bf014d0c13b7d9f2a2e0a886865701e59338ffc3f3013ee8cb676c016c251f69

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92575c5b1bd2df057e7c5d0a9f0ffb97_JaffaCakes118.html
Size

32KB
MD5

92575c5b1bd2df057e7c5d0a9f0ffb97
SHA1

ba22f4200cb8ac8986673da121e56d2f5e218986
SHA256

bf014d0c13b7d9f2a2e0a886865701e59338ffc3f3013ee8cb676c016c251f69
SHA512

9dffdb35c14407c4dbfb14f1a99081939bfbf7aa14726576f313e4b10bb2dde5a7d0aa2c446a96071273c208c8393c87adb9eaa02ce7c24dea7782490a76122c
SSDEEP

768:ScQvwtSjhfxLqaOwOs+IO8uQfJv1HhX1Vbkt4G7G1GQGmGCxGCFpLGCsGCiOPKpI:ScQvwLSG7GzBX9SUyxZVW4l

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
2972	msedge.exe
2972	msedge.exe
4428	identity_helper.exe
4428	identity_helper.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe
2744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1892	2972	msedge.exe	82
PID 2972 wrote to memory of 1892	2972	msedge.exe	82
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 3644	2972	msedge.exe	83
PID 2972 wrote to memory of 4960	2972	msedge.exe	84
PID 2972 wrote to memory of 4960	2972	msedge.exe	84
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85
PID 2972 wrote to memory of 1452	2972	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\92575c5b1bd2df057e7c5d0a9f0ffb97_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84d3746f8,0x7ff84d374708,0x7ff84d374718
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,6506756640103821903,11128593127178639541,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,6506756640103821903,11128593127178639541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,6506756640103821903,11128593127178639541,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6506756640103821903,11128593127178639541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6506756640103821903,11128593127178639541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6506756640103821903,11128593127178639541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6506756640103821903,11128593127178639541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6506756640103821903,11128593127178639541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,6506756640103821903,11128593127178639541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,6506756640103821903,11128593127178639541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6506756640103821903,11128593127178639541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6506756640103821903,11128593127178639541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6506756640103821903,11128593127178639541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,6506756640103821903,11128593127178639541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,6506756640103821903,11128593127178639541,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4668 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
1aa59eedc3e2c8dfaa6baf20e29e0c6c

SHA1
7f542085b8eca1a5ec187df07af884c714eeff1c

SHA256
4bcd0b2c0952bb266a4e35598e87264327c373bfd12d506024d9dfe432812b1c

SHA512
e9f36ad548757a16be5bef83d906a81a0fd9df001e8d14a0af4597edce7f36c4b463006695086be3d54c34c38950d81cbdb1028a40de440c34bd59e0cc0f720b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
58a345742fc06f849d9c96d1e0b4b556

SHA1
648f32f0c432d70816a551d11f93ff671fae2263

SHA256
b14cd585fc229923cba745862a19d843467d6c334549df2241b5aef8421ef617

SHA512
2dd18218bb92d2d4d5a778333d3175b9ffa171e14755e529ced2f3e06c044f32792dfe8e94397870305a5fa351410042d6a2fba1cc1abd49f68afe4c4aa37c39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
24dbf9f26c411d2af55a4bdb3ae23934

SHA1
434f4d4e3461792f6c2e8a0730da8345024a162c

SHA256
c9f0aaa18ab60db8ce59976727b8f8c2ed7a5d80703e380ab60c9e9339763db1

SHA512
08295d1adbf5e2f6de3d5989ef39f4cad219a618a6590d7ff7dd67549cd115eec0dd86a7a42cfea67309733d8bb86296c4cf2147e933d5706feda6dccaa98bda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
77ad91b74add0e84041057d82d3205ce

SHA1
c09cd0a0bbc18fa9500d959c50a602d26ab5865a

SHA256
971390f0419f6b9183e86e8261b77025a6a7c5329725041bb4d3315b67cad984

SHA512
2cb99ceb3011df7c646bd6e41d57eadbd1f48024f705d97271899f226cf748702c526534f9ce7bb2782b7425f22e246f316a6f59a44a30667f46a6613249368d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
510aefed7c46809f32a30b5ca0b8bea0

SHA1
d043f0f57c2985fa68467f3b1c0f80c5bde096af

SHA256
a67bdb4f2277c2224ed11ff6e51682604edfab7c5e4c0c62c21b4797778b3bdb

SHA512
83fa16366393fac5a8b777cf6fed70f3e34f4e0704a07644e46f246467abcc85b10dfab0eb6bd245920c3e65b0dd2689499638b1dd215c353c45712f62e368ca

Download Submit