0534fcd89b54f58e175d2456298dbeddd4061b5c67cf927a691c420c00e80cf0

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

151e1109e8a51403f25daeac785645a5_JaffaCakes118.html
Size

32KB
MD5

151e1109e8a51403f25daeac785645a5
SHA1

d16681cedc2651f377a19643c7b0edc0db2dd692
SHA256

0534fcd89b54f58e175d2456298dbeddd4061b5c67cf927a691c420c00e80cf0
SHA512

a4d7c66f09b9bdbb38497e6b963e20620b412550d7fc5e1e93d9d9de971b52a75bdf4fcd7a7690f752225f34a1a3d35910ab6f97872f117e7b4bf9be927ef474
SSDEEP

768:wu5NdFCn2YVcf0GQo9RuSGY4kexIqGEXPQmpxL/ifmateoMhZ8:wu5NdFDYVpGQo9YSGY4k5qGEfQ6Lifm0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1956	msedge.exe
1956	msedge.exe
4552	msedge.exe
4552	msedge.exe
1008	identity_helper.exe
1008	identity_helper.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 216	4552	msedge.exe	83
PID 4552 wrote to memory of 216	4552	msedge.exe	83
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 3924	4552	msedge.exe	84
PID 4552 wrote to memory of 1956	4552	msedge.exe	85
PID 4552 wrote to memory of 1956	4552	msedge.exe	85
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86
PID 4552 wrote to memory of 704	4552	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\151e1109e8a51403f25daeac785645a5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe63db46f8,0x7ffe63db4708,0x7ffe63db4718
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,8656547875570764143,10255966194839350653,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,8656547875570764143,10255966194839350653,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,8656547875570764143,10255966194839350653,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8656547875570764143,10255966194839350653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8656547875570764143,10255966194839350653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8656547875570764143,10255966194839350653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8656547875570764143,10255966194839350653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8656547875570764143,10255966194839350653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,8656547875570764143,10255966194839350653,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,8656547875570764143,10255966194839350653,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8656547875570764143,10255966194839350653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8656547875570764143,10255966194839350653,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8656547875570764143,10255966194839350653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,8656547875570764143,10255966194839350653,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,8656547875570764143,10255966194839350653,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
30b3a2a63230702f09fc030b4efa0682

SHA1
4e7fe6466c89cf5e83c061996414268fbd530399

SHA256
046ca8e88a85e76dcd3cf5966b063e20968d9ed65c1811ae7f55a35f6653eb4e

SHA512
ade931ba1a9da11c6769c69006bbb90eef9c24175145892868b6955dae60a8d24e262578c8846e136e2250a7c2d62ace8d127adf304ac0a032516b7e47a76570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bb9b9568df4f0e41e49ff3310f8932e9

SHA1
f655d0f48c3e136c0359c09f58d2ce59b30243e4

SHA256
05e18061bb6857cc9a94ace074c23afa4fddcb3a2753c35c48fa05da52bfce00

SHA512
5398f1ace0951c642ed2b39d075a0c64275eb89d0c197efb1ed9683ba2459a5a08b25b5863fdb90276e345365855cb5b1130dd367304bd0cc3c3daaeb93dfd9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2a27930cf140d51139eb7861e9f25a69

SHA1
bc1e29b735998a967f7499a01ac7e6daee564900

SHA256
32b1d07a64437da53b4cdcba94612b05a01895707fcf5291c4333a13a8117ea9

SHA512
cf6350a2503d9d5b050acefcd26f375152919c111f81356e4d37b72e2943072712ff033afaeb506374d15d1686f72808cd70f1769ce0bbb6ec98d9dfdaee3f33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0bb10f6daccc2cd1c29435b82117b9f4

SHA1
5356dedddd693c9210100f2cb7235309e101b30f

SHA256
dcb240b5db0e4cda00de2def1d22e7ce5777903d7624f71f657440abb0c07345

SHA512
95ba3f0883c9cf2b5f8824fd63ad2ececc000d873414d541670e34454c95da13bcc79e38c798a9848253a788268626db61e797e45f285d980aa965f31fa311d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
df116fb541842b52e8cfa8c780d814a8

SHA1
3532fe29cb94bb5f84ebf4010e813b2f1dc62402

SHA256
41f3caa0c51c824e49ce22ded2ff441988a56163018214f746460b735a51a973

SHA512
49b005d849b5fce51085c68ad51fa6eaa88d7750eab2284e19750ad836b84fc63e6a811cbc74c8d4e116e6be175a6a7d37e41a98c276cb406ce48260af30891b

Download Submit