aebf7fa760ff7fbeab7563a1d366b677dff674f879fdc512efa389606f665f78

Analysis

max time kernel
146s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 08:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fa18d4972140c686713d388fa4da61d6_JaffaCakes118.html
Size

75KB
MD5

fa18d4972140c686713d388fa4da61d6
SHA1

7a85459a48047fa4070774c4cef323edc7fdf528
SHA256

aebf7fa760ff7fbeab7563a1d366b677dff674f879fdc512efa389606f665f78
SHA512

ae696ef957a2a950ebc09d90d332a5314707407f5266abb24e1689bdd3de5df3eb43d3471aa7a7fd8bb1d2e9546827b7587151118f86d50494c9a80882a82d86
SSDEEP

1536:+CLvmt13kEuqLu4Mg1mzMxivYA3GVsTEMHEFrA1YmfLWKDWG1Yc+q7UFnVjzhZwl:+CKh6ES

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
1832	msedge.exe
1832	msedge.exe
1820	identity_helper.exe
1820	identity_helper.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 3144	1832	msedge.exe	82
PID 1832 wrote to memory of 3144	1832	msedge.exe	82
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 4276	1832	msedge.exe	83
PID 1832 wrote to memory of 2796	1832	msedge.exe	84
PID 1832 wrote to memory of 2796	1832	msedge.exe	84
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85
PID 1832 wrote to memory of 1108	1832	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fa18d4972140c686713d388fa4da61d6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f8b946f8,0x7ff8f8b94708,0x7ff8f8b94718
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,5213442697967309485,9264124908713936358,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,5213442697967309485,9264124908713936358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,5213442697967309485,9264124908713936358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5213442697967309485,9264124908713936358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5213442697967309485,9264124908713936358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5213442697967309485,9264124908713936358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2740 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,5213442697967309485,9264124908713936358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,5213442697967309485,9264124908713936358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5213442697967309485,9264124908713936358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5213442697967309485,9264124908713936358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5213442697967309485,9264124908713936358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5213442697967309485,9264124908713936358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,5213442697967309485,9264124908713936358,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
955B

MD5
106cdbca76a1fb18c960928aa6e885be

SHA1
24b42b5067833bcf8c9f3139524907bec262e178

SHA256
8791132bae08887597d440e20b8c7261f6f865c5ff9abb6b566b9b2ffa9f4d5d

SHA512
315b661360e9a63053e86885bfc52ecd7b0d210a5342758cbb4fe50afc424e6cf9a9039801764467bdcede596117d002e1aafcd16d0fa48ee719dec95427d8ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e8a03b01cf005aab3129617cbd379eef

SHA1
aa34b61844b192186da5816cc7c9fc291d032777

SHA256
1bf5375a2512104ebace36250bcca4be1ac4cc505a2d108f76591e381a4f22cf

SHA512
e89aaf853a4d8d7191ba9e1a5289708ead262d02147d9b12166aead5cb928145e928d187be1af70f1a2a98f7d9d6a7e9a9fbd7c679e94cf4a369010bc8b8ce49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7df8547ba3c4a2435dec5dee1e6c6edf

SHA1
1f91ec44d58635b53be668ac0aad7293045e3b7d

SHA256
9cc9e9d54a6e2f49a457a4044be8f503012d39f09603bbe6b281a572008d78fa

SHA512
5886e762993cf2209dcf7b43ff91a9e8d438829e686ef931bdcf65a211779e992835c03750f86ace961c3d67cae9f84c05248aa92c85b1cac626b36124600d27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
777faf609d182a199197140b4c291221

SHA1
221af400c2e3226ddd25eda7e579df1b399d8dd9

SHA256
11c06827a9fc8e1b6bf8166e0f261d0e2e5bb505607a96803d93bb8ab5b98251

SHA512
d271756d7a573b46304fe066c270ca179adffbcf2e81111d8c1ab4ff1a8fb956f32d4a3831ae3f25f5c5cd21cac21d2c52b0d1d218f610d6c3aa15c133f104da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
505018b09ae3fe925102a474da428621

SHA1
a39e8581f1ef999b27c1909d2c4cad76b417354e

SHA256
0b9cdcbbf2f084ce3e0b41cdba28b1e020292713de91df88398421a4e34e5016

SHA512
3f710c35a94f4a91f7fa801e7179925f921ce46dff49f45779df5e6bc2581ec4fa6dbc946e318ae250ccb1ff3fbe053f52fc3258e95454d492f37dec52afc862

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583c29.TMP

Filesize
204B

MD5
c1136542ca852a308ee29348b2bfcbb5

SHA1
099cc96ce6f3a2f631cba8e2d9b10c845784102d

SHA256
bcbdf30fe50be1aa9bf35d23c674ded2e4b24a5c90a105264f20239c07193bf6

SHA512
860658b4fdc8e2c9db959faa20cd990cf68cf79e7c7cfb32558a938f34ba2d3fe7f192336053f05517cfd710ba04c36c5aff2ee605f4d64ee09328a2a3881548

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fd38b36f652b82d9962416246e04d6db

SHA1
3ff7c25f256df1d36fb6d2b5ca2708e51504ba31

SHA256
e07c0f84826245b9df515bf58e38c87b5ae7cd1e83e91000443d686cfa413f30

SHA512
0e9806bb20def1d42d32a84b79fe53d5348141b76f155dd47c995819b79faae4e8672ab31eb39474a65af8ebe46e30a2d4425f9440fa87e3928aaae560e48d2e

Download Submit