c3d3614f513ffec75e093a8ebeab919d3ab736c7e55851e6456423e771e34901

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4534b14714281d09e04787e1e6e31258_JaffaCakes118.html
Size

49KB
MD5

4534b14714281d09e04787e1e6e31258
SHA1

b99c2335465962053a78c79afc27e11b1a3cdfb5
SHA256

c3d3614f513ffec75e093a8ebeab919d3ab736c7e55851e6456423e771e34901
SHA512

27fd5cd387c67d4b6fdc4b061b73fea60c3b465410a924a480fa36291e64ae41a1fe5488e482fbc2b0896f49e9b832142750f6c54e7106b66ff852734a1dd0c3
SSDEEP

1536:dBQcpD3u1gU5DWNWSQJhDvkghBaci+8XPJ5RKJxJIfmfp:jQcpD3uD5DWNWSQ6XlKJxhx

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
3120	msedge.exe
3120	msedge.exe
1396	identity_helper.exe
1396	identity_helper.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 976	3120	msedge.exe	82
PID 3120 wrote to memory of 976	3120	msedge.exe	82
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 2740	3120	msedge.exe	83
PID 3120 wrote to memory of 4880	3120	msedge.exe	84
PID 3120 wrote to memory of 4880	3120	msedge.exe	84
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85
PID 3120 wrote to memory of 4484	3120	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4534b14714281d09e04787e1e6e31258_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7c1346f8,0x7ffa7c134708,0x7ffa7c134718
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5151560872526698104,9904167166816163645,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5151560872526698104,9904167166816163645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,5151560872526698104,9904167166816163645,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5151560872526698104,9904167166816163645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5151560872526698104,9904167166816163645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5151560872526698104,9904167166816163645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5151560872526698104,9904167166816163645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5151560872526698104,9904167166816163645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5151560872526698104,9904167166816163645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5151560872526698104,9904167166816163645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5151560872526698104,9904167166816163645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5151560872526698104,9904167166816163645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5151560872526698104,9904167166816163645,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
900354b276af9a6170d62b5bd9c7338c

SHA1
882e857c7771e01f5243c42ad4dcc4e031bf31e0

SHA256
0caa1d6ede98b5c711e7fe1268d9c6607c79316315601edcf5d05e13eeba4ed6

SHA512
5b71132aa225c26719d796dc53be3c23f7cc8fa3a7023c02ecea4cfc3046257cb3b03c956243e7da97d47d65a15582c4fd399f3e10963e062060358f3a52b0d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cf0849cd4717d5178e0312f5901acf18

SHA1
e617bb2d992fcb90e0e3d10bb48f9d9081710176

SHA256
2f3f046d09805177a706fb98323abacbc337d7e314ba78522cedb737afcfdcb5

SHA512
01906ae2960fc152ea71af3dc8db0db31045127eb42e12e7d71bbcfb1dfa645bba672daf45646faf2905aec2e6a79d8ec34f07161a2a09d2123e7723aa0f69f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4e91b98678ff3e1cc7f59144877ae0ad

SHA1
355006f27c8b0ef7b1a3f8baae8d9c09f32cbdf4

SHA256
dac8eac16d8ec7bef52cf1646e9e196a17bb88bfe2d5e6930ef78ba82de255de

SHA512
c5a290ba55f280e82ea5c310e5eb6f5a73206f2e2280c39cde31dcdc8ac02900c3d8aa3038407497fa7c756107a09ebdc51a8248f3dc0e50dbdc4c1d080ed44b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
88d5fcf01f52e99f65facadaf3ee70ba

SHA1
c4b8ea6e9938da0cd14885140d9d15cc3d2caa0a

SHA256
34ef4e3d340f6491281f953d82076094c268d70d83e3fd480c03dad2f2a33958

SHA512
bb38a493f7bb935b660872a890fccd10433aced457c27ae9ddce116461423a4fc36cf4743c3390ec94b2d919803223fcc386f42df1fe2535292efa9b5bf5aea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
46f20e2116e125f912c65b050a17ec09

SHA1
47551ef5d505e244b19ebaf801be937da3596ee0

SHA256
3dbb2d35c08c3f9efdd9aafb1ed3d4054b388fe6c409756d168f6ec91d2158b4

SHA512
143bb08566f7b158f0a48d1f20990029d6f4b7a9f38413f74e135e0d56331cae5657c7bbe662c1783a01b4f2d9e830fa10aa765152771a4ecd56801906e3cbe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
83c3c3b88b75451375eda2cdc56a5fb3

SHA1
c31dc27a17de27d4a1a485443f6e1acf62449834

SHA256
541ec102b847e840bae01aba3f65d00378f100e16ce3b21b83b2001a0e78ade4

SHA512
b0fe61fab8fdf32af508499e03a012e37c4804d8b20696fd642a42456e1fafd09e5b6b2e593a71f880926a4a74ecb6e8c6feb807125523802d0e4f1279827aea

Download Submit