96ef4b762798c4521b2ca229c0736f1e1ce7021b7443ef115fbdcf346614092f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

368467c7a7d5d94ae8882d47c9983cde_JaffaCakes118.html
Size

37KB
MD5

368467c7a7d5d94ae8882d47c9983cde
SHA1

fd0baa959448f1448e12617fa3031330c20d8d10
SHA256

96ef4b762798c4521b2ca229c0736f1e1ce7021b7443ef115fbdcf346614092f
SHA512

795ce30b5fb0e70b34e2547b039a981692e0d8be12ed4c49608842d12007d76da07e6c973d130b3383728a3d62a07859f2b6cc013225430ebd53433b1339b4cb
SSDEEP

768:Yc/bVoRTW81D4RA+vEOjz6rdG2Gil54RZfPGnf3Gu34a6i6781DdRA4vEOjq6h8q:aRTW81D4RA+vEOjz6raA7IaRC81DdRAW

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
1640	msedge.exe
1640	msedge.exe
4816	identity_helper.exe
4816	identity_helper.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1736	1640	msedge.exe	82
PID 1640 wrote to memory of 1736	1640	msedge.exe	82
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 1784	1640	msedge.exe	83
PID 1640 wrote to memory of 2940	1640	msedge.exe	84
PID 1640 wrote to memory of 2940	1640	msedge.exe	84
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85
PID 1640 wrote to memory of 1512	1640	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\368467c7a7d5d94ae8882d47c9983cde_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb611046f8,0x7ffb61104708,0x7ffb61104718
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12281715613672786737,17175892973757797874,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,12281715613672786737,17175892973757797874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,12281715613672786737,17175892973757797874,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12281715613672786737,17175892973757797874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12281715613672786737,17175892973757797874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12281715613672786737,17175892973757797874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12281715613672786737,17175892973757797874,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12281715613672786737,17175892973757797874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12281715613672786737,17175892973757797874,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12281715613672786737,17175892973757797874,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12281715613672786737,17175892973757797874,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12281715613672786737,17175892973757797874,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
728B

MD5
29c06034160f6cf8410ce7a519e409b5

SHA1
2574665e648394c99129fd6ae9f136f32aead51e

SHA256
1051fbf80c64b11ce4ec9d1c809ec6df759816f14c05f61bb8bd7892b9e9b53e

SHA512
5a34fd575a69f56fe06050a06144297cf04298c27b749da2527975083036e4f265485925950919652d4eedb2a5969e0feaa25e528ceba5e7d28f90274b58fb99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8992fcd297ba260a7c6f046118a093f5

SHA1
e536ffa85ad81ed681f44bbac0a4aa55264609b5

SHA256
2d72e44545c8aa65e708165b9867946bde966adb471a0fda2ffb38edf263b2ae

SHA512
e3bba2d0efc7b5a95261d838355dced0f0433bce8b8cff20e812373953f8a2500d877008da057b40146c98fea487ecb1fa31de23de4e9fea2721b72fe4e3a0d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44c9a6acbb9a9b9ab7536f45fdbb302c

SHA1
eafa1dc2c456745b71cd0f37bf31d8d7441b8bbb

SHA256
803ab91944a1e54ec24e7a57c95b2f758ff1520af6ae8db6f97b040fcab741a4

SHA512
29f743820945e83242e9751a1610f8610758c42673a1564f915ea0ac56e39fdad0f2f0d1187044027d56eee94cdf8ab22d62ecee9ecf30cbc644f994eac8c3a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
753a0f24bd5b5eb7ae9596bb77f49c22

SHA1
cc8be0c7597253d00f52bd3d78540ab6cf3c0e00

SHA256
43c9c45092fd7cb5ac4136ac8930f59ea8dc45510951d2af3b62344775551ed0

SHA512
a4520d93c34a3948b206ae864cce0f66536a03c851a511d60af046c740a2fee319c687e1afa7b1174e90fc0930bc79c42d9afb2dee136845461f501e6ad53b99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
daf19f9e0ba8e63b614a76168991421c

SHA1
b6bf40033a073c3832f33f4197deaf38445345ca

SHA256
238f165b7736b238a8152764c15ab18bfabfe996f46195925d6959c89a8b171b

SHA512
0889c8223e4f25594f92f28ceff97b612d7371d08d655348271689989a10a7099a64474cc90fe8fa220f21aca522b06a621f35d3ef8a877a7793a33c1375ad55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b65240543c8274535d987a2d2009ecf8

SHA1
5af4cce084fa10f1728475659d5c9e95884538af

SHA256
44b04f782b90fb62bd6248915ea00019b3c81aee31295ec15bb27dd16c150e82

SHA512
8a3da9a4637607014d1d8313c4b41e77b320d64b17f41cf06d10084df0e65cf0fdc49d2127b9d15d4f9cbdc41b6a97baeab3b41a7170bf19ea1dbabfeb0a91aa

Download Submit