ee8e7cac134c76af15e70b4d2f3d69121f0fd9623d89297cfc55c8b65b5b3ad9

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a78af3367887ad2ef765ce6107611da7_JaffaCakes118.html
Size

7KB
MD5

a78af3367887ad2ef765ce6107611da7
SHA1

eed576e758584040c7c8af8c76b39200e050bf79
SHA256

ee8e7cac134c76af15e70b4d2f3d69121f0fd9623d89297cfc55c8b65b5b3ad9
SHA512

cf073aa10fff92b9ba7b6087159ae4a17cc0e7af820e91d302efb2aaccb3c74bb9d77be20831584f14382a337ed0695d0232ab6c4294e2e3607b8cdd5ca93d6f
SSDEEP

192:UEArnxDJOBWEW77uTHKSMEArnxU4ZIgIiM9:vcb+/AYvcfdX6

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
968	msedge.exe
968	msedge.exe
3096	msedge.exe
3096	msedge.exe
2948	identity_helper.exe
2948	identity_helper.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 2476	3096	msedge.exe	84
PID 3096 wrote to memory of 2476	3096	msedge.exe	84
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 1744	3096	msedge.exe	85
PID 3096 wrote to memory of 968	3096	msedge.exe	86
PID 3096 wrote to memory of 968	3096	msedge.exe	86
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87
PID 3096 wrote to memory of 2564	3096	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a78af3367887ad2ef765ce6107611da7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c31d46f8,0x7ff8c31d4708,0x7ff8c31d4718
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1013618920604160059,6322610245449938188,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,1013618920604160059,6322610245449938188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,1013618920604160059,6322610245449938188,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1013618920604160059,6322610245449938188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1013618920604160059,6322610245449938188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1013618920604160059,6322610245449938188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1013618920604160059,6322610245449938188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1013618920604160059,6322610245449938188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,1013618920604160059,6322610245449938188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,1013618920604160059,6322610245449938188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1013618920604160059,6322610245449938188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1013618920604160059,6322610245449938188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1013618920604160059,6322610245449938188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1013618920604160059,6322610245449938188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1013618920604160059,6322610245449938188,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
dec7f372427f40befca11be4623136df

SHA1
90274e8882e412e5a2a3452685d1adbd4694276a

SHA256
f0e2435753d974633bfcb2d29d9e876899a31fc9673cf338d978f8790748b40b

SHA512
ccdd2c24b2986c3478948a2e7185ae511cbe906bb8086f34ad34f23a53d4ea5588d9c7d3a8984c2d9da186dc6ff86692c85965162dd244ea7c96b2ac877a6d79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
93d4e0b2b067b1f8f0307c66bd649d85

SHA1
2f20ebd8dc1e74348a7a2f8f06c84946432b2eea

SHA256
6fbb204b2d1833bb4b15ea19f1cc095510ef832efada4016a2f4cb875f24209a

SHA512
1866594fcca836044f8a674595f0a4b26b5c03ceefd2e62b9d29f23050d11cb67c899f7cd5ac4265ef913d1ba597f3b662db53fd5467dabf739e7d4486949109

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d2a9952e7d4e53b6894958004c4d2a1d

SHA1
291fdab6a061a95b0bbdbc5a7d21da5040020875

SHA256
663f39d946af1576b1564582f333f48004c1d7986ef2ba3172418c6d81d40613

SHA512
160defd509f94ae40ac4de8c620b8f1be551ef0c7096efbea7967f06c6ea2df353c92c58aa25d3da6b2d7cf2e02d7c0dcc10e2f4cce72b49fdf7d45324beaea1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c9d0d41802d1aab311b6541f138bec7d

SHA1
5b0e03355439387296e1df4dbc2a6bc9aac83f93

SHA256
a426516b8ed92ad510953c36b0ed5bf4e2160cf642bf491a30ac88bd076166fc

SHA512
fb1ea671101a1862bc1238bfb4011ab9f0eec2664ae7375b3a52f34023879e7ec77f01d67b854fea58ddb5970da63986b4d551c2c2ec43b94c03c6396ac1a8ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f3d9b3f021d0db2750c1afa0c5ce58e6

SHA1
ecd328e9a98e4e5bcc754e94f97b905ce916ad46

SHA256
6373ad035830292acc45913c74470e5231d2ba1b59a927f2f10eed299d41e20e

SHA512
17e93d95f5fc999ee1b2a7ccc40b42a430462e93b2eaaa588f7808f4c01a63de62c7adf5a49ad1d815547710d66a04946d626b72baeb45f3327b2eb71fd5eaad

Download Submit