0e1d6dbb8ec6e2ec5c20b56cd4b45b55203efbf4d23f95106b9783b5dd72e0b6

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dffd2575ae0974d83733bb90a0ba4115_JaffaCakes118.html
Size

58KB
MD5

dffd2575ae0974d83733bb90a0ba4115
SHA1

81ad09ff61277f22eb490b9300d00a53d7f413e8
SHA256

0e1d6dbb8ec6e2ec5c20b56cd4b45b55203efbf4d23f95106b9783b5dd72e0b6
SHA512

4c0ff65e9d70562282e58233434ab47ffb896a2cb499f1621e82dea7afdb5784b0156eafa058ae2983c319dc193ffcde255a724e84f038cd4006fd943a006472
SSDEEP

768:6ZJoagG12yjg9Bpi6OdlWDODwZqJtb2SFlE:u/f2yP6OZJt+

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4920	msedge.exe
4920	msedge.exe
4872	identity_helper.exe
4872	identity_helper.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 3780	4920	msedge.exe	83
PID 4920 wrote to memory of 3780	4920	msedge.exe	83
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 2180	4920	msedge.exe	84
PID 4920 wrote to memory of 4024	4920	msedge.exe	85
PID 4920 wrote to memory of 4024	4920	msedge.exe	85
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86
PID 4920 wrote to memory of 2200	4920	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dffd2575ae0974d83733bb90a0ba4115_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdeaaf46f8,0x7ffdeaaf4708,0x7ffdeaaf4718
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,17537877458183815915,3482591923964909784,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,17537877458183815915,3482591923964909784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,17537877458183815915,3482591923964909784,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17537877458183815915,3482591923964909784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2032 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17537877458183815915,3482591923964909784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17537877458183815915,3482591923964909784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17537877458183815915,3482591923964909784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,17537877458183815915,3482591923964909784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,17537877458183815915,3482591923964909784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17537877458183815915,3482591923964909784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17537877458183815915,3482591923964909784,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17537877458183815915,3482591923964909784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17537877458183815915,3482591923964909784,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,17537877458183815915,3482591923964909784,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
f0239d32dc9e592c32191f645e79452a

SHA1
06e718da0412536606ac1a498afa23bc5ce6b1eb

SHA256
a056f946113d1af2b6f02df6b83ce9885eadc6597eb5fbef93b59fd1ea3bf2ad

SHA512
6059012fe6bfb33713bad142c0ffe1ffa777baa933ded4a70645693e91fa635637a9b0bdea0336d972fb6a5ab6e67e770aa9405e61e7fb497027eddae63656bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3841fa38b0ca898778649db1aa773359

SHA1
42e6b159cbb8bc8fca823562feafe4bd2123b2af

SHA256
5d59e29fe06db0917978d589b6ec7f5137146fc9b34a4c243814b19d564255bd

SHA512
ca8eee6c9b6c788a2dcf6d2b2d5ab955ffb9590701595a7ce80de161e1a6ad928484e2a25fe9d69125a23fcaea2cea0b71e8713d1dd3a14c92b87a154e23277c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5db2f842493dad641970343eaf5c72df

SHA1
013fdd2b08addf2e0236ad5531839978b2b03d61

SHA256
daca56fc52bda211f080613c0963286b55f7ed6ea30615fd7414dbc712012396

SHA512
ce080a8f29c4f3532924a744462b160c93bb58fa9a720359e1b3a04168a0177f9e818d7cc21767c9d168c38c62d49246161adca652e337c482a881f23080fb0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8bd62402318d532af164ac03bfc05af

SHA1
2b8bc7c34196b71d0fda64d142faa44fbd76f78c

SHA256
ef658db955f6a21b6eb24851b9adc15152aa8a04bfd0ea954dace810a35a20b9

SHA512
ab422ce31907d301b96a8fe508de725b7149e538cb6175f5d0a6f59a5806974cf2b338bae45701509206e319609ec92b477d8b26ef22353ec56c97124a04e078

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f8850d0e94c8191206a3fb25b0cdbb7

SHA1
875055d0cefd0901240c0e0905e7f8e81b116c49

SHA256
41b6915f7b84415ec249364ae4b231452e30072836a2509ae034484d440c6e19

SHA512
45519ba33be59d843170c4aef5026565a18e38785bf8ad8270aac1908692e7e7e611e66640b98065e5258defac961eb51dd678352f093159628f2819224cb92c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
65f4387e115b43e8aa76abd5a2b55334

SHA1
c4ae41795b5cd5262f90fd905498d9284be671bc

SHA256
06a54c86a50e18324a791751d93caa05a4d748e3f9c5f6f771fcd39c3290dc9d

SHA512
943f13b42195a305def6698637b7ea363ca8103c54263b6ab23c764587a27017b49768cce5b9994344032bedabfdfc9d444f9a67738b01933222ea2b0571fdb2

Download Submit