217b1c404f368d28b139ffcb22448d9c9516527d95f9c605185a0a18c88be707

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd2191f5973dce15134d6814910bbecb_JaffaCakes118.html
Size

95KB
MD5

bd2191f5973dce15134d6814910bbecb
SHA1

f6e65b9f5424667736009477ac02061b54d6556a
SHA256

217b1c404f368d28b139ffcb22448d9c9516527d95f9c605185a0a18c88be707
SHA512

491a1c5d2f82dbe280099312255ae53ddb2747c5611085bff6abcbce82cdabb2539ad9aac0b4ba174cef795b77ac639dd5dc7b7ec5a1951ba5c02e34ecd1c93e
SSDEEP

768:0ylkSgOriWNQuavoBgGjMC1v9JnLkIO+4nimsLoS7uF79n+UIomisUw/Qfq3dSyo:+aBMC+IO+4W9sh/Jir82oST5V+

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
2552	msedge.exe
2552	msedge.exe
4968	identity_helper.exe
4968	identity_helper.exe
3336	msedge.exe
3336	msedge.exe
3336	msedge.exe
3336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 3584	2552	msedge.exe	84
PID 2552 wrote to memory of 3584	2552	msedge.exe	84
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 1440	2552	msedge.exe	85
PID 2552 wrote to memory of 4992	2552	msedge.exe	86
PID 2552 wrote to memory of 4992	2552	msedge.exe	86
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87
PID 2552 wrote to memory of 1952	2552	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bd2191f5973dce15134d6814910bbecb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e0d346f8,0x7ff8e0d34708,0x7ff8e0d34718
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,475059369686301004,5878588375936027870,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,475059369686301004,5878588375936027870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,475059369686301004,5878588375936027870,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,475059369686301004,5878588375936027870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,475059369686301004,5878588375936027870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,475059369686301004,5878588375936027870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,475059369686301004,5878588375936027870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,475059369686301004,5878588375936027870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,475059369686301004,5878588375936027870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,475059369686301004,5878588375936027870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,475059369686301004,5878588375936027870,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,475059369686301004,5878588375936027870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,475059369686301004,5878588375936027870,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,475059369686301004,5878588375936027870,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:64

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
371758167d5221693a2b4041547d408e

SHA1
04b5ae571ed0c73ad22c2534b15db0490ada51bd

SHA256
86f765fec1befc095d42bd30c27707f224f72b919c172cb37f2573f3ba684a31

SHA512
f0b27c433ca444a7bf9414b404e8eb0888b4744835016a833f29635280ac70de17d6187cf8b342ea26b143976e9595bbab834f3e0dbab26bec4f9e4b1a4c1882

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b759a20371b057d6030e97203206ab1d

SHA1
816f1bdd74b5167a6de1de7bf4955290d6569f73

SHA256
e270371134545a0a74541210aa40958fbf7fe496812a1ab479cafa8696dcb26e

SHA512
690601025c6061f60eb37b59484aa6db372500a3316300e50b53cc8bd8e56ad1b650aeae30320f290123458b1da7ab87fd527bfe9f4fe0e7e39048c504bb7596

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce90ace4194371af10cb186aa6d5f279

SHA1
66303e8717f533a44b69f52a4f1e97982e1b41c6

SHA256
45a00336b962d787dda8cade9a7d577d59b9da7b12eb5043c13dd67d14562faa

SHA512
25ce6365fd5ced9483d658fa2617551ce35273258dd84da204bfbd560cfabca14c8ea7067e24ea1e2fdb7fee6516819cd8c937d2e4673295a012cdef2480b982

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7e14cc82f72f4bebd25b7a37c5b7a9d8

SHA1
277ac750e1ac8c2aa233ebaa2df4dbef675b0eef

SHA256
3cc60e32bfb919c43596b270944d053ffa9a68b664654f18ca6164b3e4c86e44

SHA512
34b0d0243f25c863c9a717710f5ef1b75a56a7211ca5dd2ee8ee033048f88f270eaa1b64a122d56208c03ef38050bba631f0b633a020c844e9936b40021ec3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f4905d2ffb47617502e718933e6c556

SHA1
645c86fe19cc06a947f109ed7fd7829fd2da32df

SHA256
39ce04a7b31a1f00fb9c8cb1caa071482d9766840404a96c51a2505fe7b0281f

SHA512
c8b786b760699c147929ed09c6c976234f0df0e60a7fd8d94434ea1ac3bf51a2f89811d3ebc5f8fd5c2d4339a5111b46544559351e2c74a0b85a7b38c7ad42e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b8e19ec390abdababacad79ec13701be

SHA1
a77d29d71fd4bf480281d13aed7a49691937339a

SHA256
4417860b025b928b2814845e08ccc055f2204bee1d0ec3c75b74233690ea7770

SHA512
30d5a69302da42cd929b726278c6e847a0c4922589c43798123a41530b615cf7d14fbd6ed653d2697ff6719ac848e079f0a249b258dd43b4295cceb72fce878d

Download Submit