3366663239f99eb93c547eb01f83909a4eac8c894eaa477ba1b4ed5786d79100

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2207c83383e78a0cb367b620df8b1421_JaffaCakes118.html
Size

80KB
MD5

2207c83383e78a0cb367b620df8b1421
SHA1

c0fb0d829fad421105339bfa561d44b7584e0201
SHA256

3366663239f99eb93c547eb01f83909a4eac8c894eaa477ba1b4ed5786d79100
SHA512

1214304541aa4bc1967a847a008f495ab1dbe484c253e85825ee3fed7a8a71e062278416fdabb81acd594eca7d9b5877da9a1e1e7f2fea2d685ee4fe05b6b243
SSDEEP

1536:MNw5JAzqzf9CkdzJugMTvSdrX+VJeZPL6kaRgRj5cVak0XVWwXwSecpk/M1TamEu:mw5oqZrEKZOXCDZyAN8HIVbgRcpgDmEu

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
4500	msedge.exe
4500	msedge.exe
4556	identity_helper.exe
4556	identity_helper.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 4608	4500	msedge.exe	84
PID 4500 wrote to memory of 4608	4500	msedge.exe	84
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 1604	4500	msedge.exe	85
PID 4500 wrote to memory of 3084	4500	msedge.exe	86
PID 4500 wrote to memory of 3084	4500	msedge.exe	86
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87
PID 4500 wrote to memory of 4864	4500	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2207c83383e78a0cb367b620df8b1421_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca45046f8,0x7ffca4504708,0x7ffca4504718
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,5922972542242115975,14915002011100628476,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,5922972542242115975,14915002011100628476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,5922972542242115975,14915002011100628476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5922972542242115975,14915002011100628476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5922972542242115975,14915002011100628476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5922972542242115975,14915002011100628476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5922972542242115975,14915002011100628476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,5922972542242115975,14915002011100628476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,5922972542242115975,14915002011100628476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5922972542242115975,14915002011100628476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5922972542242115975,14915002011100628476,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5922972542242115975,14915002011100628476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5922972542242115975,14915002011100628476,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,5922972542242115975,14915002011100628476,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
717d6d01f1ba15ad936341b31ae59155

SHA1
cf02780f4f9ef79b0eb4e5102cedceb604ee5ecc

SHA256
2413663e420594aef3637803a7d7a066b48f29e0f1f73db04ab3020f2593906d

SHA512
40ef0d0d937bfb615711f53b90aa24333d07a3a1afc08a4510f52422c649177f3964a06b3d90a77df611249a50c6474ba733af139bc0edf48d6597ee99209035

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f1b32713900801706b41990a79cc6560

SHA1
ad7bc65bf072e0fb9d1e92702415fef589decfab

SHA256
6081b027dfe930b723a53d82733c81e236dca1bcf3f57d3f4074af7ad3ad61b9

SHA512
64a6663cf83230788b9e34c7cd7075ca99a1f0b746eaca2fc1b8ecd2ba09b5cd7b03939ce3fe430cc700703237e26f64c38cc15cf87397a14fb06cba35e4e3b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
301555e169a3cd5c152dd31caea082f8

SHA1
5ae60979f508ff362b52acf018b298a58ff67e64

SHA256
47072ccb61185f817ef08f6d6f59e3707705c7311ff18860aa5fd4d8b863d263

SHA512
41bb11303fc698e6fb50d8d8564c61971188bc83703a2b09ca7feea6755d9adb4652bb314631419649069c45d4bd5736ff5c6a27c7519edff0c185ba8c529252

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c3c9e17a0ee34e4b87743803a62024f8

SHA1
aa7bef43168d5cb8e9a225c934fd25834647cbf9

SHA256
87418c383d75ce74fee01aa50f6598ff7ac14181f0037996ef3ca20e3f80eb34

SHA512
9fdc574937f227d4426b7f9504828c393f2ccbff11a04062a0b67fbb967f52c54f23e2b1ab6a937e29106cde51090cd64f0d60331a46fba1f5e01c798926219e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cbeee06f5514f01f1bf36ca39bd4c7c5

SHA1
4a02021ef9220bca26912548f2e55f090d97e5e4

SHA256
f9d38529e0ac5d8162c7fb4e6764d484a768705903db9e43daefc582a6399a80

SHA512
7f8550267954e97e76731f14efb53e17b3af74ba96b2e9d6c3448ce09c505a2a8065403d7a762e92089a1f0c92de906c286f475a79103af559b11801d355db1f

Download Submit