b7728ef950da727e06a7a529d843e9a1c1b86a4e90a1237a20cf3fea856dcd66

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

014ff8f573a7c6f2a3c05c89d14aa673_JaffaCakes118.html
Size

33KB
MD5

014ff8f573a7c6f2a3c05c89d14aa673
SHA1

778ab3a81f87d1fd22b2e0929a860528bea440b8
SHA256

b7728ef950da727e06a7a529d843e9a1c1b86a4e90a1237a20cf3fea856dcd66
SHA512

2faeb0c0a7b4d59b6b32b18860dc157cf2d69b6e43c1ea01cf35e91363192ad5dbb9118fdd19b1cc6df63d8d4d2b08469e1fa35a61b9a4e5fea87920aa8e25e1
SSDEEP

384:BgA/X4xjEuIUlsgRc93+arlKSE/tKymHGIm6OHGv+FlQXyc8XoBJQkLgt9PptBMQ:BgA/UuUl5Ogo8ImxHxFyBVLgDPptBMCh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
2372	msedge.exe
2372	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4752	identity_helper.exe
4752	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 3680	2372	msedge.exe	82
PID 2372 wrote to memory of 3680	2372	msedge.exe	82
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 312	2372	msedge.exe	83
PID 2372 wrote to memory of 5032	2372	msedge.exe	84
PID 2372 wrote to memory of 5032	2372	msedge.exe	84
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85
PID 2372 wrote to memory of 4516	2372	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\014ff8f573a7c6f2a3c05c89d14aa673_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf8ae46f8,0x7ffbf8ae4708,0x7ffbf8ae4718
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3699574896697445612,14004951300693985127,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,3699574896697445612,14004951300693985127,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,3699574896697445612,14004951300693985127,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3699574896697445612,14004951300693985127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3699574896697445612,14004951300693985127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3699574896697445612,14004951300693985127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3699574896697445612,14004951300693985127,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2392 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3699574896697445612,14004951300693985127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2392 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3699574896697445612,14004951300693985127,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3699574896697445612,14004951300693985127,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3699574896697445612,14004951300693985127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1288 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3699574896697445612,14004951300693985127,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3699574896697445612,14004951300693985127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3699574896697445612,14004951300693985127,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:3516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
7d92cbadcdfb5405a40138f0b752a3e2

SHA1
6aa7ef0dc1a691d2d5e038190df93227410a4fb0

SHA256
2e1ecdb913629d621f66cfd954291a00e79a09ffb51f1e9633f04548fddb7276

SHA512
14d4260e80f267c5ef5bfc9b84e843a5b1851952069a4aef418908488e06635f770e6c3210700e2e9530db038b13f70ae107c48002e6bb221e290ebba236ae11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
409B

MD5
3add3997e9a34e828bb31c964de5144b

SHA1
4d3839c847674bee2332a3ccca47e1e777eddfd1

SHA256
85c62dc98df741addbd2b45a32199853f9cbf9ed2bbff4db8dfa722eff06de04

SHA512
99ad8dda0af8f670af2921dabe8972aca71996c056985bb22f985f4cee23c522e52946645da63ba91d30e1f737c1f34e0447456d4e9b5ac54492be64d3f91d75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
71a528576a8f85cde4ee2e064c983ee6

SHA1
9d2952fdf952c085f2c59d31079a7785bdca9333

SHA256
98337d65f3ac806a1a0aa8a83c4aaab0d4f1979c4b93da79a63bdd04f83dc41a

SHA512
681f0ef09450bd730c07c61cc89cbdb518e6ba4a362abd17cbd2adeda67bf8bd7681581fa82123f7d0a30528b455589fe121b3fe101a40c4a210aa7ca93cf6a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e8f11f30e1522d6eda77c97f89d9035b

SHA1
b0c65e3ec470a92ed36094b2d397505afbba270f

SHA256
29d1cb3467ea097aac40c607f19b11f24c54ffb9bf5140f665a247e2c8b04c83

SHA512
3e260c7a42894955846cf12a3376e15559eb185a63f02fad467437b388d834f3678ed5fc848b86dd5efc22011960403661daafc8dbbeb179dc6000039b559850

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
54954ab6cba0a30cac9505c0c093bda6

SHA1
5351692e66d8df60f6492b65c5e5f77c1dedb693

SHA256
e6a6ca47aee9ee573ed900f9566fe5ec48c6188846b310fd8b586697961c59b9

SHA512
7097743415541a0fbd84ff4a0fe1e21ccefa727dc73838d62a1f04f327b845765f757d646bcafe1ca01a9791c8a741f3256f4ef12bec2aa44ca289dafd2af0a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8c91161c154b8aa8c74ab2f647679f89

SHA1
2f75e0693ba84785c258f8eee77c3903af355b15

SHA256
b3560dc78acebb7b0a715b669c3cefc1fa3068488474b535bbb2c3eeecd8fc0b

SHA512
7ad139e11baaf4dc34ca7f5dfc3e7276748a80bd564b9a6e208b6ca3528f55dc548bbe41272fb10328fd40e7156b393c5bb75dcf5300171fa30310ec90dd7ce7

Download Submit