20cdb63a8da3627db5377a44dae4f7692208b7101e0b2a1a328d13b8dadd96b0

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a37abf13813d09df45834829c903a62a_JaffaCakes118.html
Size

37KB
MD5

a37abf13813d09df45834829c903a62a
SHA1

b2dad40ff044b09372d06cbae6a56eebe0551dd1
SHA256

20cdb63a8da3627db5377a44dae4f7692208b7101e0b2a1a328d13b8dadd96b0
SHA512

1dc8b2ebde3672a842dc902ad47e5347bce68ac63b0223f26515880f1fdae52e650a64b2ab44bff68c9b854be93ceeba7b741f4288e7fd50e617a1772cc3de64
SSDEEP

768:yUQm/us2e3I7YdX/mi0Nq7vYtdZfdT+MVsNmenNLjloYQ0usJm7ANe8ae0m20zPG:yfm/us2iI7Ydt0CQbZVO++KipMoZTI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4372	msedge.exe
4372	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
3648	identity_helper.exe
3648	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4276	4372	msedge.exe	82
PID 4372 wrote to memory of 4276	4372	msedge.exe	82
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4984	4372	msedge.exe	83
PID 4372 wrote to memory of 4136	4372	msedge.exe	84
PID 4372 wrote to memory of 4136	4372	msedge.exe	84
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85
PID 4372 wrote to memory of 1892	4372	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a37abf13813d09df45834829c903a62a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd15c846f8,0x7ffd15c84708,0x7ffd15c84718
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,15373733730268831073,15028132619107627695,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,15373733730268831073,15028132619107627695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,15373733730268831073,15028132619107627695,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15373733730268831073,15028132619107627695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15373733730268831073,15028132619107627695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15373733730268831073,15028132619107627695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,15373733730268831073,15028132619107627695,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,15373733730268831073,15028132619107627695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,15373733730268831073,15028132619107627695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15373733730268831073,15028132619107627695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15373733730268831073,15028132619107627695,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15373733730268831073,15028132619107627695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15373733730268831073,15028132619107627695,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:1204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
262B

MD5
8c5bd48250406a0ca7eb2b3c75adb820

SHA1
ffeacf3a1eb1e0549219b6428ec4af8c5054e060

SHA256
a13323db9208c5d8edff0eab641bc5b9ef44044a8b4773b7e026661388089e1b

SHA512
b58eebc062b32b6c526160393b9f8758024d09a9b14c0583f2252effb82bff52b83b48efdd10ff814c04bb417e93eedf5bb27d14c224681084ec64b27ae40f00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d6daaf16efe6652f138fe851e314767

SHA1
c2cf3f084a48fb13b999468f848ed7529d0d3c4f

SHA256
7413f095dab36436a6b6d86e3e4fa65cfb87de09df44e992cce5db31cd757558

SHA512
8657645534f6fdd151212d943f2285f66822dadf7fcddc04692515e786e37c2c33e713e429b35452420ecf648d2ffcba7b0868ed01c02881656a657ac7eed4eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1beeced892ea845a9caa16954501f325

SHA1
af337ba9e3d4cbd6aa98be617e9ccba408d619ce

SHA256
37f1d841cb9c1b9c8bc0f5a88d2222126759155ce0f24829401c786fd43cd81c

SHA512
94ae8634ebe0010a5186ac818b68580a7d96c88e7866078bfeeb2d769970ac1c07ad9b99b9398ee9af7a6c31af71a55c3a0b3318814adf9d17a044eb40995a53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
75858d3197a22f9fb95f91db60d612f4

SHA1
872f00cf30f6eb9ced52cbcab3ccab377b19498d

SHA256
eec6db8fad726856f46393cb3cc423fb2f03ae20b49fac7e0b6b04dbdbc5e2de

SHA512
84d8aefe43074b7e2a68303258c81f2849cb0308c4f7e3db93d5a0cd47f9c0390e6c8a7bfdaf5d0a9c587f798d2e47da3347c821e4477b494fc38ff091b7dee5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
367B

MD5
82317e8f9a0c451d428c46f9ca13ccdc

SHA1
2ec89e04e8b5818c17f27a33a538632f9115af66

SHA256
d75773c46077018a9f06512e1e98e0e492e7f8dc42ef7e770c68650d6abbf941

SHA512
6f9f7a36aa32dd5b1fa400b3970100b17a673a2f1e7a4020a0f8eff04ff71077df72d2dcedb34a3d8154b78ddc8742773201e2e281a728cb4be4b556ffeb3b58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581e60.TMP

Filesize
201B

MD5
c574ebad6386ff3e49aa8a30adc83824

SHA1
504c9c938d542218737a4e6077934f1da9f585da

SHA256
52011a613712955e0f415f4fcfac9fbb410beef678dfaace14dd648eb2282c2f

SHA512
8cc9c6857c7450562e3f2fc27f85c9f5c17b308936088f386f61c5f91778a1324c30742ed4701669724bfb041ede2c77ee202c1bb490cd8656969fbcfdfbb573

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
aabcde9b20601c1ba79c66a73a2b9964

SHA1
57511fe2fc369b29e7c21adb884013a7680a2fe9

SHA256
913dd2eee2152756fbc9598f2ce478eeb45d89af697b2a7973af0babbf0e9189

SHA512
cbe72339903298bdd7164db6d622e8170fbdb7cc04be47700847f42cec940a5ebc2a62a08db1d15f2c4074315eb5e52c5414ca06b592f05eb6d1fff7f4ae6b9b

Download Submit