SHA256
4f3a45f2bca6e8f0e3ca9e840d6d58f9d865b5af0a601ecae036cfd5bd1dc862

SHA512
835da67fec033be80fe7d446a474e1848b4f3389febaddb40a712fe620c57c1e828f8d9d09c17982d8f0ab41420a23221a86b9d399daf72fdd233e0b1e5043c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50a325f66ec6606c803087a2f27283a7

SHA1
933de9f96c2f15df7273fab69d83f34cfbd54727

SHA256
8621cbe61c224dbd723cd89cd2f524753e56cdece7e7bdcd461e63586c9c524a

SHA512
62f85e194f626e2c4141968a687660e1a13e627430453c6e789b7162d55bc55c2a3d8e063392a5133c2cf2f08925e6a1c6497cd647b9e5f7b6e9140646fdc2ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
b449dbba981f10cbb7cbfa2a82f50826

SHA1
48f41ef5b65a43462445f564fedc2c39be69f165

SHA256
858537e19088fea4ad36ff7bf1401b48543d09c4be63ef9565fb001fd2d0c094

SHA512
d2da49a55c972488c99a2ef43fe53cd464f6c47545e7be3353ca90e70ea3bbf4c5dc51861a852fa211133b538d315d416e7e782bcd9726984b83eb1818746230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bc89.TMP

Filesize
203B

MD5
464f74bd5334db1277a7ded6ad60535b

SHA1
43bb180ff06ddc2eae7ac96fe25fe646ca7028bd

SHA256
456eab2378412fd37ec64ba07eab8b02bc7f69275651f347b1002dc62415235d

SHA512
de8ab2847115b66642fa34259ec0b3290d8a4d64ca93c3cc51ac89a0d10ee24acffefba5bc65e2ddde8dbd79ab100ef5ec5f2572f8943f0bd96520ce4b2f4ae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6c8a50e3dc30a6c5a6243df3633d8fe5

SHA1
01ebe23444100cb60a88044e3acd8c77d8b12c21

SHA256
253a1425d38b0856b83ced36139353ae2b913a91e59d5e4955d15104f21c9072

SHA512
aca6ffa04ba382ff0c127cea11143b66a38ff40a09ccfcb9c92489d644d0b2c04e6b557aa2a1dd04b0ac13b851261b6d281eec023e56cb2feb5771b17793d7ff

Download Submit