0db4966d89e44e2574b056b624a4108e2fca7b120b06e0d137bfdaba0f80e11a

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94c7d2f190080250784b84e42ebe31a4_JaffaCakes118.html
Size

55KB
MD5

94c7d2f190080250784b84e42ebe31a4
SHA1

acc36232d4ab4cd6546817f800a574bee0e439ac
SHA256

0db4966d89e44e2574b056b624a4108e2fca7b120b06e0d137bfdaba0f80e11a
SHA512

c7399b4395a528a12916036b0b6508087cf0ad4e8096fde328eee2aa4a12a3376fc2ab123e22c3a47aa8cc95c5e229bc438f82fb9047ee689bad082b2636fe55
SSDEEP

768:vnT0EipBBirYAQM7NLo9J5k6L8b/5sIDJf94hW95U2SEP7/B0:/TupBBirfQM7NL65T8b/5sI1mE5C

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4216	msedge.exe
4216	msedge.exe
2540	identity_helper.exe
2540	identity_helper.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 1796	4216	msedge.exe	83
PID 4216 wrote to memory of 1796	4216	msedge.exe	83
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4484	4216	msedge.exe	84
PID 4216 wrote to memory of 4960	4216	msedge.exe	85
PID 4216 wrote to memory of 4960	4216	msedge.exe	85
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86
PID 4216 wrote to memory of 4824	4216	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\94c7d2f190080250784b84e42ebe31a4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa05d646f8,0x7ffa05d64708,0x7ffa05d64718
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,14999388227111177523,13045754567313561178,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,14999388227111177523,13045754567313561178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,14999388227111177523,13045754567313561178,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14999388227111177523,13045754567313561178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14999388227111177523,13045754567313561178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14999388227111177523,13045754567313561178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14999388227111177523,13045754567313561178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2068 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,14999388227111177523,13045754567313561178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,14999388227111177523,13045754567313561178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14999388227111177523,13045754567313561178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14999388227111177523,13045754567313561178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14999388227111177523,13045754567313561178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14999388227111177523,13045754567313561178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,14999388227111177523,13045754567313561178,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5264 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
44KB

MD5
23536ccfe05b737ae639fe63ee4cc435

SHA1
6d2e9822835dc3e6117a4d2addfc8f241fbdbc82

SHA256
6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce

SHA512
f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
7c71c0d0bcf5d605a9be3a77e59d964d

SHA1
460c1af755f201c4e2d1b6073106f426d6d8ef9f

SHA256
334e0b25a9ab852f8c016dc5b4816ba08ce587465e5b69e37bc6677ca2b7aaa8

SHA512
1ad2c72118e773747a9dd47e61375d7c808479b80ae18ac0ed02bb35d8f74c71b03b9f16b947603737c59b704d077c7df2e0289977926da21e1e3d4ec8444f9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
53f6b8a39c94e046e93320e3293ca44c

SHA1
97ed880370b3b6edc977fedfd5f129dc3d0b98f4

SHA256
3ff4ca7b4c211d9e04e4b962176ad84e9d2cab6f077c2184dbd89716e521963d

SHA512
838ccf9d44d910e95c2b3d913372b6a01c1728f0a9879e3268a1e2d94632f29a13524c87ae499afc72ff497db090e364478aafe50378cfdf98b01cbd7182f632

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
036682a3781dce504001713cb5882774

SHA1
29a6f4fcf39e89476b9a82524ed4879be4bbc619

SHA256
754e9d626df16293e4f04723455e2fd9e3b853de0b49beec2feba3d0f5849f55

SHA512
dedbc6f237d53f822091bbff668f7f98b47029dafe35e6e749de5aaefc655aca0c20a77f4c013ac23a4a7453af9cd744445a077220dbceb2c79f2d1de4048dad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8c2841f27ef69448b33bd68337aaa82d

SHA1
710f810dd7dfdb5794f8db97aaefa7a2ae397d76

SHA256
d3f8827eddcda852fe754c26f2cb806e24f656053d27cdaf2ea78c1767181791

SHA512
4a4232345d7f8ff624c62e70b90122856a607921d8633c194a5c113b15de41eac4de6573bb92cfe39953502267e4d834b4185567fde463bd591a64eee8ec059c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9fc3095b36286bdf283ab6b8aee50292

SHA1
af6adfddeda19c7f5cbc2cb7c91e2650d9cf25aa

SHA256
d6fc9a8388b5f5acd579c339968fd6a01f5b13078518f1384149118dc3a7290e

SHA512
17d025c40e01a81f21b72f8d617004d8d78ea0a343e9a236b275929d306ac350bd76cc24cb46e4636a9b544b69398a913f2740693606bbbe37eb42a0a27ae832

Download Submit