f2c4fef247384fad606b26883c851fac23c81767712e0445e44675abb39429c0

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42b8525be8d909c0293ca6f0ea14bfcf_JaffaCakes118.html
Size

43KB
MD5

42b8525be8d909c0293ca6f0ea14bfcf
SHA1

b36f251b46e2461360fc2c31a79f9c899fc159ab
SHA256

f2c4fef247384fad606b26883c851fac23c81767712e0445e44675abb39429c0
SHA512

529539bf3493dfeb4c7eb1dfef4a394ac0376f417372835e45c2246a83f317afe21d8285bd7bd03fa876b993730e34faafd08273a79d305ba2dc3baa67282ed5
SSDEEP

768:PF9T0EipBRVCJtPnWvAriIQx1VGTA46dm5kW2OH4CcP:TTupBRVCnnGGiIQx17E5kn

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
2856	msedge.exe
2856	msedge.exe
2408	identity_helper.exe
2408	identity_helper.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe
2068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 4996	2856	msedge.exe	81
PID 2856 wrote to memory of 4996	2856	msedge.exe	81
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1880	2856	msedge.exe	82
PID 2856 wrote to memory of 1748	2856	msedge.exe	83
PID 2856 wrote to memory of 1748	2856	msedge.exe	83
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84
PID 2856 wrote to memory of 2128	2856	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\42b8525be8d909c0293ca6f0ea14bfcf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0a6a46f8,0x7fff0a6a4708,0x7fff0a6a4718
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4403769874220385767,4279261186383202321,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,4403769874220385767,4279261186383202321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,4403769874220385767,4279261186383202321,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4403769874220385767,4279261186383202321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4403769874220385767,4279261186383202321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4403769874220385767,4279261186383202321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4403769874220385767,4279261186383202321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,4403769874220385767,4279261186383202321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,4403769874220385767,4279261186383202321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4403769874220385767,4279261186383202321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4403769874220385767,4279261186383202321,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4403769874220385767,4279261186383202321,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4403769874220385767,4279261186383202321,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4403769874220385767,4279261186383202321,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
7900c24c7646dc104c02edeeec62c1cc

SHA1
f1658c24af951214cddca59f05893cf9305140e2

SHA256
233cbcd2d4a1cb56a73ce8f2a65b05dd6af64c170733d3f7def2280664922d59

SHA512
3788f12c770e38ecc86466b57d3e96ac06e85f9bfc59e0642ad756d4761ef5796d9745f47adbe1f9a7aa83e220f2fa9df535079bb13bab5585b6e55bb95ef132

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b4bf4521f34e05484cd5d25da9cc668a

SHA1
d73c9bcb170e7de8d3c72f0b31ecc482a6bbde50

SHA256
01b97014807316db22a837eb414dc4204a50e467102871b2f705edf8a1fd27bb

SHA512
89d912336ad137be6e440c09d0c688266d762fb5fcec3d96c731933581ab3cd394618cffade76e79dbc347379238a3913ef35b2698acc1a4b7086fed49d71f66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
efdde8095ca1beb2cecc9f7e4c1d260f

SHA1
635a3635c8895ddff4e92f0c92eeeb132f71a8af

SHA256
6cb826bdf687346c15a9e0c1927929479793c59e3e4284a9cb48aaa51faebd4b

SHA512
09d17ecff0d71dcaa9037a350e4fc40398b92b53df9d13c1b4825cb6051f229157c8f6a371d35abc03a81fe3222ae48c6f8ae7b1c878759ff8521a6747bf63aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dcc85888c1975dbedc874f5662369abf

SHA1
bf9d0c089c3434babdfed01a12886c9847cab0a8

SHA256
aeb820ea2d3325a7ca08f610e374356a41b20a9fe81cea9757993ea370b92063

SHA512
249a76e9eac38e1ef447f0e976b589f893e1061d3791ef731b6b51ffc5984588c5552d01a99a90bb69f44093df7cb4eca91982fa3f550f2ca7da40e587eaf05e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f9d753c8a0fd62c493bec633bf98854f

SHA1
d8fd7a6756d1c27ead9107d4c477928d65b3d8f1

SHA256
d9a266bc78182a58d84aded1e2dfb743f130e25a2da0cfbe08f31d453f597821

SHA512
fc84e15d77e361fb935e27c62dd2c60b85c6696d0b4d95435c141b8425e7a813da7f36eb8d62e0b066bb8d308e236e373bd7cd7fcc1568491ea16d45b8c982c0

Download Submit