4cf04536e3192862850b403c79f459d9fceb9af31784404cc6e56cf436655c55

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7640d9bb5830804b3bbc8d879881a27_JaffaCakes118.html
Size

202KB
MD5

b7640d9bb5830804b3bbc8d879881a27
SHA1

15280432b312e35ae1c5258ae9073ed78f5815f9
SHA256

4cf04536e3192862850b403c79f459d9fceb9af31784404cc6e56cf436655c55
SHA512

ae298f35e47fb8871dc430aa825130f55b39e77f5328fbb59aaf976cd3b07e8e6c8f19a754418077f07234b05f2d78318917d398ab16ffc66f75f161f72e5ad7
SSDEEP

6144:/Nt6e+bIlSUlR3TTQ+mPltvpl9FMMQkZX:lt6e+bIQu3TTQ+mPltvpl9FMMQkZX

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
4852	msedge.exe
4852	msedge.exe
4960	identity_helper.exe
4960	identity_helper.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3320	4852	msedge.exe	84
PID 4852 wrote to memory of 3320	4852	msedge.exe	84
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 3368	4852	msedge.exe	85
PID 4852 wrote to memory of 5068	4852	msedge.exe	86
PID 4852 wrote to memory of 5068	4852	msedge.exe	86
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87
PID 4852 wrote to memory of 3588	4852	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b7640d9bb5830804b3bbc8d879881a27_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa00d46f8,0x7ffaa00d4708,0x7ffaa00d4718
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,10310070816958053729,8069097902687705624,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,10310070816958053729,8069097902687705624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,10310070816958053729,8069097902687705624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10310070816958053729,8069097902687705624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10310070816958053729,8069097902687705624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10310070816958053729,8069097902687705624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,10310070816958053729,8069097902687705624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,10310070816958053729,8069097902687705624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10310070816958053729,8069097902687705624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1692 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10310070816958053729,8069097902687705624,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10310070816958053729,8069097902687705624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10310070816958053729,8069097902687705624,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,10310070816958053729,8069097902687705624,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
408B

MD5
290f3a316e568f9f7b9e46af880c6181

SHA1
e202943b12a6c3ef0fb50f1de44d4229f5a611f5

SHA256
23f10cf5969cab0ec3ace6ebc2e06916de7520886b3c228553f312925c263dd0

SHA512
5dc8a97ded08ad6e94130e03a11eb54b85dc6c2f2adc093147a835a9bf31e1a1cf520cee78693048349f63d5d1c2dc35b3f46512f33fd100c8a8cd45498bfbac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d0ef96a9656f9349a03a16939182e86b

SHA1
fc63137a55b1bb16b70100f26504b1e1899d13e2

SHA256
8db02844fc40894bf0f9bafeeda43015f37b07206e0149105a4e63104ad62ab2

SHA512
07bf06ab23200ce7e78e2cb0c3d995a0ef97fa2c4353e263388c676764deab54ed8224f79095f6220b6e9b93a3c098515f08f320a474a1c0ab695c7c03d7fdcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6b4754f6ea8cabb91383fc5589a29759

SHA1
3906c00c8b1e5bb9c5763f3c9b8fe1858a1a78c2

SHA256
faebf56654bfaf8896339110cf29a9cb784200022ab1d6045b51d68fb79b6515

SHA512
12cec1386573757f513fe23dad5f3005e58f9d8da4c76fa4900e58062590c07d1ede39f2908b4458912c8245d6c0527a454542aa7bf22e1e00893c88d07232b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c2dcc2b34b31668ea745927f6b427a3c

SHA1
1e1b903bc14ec018830ebda44588c77d7a26b3cd

SHA256
b2cd72d5fb1127b0779b96f9ded2893deab2e76d6b5ceb5c9b6f7fdffd9d0d8a

SHA512
393e848fc3f32012709b89bb191a6ba27074ef41f38f386e36f61e73c172ab9d9ea5d944f5914e812339aa272bee68eb93295456e4fede5dae405cc3b57c66a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
486ca8544a22bd70df19a739bfcf8601

SHA1
61487564cb3b1605eb5729d9d4dde196f6c985bf

SHA256
741651ee5a4af1ec815ae2e6d7143fe3fa8216cdf7b6c3490aabd667868470ce

SHA512
7ec3dbf3c83a4752de1ccbaeda748254f8d7eaf40c2c8f7880df22661373bd21296942ef70530a1017bff3c96f83cc7aff16842ed7c060ce4863628ab4263b15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584179.TMP

Filesize
1KB

MD5
e8ec4ae5a1eea754f17b757f53fc9334

SHA1
c69269538bbd2def6534ed053dd5487d39c059ff

SHA256
77148be00537ebeed554b22b478415686545a7048e6c3eed3313c8a561d47b85

SHA512
709b07cb5a61dbb7621f3c6d6cd5175e39a8619831201fa3f6ec7ef2bf2c134a5f056968a027171f4a4e4b3c48daab2e77a6e4e9b1f4d5424ae86f8b4bc1f0b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d641358bc42fc75c8da844396edc51fb

SHA1
6ee3dca1b65de33c2fa4a4f9b630cb52ed6b03f5

SHA256
0de45c0d1dbc0cc09756bb2f33d6169d84264d528e59a93dab5959b91d88bec1

SHA512
7ff0b94b4c1e41eb0dd78606045ca5aa5e77ae1daa910c9a95e5ed4b6d2854a47055230ab74a559a287add01815901622baa147711375144868b02c2ee8d9918

Download Submit