1b4420f24032c662665b6566ead1031139b7531944d95e4fca296ae1e48ca39e

Analysis

max time kernel
146s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

110f92cd6a4796fc111543c33602d4a0_JaffaCakes118.html
Size

50KB
MD5

110f92cd6a4796fc111543c33602d4a0
SHA1

f83433fbbe7c26a2bf41b4f98781d34f5562413f
SHA256

1b4420f24032c662665b6566ead1031139b7531944d95e4fca296ae1e48ca39e
SHA512

113ac508cb202c5c24259dd1c09f3c306faaccdf488d691a58ce1a7c18d2b04ad7700ce749ba7efcd36cbac287ba0f101a606541cf7b8edf5094b37f3294ea6e
SSDEEP

768:3zMGRNr6+boagGjkla1w2PTvQ2go1yDwNlJLJ2Smx:d/tklcPT1lJLq

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1428	msedge.exe
1428	msedge.exe
2652	msedge.exe
2652	msedge.exe
3164	identity_helper.exe
3164	identity_helper.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2848	2652	msedge.exe	83
PID 2652 wrote to memory of 2848	2652	msedge.exe	83
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 5088	2652	msedge.exe	84
PID 2652 wrote to memory of 1428	2652	msedge.exe	85
PID 2652 wrote to memory of 1428	2652	msedge.exe	85
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86
PID 2652 wrote to memory of 4436	2652	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\110f92cd6a4796fc111543c33602d4a0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9026146f8,0x7ff902614708,0x7ff902614718
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16710578209538812830,10171819975111425854,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,16710578209538812830,10171819975111425854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,16710578209538812830,10171819975111425854,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16710578209538812830,10171819975111425854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16710578209538812830,10171819975111425854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16710578209538812830,10171819975111425854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16710578209538812830,10171819975111425854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2612 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16710578209538812830,10171819975111425854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16710578209538812830,10171819975111425854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16710578209538812830,10171819975111425854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16710578209538812830,10171819975111425854,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16710578209538812830,10171819975111425854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16710578209538812830,10171819975111425854,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16710578209538812830,10171819975111425854,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5264 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
99328b0024085660bcfdf76ef2c61547

SHA1
80a0da1b92c9aa297c64e5a8a78a13dfc564c04e

SHA256
5898f30acfccea19842135fadd3cacdc2e1c2a3e0cc287abaa722b333f67de5f

SHA512
e18c748594bbf433ab2f3179862ae491ee1db3230d46e682e5ea7cff07f516c560dc49c3c548654e9ca9201e9006f5bfdd04f9302790efb864b57f74b2f591a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3a80c096ac8a6462731dcd60102483eb

SHA1
96cc8bd2a9167ebcb37bfc5943a78e4236ce3e75

SHA256
a078dae48a2e9a2602106ca98041400877ca0732ac17d5bba8b5403a615e6469

SHA512
24573238a9521a60ef838856482b9987bf713c9091ef4bcc0d0c9e1ac2cf7ac684b6b73fa51c514fc5e5e1850e72415287bf1acba589d1486c2523ca94ca8414

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
98ce3c3ad6915096836b33c26dde481a

SHA1
a8ea0e205ba83fa85c38f683a2d4206c5e49d368

SHA256
9b3c51e936c7128fd5f57fa13aa2bcd7c001cda150245a779e70e539c56fe147

SHA512
41d708d41d6fcd2b96c27989cb89824ccbde478a3fb3e67f13d785eed591d11f36902b994c6b3076b9b42f8ba765cd2124155b5364a1a03e5f41a5ed7bafba2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d250238e16968262feeb39e86dfd7faf

SHA1
1bcaf9770fc4b1b574517f29652ef92001f9b9c5

SHA256
93bc44b2a631c584f2f9eeabccd5f10f7a658d0c6bc0ff465945521444dfb230

SHA512
2ba2c09ba465b8fcdfe9804aef7e012ab7cde643b3ebb9581697cbc643b1e62dc34f45dcbf62d3a3f1e11047241ffa3d731f36428cf43242df5451448d96a00b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f91d447dc23b67019f50cb88c0464e9b

SHA1
9c6f90f58c30490defa6eebe90b0c8bfe2a8c984

SHA256
cb33fbc4fca9fd3d8c51ef9e3d6d2f0809dddfeada904d389dfc92011f5fa712

SHA512
43bb970f043f4be3e66de9c5310da533ead8ed77e339ff76ad4fe20179f43e668f9903a812e75a949f378621d0058551f0ffcd2cabc256355bcc2555cee37117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
49ca60333ce331cb1bf4aff8e6bd83db

SHA1
d1680339d8e00370a93354eeb72580f7dee0bd0b

SHA256
486552967079a1c4ce50c584491ac8178eb76f914104b9ce7b5ab390f921827c

SHA512
3ad9c0972fb718f0eb980a4d128d33ff53f3f5d25dd8ecdb3f4aaa0cf877af3035e1081e3044fb4633069e83c93758a5e65437624ec68dd6fc6a046338169426

Download Submit