6869d82ee7d308b4cbdcbb3f966d0574b91670331640f7276c4767dafdb1db82

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ded84cd9d810a8d74411290c010f6df_JaffaCakes118.html
Size

26KB
MD5

3ded84cd9d810a8d74411290c010f6df
SHA1

71923c305a78d5619e23694ce8870f90cbc12694
SHA256

6869d82ee7d308b4cbdcbb3f966d0574b91670331640f7276c4767dafdb1db82
SHA512

fbd89e9f07d4d085f23043cb34e418c8bc7939bc24175593a58b9a07b43fc3a9aacbb9a047fff71893b8c7aec87458d16bd05983839a5bec52ee70a37a13f98d
SSDEEP

768:lud75KN5iDVGK0e6qpLauIUXrgv8+C9JQ4:luR5KN53o63UXrgv8+C9Jf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1392	msedge.exe
1392	msedge.exe
2312	identity_helper.exe
2312	identity_helper.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 4812	1392	msedge.exe	81
PID 1392 wrote to memory of 4812	1392	msedge.exe	81
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1592	1392	msedge.exe	82
PID 1392 wrote to memory of 1160	1392	msedge.exe	83
PID 1392 wrote to memory of 1160	1392	msedge.exe	83
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84
PID 1392 wrote to memory of 4192	1392	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3ded84cd9d810a8d74411290c010f6df_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe811746f8,0x7ffe81174708,0x7ffe81174718
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,9830536728149712092,1533900228434474323,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,9830536728149712092,1533900228434474323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,9830536728149712092,1533900228434474323,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,9830536728149712092,1533900228434474323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,9830536728149712092,1533900228434474323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,9830536728149712092,1533900228434474323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,9830536728149712092,1533900228434474323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,9830536728149712092,1533900228434474323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,9830536728149712092,1533900228434474323,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,9830536728149712092,1533900228434474323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,9830536728149712092,1533900228434474323,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,9830536728149712092,1533900228434474323,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,9830536728149712092,1533900228434474323,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,9830536728149712092,1533900228434474323,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5152 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
32KB

MD5
f48baec69cc4dc0852d118259eff2d56

SHA1
e64c6e4423421da5b35700154810cb67160bc32b

SHA256
463d99ca5448f815a05b2d946ddae9eed3e21c335c0f4cfe7a16944e3512f76c

SHA512
06fdccb5d9536ab7c68355dbf49ac02ebccad5a4ea01cb62200fd67728a6d05c276403e588a5bdceacf5e671913fc65b63e8b92456ca5493dae5b5a70e4a8b37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
c673d517ef74ebc3324e1fea97c0ca0b

SHA1
27de89b0aa716909cd104bc6e4cae419028e24c8

SHA256
b1a86b82f30e52dad51f99a815453a06df442ba63e8950c7350fa4a23109a95b

SHA512
b0a650a630a3d92b2ac4d92cd98b40d87965d3d7f59defe437771e70ceed03438e71babb5ad6bf46c77061afdab114199d5a0cf2d47031d9651353e53a4651d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
602B

MD5
0f262c78ab64cb8f46ad533924699b30

SHA1
4e24c2bc331cb523e772629c9fd2d2cc134d8b90

SHA256
15dc6ae05db692916e255b8104adc7037f2b5be63a0f746ccf964bfce75ef376

SHA512
f486e7f5311b21c29dcbc3846d561448b18553aa3d453f606cd81bc3bd2c3eab2fb62ee5ee8eab278da69c5f62fca5cf1520a4ef54e23d4aee0e8591f98374cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
971acea0523251d19fba70b3268aa616

SHA1
845cbe3d208f0a64203d5a1df7878600c38e8403

SHA256
3e0d24ad1f29f6f738115fba86da5e23e16187697feefa927e935e3c6d851852

SHA512
1e310063d04a37dcac5cc909ef731c58d0a0ace09ee094329a19f31d3807b0292fbfcad4a75a897dde8b8bd77aa5ed3079ddc39ee35fe7f4c0115993ad41a24f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c04745e3a46dd49684c1e72ceef1072

SHA1
9d891b21a2e550a57917516a546ff0064309e790

SHA256
c1f5a63c7798f7ef87cf5d5a4fe7deb5d022d22de3c5e4d0fb8dc7a71bde4cd6

SHA512
f52becb3915bfeda350b8580f8291102ad66d48e18adf18c33422ae8d03da37ef93dee10f1c3efee0fb0b39b6ee85570d5343de14d7c1716be6efc488d2cf238

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
647175945de748478ed539bbe80a46ca

SHA1
769a545feca63ddc09db0c1d030672f6204204a8

SHA256
a1eb925d70f73db3201ae713e6444e2ee6fcdca0d89aa9705bfbd0e18844ca20

SHA512
62a1910cbaf9de474192e8e56099898f83fbcf2657c6fafd2bb8def2b44d37b68c7de7e93b62012518818f0c1a17ea6b13d85a0fe34db2616a6a5773eeec8475

Download Submit