439a7eb35b14aa012365eeca8256dcc417a7a0a231edf59809acfde63ac4378b

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

274eef13428b10cb9b5396501c357ab3_JaffaCakes118.html
Size

57KB
MD5

274eef13428b10cb9b5396501c357ab3
SHA1

7efb4494cc870204df15a695d77cf781a1f36859
SHA256

439a7eb35b14aa012365eeca8256dcc417a7a0a231edf59809acfde63ac4378b
SHA512

2c32eb119c3effd4f0a20ffe2e1f17e1353d4b86724afccb9c324530c29cd7853defb27fa75c65d99ae296a1c1fe1792e623182d3b6dbdb10a6ea0c6a81732c0
SSDEEP

1536:ijEQvK8OPHdyAto2vgyHJv0owbd6zKD6CDK2RVrofCwpDK2RVy:ijnOPHdyP2vgyHJutDK2RVrofCwpDK2m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
740	msedge.exe
740	msedge.exe
3644	identity_helper.exe
3644	identity_helper.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 852	740	msedge.exe	82
PID 740 wrote to memory of 852	740	msedge.exe	82
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 4860	740	msedge.exe	83
PID 740 wrote to memory of 5048	740	msedge.exe	84
PID 740 wrote to memory of 5048	740	msedge.exe	84
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85
PID 740 wrote to memory of 2908	740	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\274eef13428b10cb9b5396501c357ab3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff850b646f8,0x7ff850b64708,0x7ff850b64718
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,14907073441110738001,3295731524076777137,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,14907073441110738001,3295731524076777137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,14907073441110738001,3295731524076777137,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14907073441110738001,3295731524076777137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14907073441110738001,3295731524076777137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14907073441110738001,3295731524076777137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14907073441110738001,3295731524076777137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14907073441110738001,3295731524076777137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14907073441110738001,3295731524076777137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,14907073441110738001,3295731524076777137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,14907073441110738001,3295731524076777137,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14907073441110738001,3295731524076777137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14907073441110738001,3295731524076777137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14907073441110738001,3295731524076777137,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,14907073441110738001,3295731524076777137,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2944 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,14907073441110738001,3295731524076777137,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3c78617ec8f88da19254f9ff03312175

SHA1
344e9fed9434d924d1c9f05351259cbc21e434d3

SHA256
3cb47fcdca33bb3c8f4acc98424140987235ad79815da4f0e7593e4591ae90ed

SHA512
5b58675088b0fc2b2d705cb648ea89385b80c7cf908b0f4f95a9acdbd350b50754e1b586202db6a918eef70029fafb210947f3c43c570ecf7657e08939fd7e9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
09c7ae658385f6de986103443217840b

SHA1
298d880503edce4413337c09d3525f27a2edcd28

SHA256
91e04ec38abdb0204458543592c4621b7bc0306407884f764aa9596a52454cd7

SHA512
4e1272b209487d1e9e7d8502be49ebce91c76718410e817b3ac7faf47d9b699210aab1b941fbb5ddafc192ddf4b2ba151afd47fab753ec62bc0bca36039c55c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
4637e01a22dfaae94aaa8cdc0b69b088

SHA1
555d1bb9bade48146d680bdd888699d1e589a44c

SHA256
c1f071f8b37caceda7d0c2a3e43844ce534dee9c7bd5bbe5016e8b23934aa0d8

SHA512
43276b0aca467c3a7fee027f029219e8aec117cf30f3457baae17e1483aaab73319df04db419d7e154ef1329b3637364bdc07e012b1103742612b44c733525ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
81c97c4b5bfcd6f0c26baae79456745a

SHA1
f4815c9dd853e95f3db5cb93c1dec3494afb7c8c

SHA256
714b353631dd1b48a6b8083b01b0fe2a22ef541cbc95883d4084d0b75a8dba5c

SHA512
3a7b0d525b831cfd14ce3df9d3d8b3c46d8ed699121f58f1be3df6c238546cbcc086c16445bf82e86287a8908ff6d351ed3cc4855059b89260b8a47eadcb2f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7e08d006e38075eb32b3615ec28174bb

SHA1
fc87e37c81f0da5abeded2acf2ffddd19bedd178

SHA256
26cefa2de138091783862c792e54bc03b089581e1c71476a41ac85cb0e7c6177

SHA512
ad5503cd2dc2b982fd4d35006add0d12261c88462338bb5a3383f338e3572f77296c9ab308c13c213abce667aeb1516c1c20730fe5929f12cba44c6158c351df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79bd4a7fcea15fb09e05e0ea239e129f

SHA1
adf2a1be4e5930036aa9a4076930cd792eadbc06

SHA256
25a8472dbc41cb817ad6bbed6c70a550e357391a6a45056c30d1926234823cf9

SHA512
c9229d52b8b41550559fda8abb0e7379c5d0990e9172aa440d8876ddf0aa07443d5d9cc120b1b6aab4c04e5977ed91973e2fd15f69048b2acc0839e0bcadd689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a3c1ccbd730118bf6858aa45acc71526

SHA1
524442fb1ab205c66565787596b86a1cbdae2d1b

SHA256
e94e34f18a2453977ef6556a5befe3ce0b2dd2b762b90d869bf269aeabd216a3

SHA512
0e5fc7f7a2ebab60c3922b8ca12ff4b6905f66f0d252bf2171f4f7cae2503f14864d6ce4e33acc69232bf3b9f63a8f7fe61f8a37477f573ddd8f09db2529242b

Download Submit