55382b883ce16ba470f0628470e41478783bbb63329678eebdedc427ea1f4b31

Analysis

max time kernel
139s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

460d1db980302190325be4da6a8db773_JaffaCakes118.html
Size

82KB
MD5

460d1db980302190325be4da6a8db773
SHA1

e1fe195c1340942bc45f6148e882783bce6dc8e0
SHA256

55382b883ce16ba470f0628470e41478783bbb63329678eebdedc427ea1f4b31
SHA512

78123fce8267db0a4312e3b0570bf45d7d911c5990571bb0dbf22a3013c7fc59cc993d175b0cb98416253948b49287223ac79bf32a552dcb18bd56dc836627eb
SSDEEP

1536:opPMlbN6FJbTM7NbdxU5lSWE5/ezOlSYqKyM4WvsUWZkojNqZnR0pD:opPMlbN+bTM7Nbr+E5/ezOlSs0UC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5968	msedge.exe
5968	msedge.exe
4808	msedge.exe
4808	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
5528	identity_helper.exe
5528	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 4472	4808	msedge.exe	82
PID 4808 wrote to memory of 4472	4808	msedge.exe	82
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 4632	4808	msedge.exe	83
PID 4808 wrote to memory of 5968	4808	msedge.exe	84
PID 4808 wrote to memory of 5968	4808	msedge.exe	84
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85
PID 4808 wrote to memory of 1972	4808	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\460d1db980302190325be4da6a8db773_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa682d46f8,0x7ffa682d4708,0x7ffa682d4718
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,12874421849186821351,4391921753351999099,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,12874421849186821351,4391921753351999099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,12874421849186821351,4391921753351999099,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12874421849186821351,4391921753351999099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12874421849186821351,4391921753351999099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12874421849186821351,4391921753351999099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2300 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12874421849186821351,4391921753351999099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,12874421849186821351,4391921753351999099,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,12874421849186821351,4391921753351999099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,12874421849186821351,4391921753351999099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12874421849186821351,4391921753351999099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12874421849186821351,4391921753351999099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12874421849186821351,4391921753351999099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,12874421849186821351,4391921753351999099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:1852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
fdf5cd6182e02fbcc3c7ebffab26e9d4

SHA1
45b0d9a70e4be8f7618d248012ca2aec855f5910

SHA256
788df7f709aeb58a341b0225567860fb2eee4f26c30b2c00a9cf825491d915a7

SHA512
61787fac296efa4d156e8fbb6263a9935e4e4088aed8cea944b9b8f3272e69d7e2eabd6e8f44727a40d7445684f503d8fe81e08ca22216a1497edc5363c15657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
544B

MD5
8e3790709eea35b51e12b64bccdedfb2

SHA1
ad9e6db625fcb536279d9cdf008b445878277fd6

SHA256
e33f8ceb0e83eb422f0a5bead2475d39dd938b3874aca5f2be87a5328406e19c

SHA512
af0d2b5fa577e9d73c49420a4e1bcd61b74a7d0a9fe7bda7b5f30a10b815afbb50df25d3df990aa93a27923d5a0bab53d32ce39fec0a0831cc3459999dd0244b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
65785516a2fee344058bbcbb942dfd5a

SHA1
e0f8e67f7dbd223339512f0f427dc9f82fcc7a0b

SHA256
7d21699da584dbdeb68148392c5c7ae4459bac900c29b18e6ef95d596a5ed9a5

SHA512
79a2a49885f4fe6336ce8de8ba4e93b905d1ea6437c6b04c356982132f0ea86959a44b2c3db8c7913e34a4db60d0e6bee2a836fe552a16e467d74d0b34c3a536

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19b39d60adfc43f9c8751322b8bb5120

SHA1
4b94d88205cd1f13da7ade1ee8af6ef4d8609e0a

SHA256
8989dda46a2c367ed1804eeab2bc05c567c6e5daac2105195c20921fd3b0d082

SHA512
0bb3b2737c56892ee93cd144dfcb67141815ebc63b38396259f573d2ccb45b85b31d6400c693ee43ace7f68306ec15a268a4341da5cab35c4b6ae89435eb7a21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a208bf117355b6d08301c8685c41b90

SHA1
6fd0fce78f0e54911a20296688b2f999f3f672a5

SHA256
4744eab697f9f3c3d38f6c6b8be08c69eaa2407c519e3ccf386c8a9960a1680e

SHA512
3ed94a3b851717bb54b51bb9b3e210726e5fa92869271f6aca67ba22bb07b21998fe344a12a5cce8a6d10714889cbeb7c1c82c85a4dfd4529f004471ffaec3a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
86e6eb0443ed0e2b1c3686e3ac53460a

SHA1
660df3f66565aeca0c272cd939caa5acd3952cd6

SHA256
e5153810c4cd2170bc1b5fd3193b175cfc1345fd4f78a020916a35a7e3e78c16

SHA512
2dc6c767603b414cb99d8fac5be1b7a9d7399621c049f3f78efef950ea99f4d06ad11c11204df80dabb84d13225729ed170c17b382aed676b558519e5acaff7e

Download Submit