7effe2ac62b3cabdd99331810b054c858aa3ec92c4312d64c470971919b6a529

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 21:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68b7d5bd2fcfa5ee3c3ae43147aa40b6_JaffaCakes118.html
Size

32KB
MD5

68b7d5bd2fcfa5ee3c3ae43147aa40b6
SHA1

c542164d4ea44cae9aff33f15af9659506ac7529
SHA256

7effe2ac62b3cabdd99331810b054c858aa3ec92c4312d64c470971919b6a529
SHA512

aa26377be9803aac562da68bc788f9828db4b4a86272e527643448ca7b7a3640a1345e745a845deccb8e05b1b5295caa25f0d6bab2233d8411164017c4e6312d
SSDEEP

768:MCMZ0mA3TU+02bCNCfCfCfCfCECECmCmCulLuQb:MCMZ0mAI+0eMee66NNllX9uQb

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4572	msedge.exe
4572	msedge.exe
3424	identity_helper.exe
3424	identity_helper.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 1804	4572	msedge.exe	82
PID 4572 wrote to memory of 1804	4572	msedge.exe	82
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 2452	4572	msedge.exe	83
PID 4572 wrote to memory of 4012	4572	msedge.exe	84
PID 4572 wrote to memory of 4012	4572	msedge.exe	84
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85
PID 4572 wrote to memory of 1428	4572	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68b7d5bd2fcfa5ee3c3ae43147aa40b6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fd0746f8,0x7ff8fd074708,0x7ff8fd074718
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,17965106840263604281,16506458605709157593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,17965106840263604281,16506458605709157593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,17965106840263604281,16506458605709157593,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17965106840263604281,16506458605709157593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17965106840263604281,16506458605709157593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17965106840263604281,16506458605709157593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17965106840263604281,16506458605709157593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,17965106840263604281,16506458605709157593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,17965106840263604281,16506458605709157593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17965106840263604281,16506458605709157593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17965106840263604281,16506458605709157593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17965106840263604281,16506458605709157593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17965106840263604281,16506458605709157593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,17965106840263604281,16506458605709157593,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
fb24a7c81b0a9ab5a465878f194e1ee1

SHA1
d830a3747a3d50f81b3711262b5dd1ad5aa5c8b0

SHA256
6f0077ea051bd86008bb0e3952055ac8594670f695c04c2d769483d8a0c2355d

SHA512
bfbb4e37f3e950a963a1d8c39b4ecd8bf38423aa5ff5ceb75d31950820a56447c6ad18ed2e910a27ab71e9898a9646a98f25e0905a4910ed91b7c0cc6d72f64b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
638B

MD5
ede550c373dd64ef10897ff22b16ef3f

SHA1
fa7127465eeabaaaccaf2fc564130aa8210992fc

SHA256
e6cfd09a52d03c750866b34802a7cfcc9937a3af299d2ef3d155295d4372624b

SHA512
ba0a9a6d757c18833278998d3e8d6f107d741337270d166c8cc60e5ddf6d8fdc0f89667ec9fe4f8cf5e4af878b425947703fea5f585f5500364e94e1f7951977

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4eadc0295f4b61003eadedeb14cb0d31

SHA1
059feba90e33a5d9bfb8a1b1e77020ae2573cee3

SHA256
e37662f13af4073475dafd9b895048bfb8b40ae2764e1e144880f658366805af

SHA512
c3799beb98ae47e48c59fa1d1c44279585f409bb8ae505676194c969a9150a52b7647bab31fce34fa86ce1df8ff9a55a91f46e5f59b9a2aa8c13805ffc515883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bcd70c2edbca8f622a42b57eed394c9d

SHA1
298b0723f6508a3f34a196a4459b58e7d29347ec

SHA256
d2549ef49a876943c0d9827eb127f5475fb7147352bea2e71621a5d15706e10c

SHA512
3d5ef12519ea889f51992a0e307e6cbd308e4bd0480b74a0f8648148518dd9cef8739d40facff7af7701d48cf62a8589785803cb10dbf544288a1f72f54a5913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1c33646ece36a37c3198d048b679b8b0

SHA1
81b350fffa6ee4eb40a0ea19703cc0d87af199dd

SHA256
4ebfe5f52d2c6d1c138a2051b12309ee0fee8e8f863e8bcb3ac0c9890e68a859

SHA512
a3355d15e1712d313eac764a33b658cd8ce4069496aa578ffab1d7666a34817b87d43bf19b716bc4867b113e6858e79ec7c245541b491dae013149dc34939984

Download Submit