f2bfc06801de72fc43ec55fc13144c871e87fa400265e9fde5f3e6c1e2db83a4

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4f0796025f92830a0e0aa712e42af75_JaffaCakes118.html
Size

13KB
MD5

b4f0796025f92830a0e0aa712e42af75
SHA1

6f150431b1c84b01ac0767abb51fb67cbd9c4ea0
SHA256

f2bfc06801de72fc43ec55fc13144c871e87fa400265e9fde5f3e6c1e2db83a4
SHA512

101c263aadf01396d5dab0425a9e1441a32601c936718e07b6e28c12932b29f43ea1bbb04eb550b41bdc646c89eabc728b50b46b55d4401ac3b486adb02ca19d
SSDEEP

384:8fdSptUy2mf15K2s9UnhdKWeQDckCnX0kROF21BNj:ley2k5nsSntDckCnX0JF2/9

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
1872	msedge.exe
1872	msedge.exe
872	identity_helper.exe
872	identity_helper.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1716	1872	msedge.exe	84
PID 1872 wrote to memory of 1716	1872	msedge.exe	84
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 1324	1872	msedge.exe	85
PID 1872 wrote to memory of 4440	1872	msedge.exe	86
PID 1872 wrote to memory of 4440	1872	msedge.exe	86
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87
PID 1872 wrote to memory of 2788	1872	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\b4f0796025f92830a0e0aa712e42af75_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8e1246f8,0x7ffd8e124708,0x7ffd8e124718
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,12907325380650222439,10215916028003409095,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,12907325380650222439,10215916028003409095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,12907325380650222439,10215916028003409095,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12907325380650222439,10215916028003409095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12907325380650222439,10215916028003409095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12907325380650222439,10215916028003409095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12907325380650222439,10215916028003409095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12907325380650222439,10215916028003409095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,12907325380650222439,10215916028003409095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,12907325380650222439,10215916028003409095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12907325380650222439,10215916028003409095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12907325380650222439,10215916028003409095,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12907325380650222439,10215916028003409095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12907325380650222439,10215916028003409095,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,12907325380650222439,10215916028003409095,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
d72be92dd3a87e5b4acd993dd9c14f32

SHA1
14d8cc1535bf56a89afedaec7c409dd8df7e3173

SHA256
7f398e74384498f2b47e6cee3522e4dc7c5a2e94f5000f01fac9634719a8dba1

SHA512
75582f8c58f2ad4fee4a2cc8e86583d50227cdfefbce5a03da2a98518258752ae1470dd3b80c919ee93f6246d26399913d14d3070bbeb5250a41e693da0f7a70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
553B

MD5
fcd5c2b1ecb268ac98435597e3722f48

SHA1
c1f1b18db3954f970d7b491d520f48acddbd921c

SHA256
48b59a30bd1753da2bdf81afe988415a30573d862c6f4f6c68a044b0d18dbc4e

SHA512
eda11eb08a7eabda276e72a3c87936c788e5df08b06cdfc9b67595f1e21345edb0289ff5116c4f828d1cf45f92fb03fc9b5439965714b1180aed463d02841fd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a5cc7c1e099531665c271b445dc1d633

SHA1
8ef61e522c890efc3f32a9f9881e477410c04a80

SHA256
5c568a7992e7ebf7812d1867a5bb6768389161bd4606250fcc1c75d1fe174c40

SHA512
69fa838edc689a28c5a64b6ba6e340d29d8d2411b3e5375330f19fab7f9f4d0e8266a80db78d6a02f4096dde02eac5dcd5a5ad500abf4cf54e6ef47a96cad5e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f78769ef86688dd1d544cbc65e08cb6e

SHA1
4a1ad9b35124b9ad686a2e0d7e90384d27ee6744

SHA256
264641169cbaf647a95b2b9433555c7c14eecf08a96668a0d843d58a07eaafe7

SHA512
425ddcbd85e994ba0213d136539d0f76a063b4260376e6c68691b0b2861a681fa112ce3e08a606c4eb4fc278cf8ccdb8c5591108641c826e6ca02e7873e99024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
650684fb6627c610682bf2927fdc148a

SHA1
b5e01cfebede8d5b4f6ec34bf4ec1dce036077ea

SHA256
f8405b3b251cf49f5c49de4780a27afbe951aea3d2a12558f9a9054e46a1ee80

SHA512
94e8625281f70f51c9c49a995960b09f59de42645291cf7159213c5410943dbe674d0fc63a9c9917856ae66de78299f8a9465d48cf9c9ddf4c0bdfe573f63d67

Download Submit