cff04c6e9979c52888301edb24bb1bd7983a68a41f8ff6febd0c86fcc31c31ad

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

823feac4fc70357513d929d8fd6cbd95_JaffaCakes118.html
Size

60KB
MD5

823feac4fc70357513d929d8fd6cbd95
SHA1

5c5feb0c3822e7a5322ba86336acaa864cb471a1
SHA256

cff04c6e9979c52888301edb24bb1bd7983a68a41f8ff6febd0c86fcc31c31ad
SHA512

ae9488fb841dbb1416e5fc2f957af1f44fb9e14a3e06a80e86114b5c32e79487e9d639b3ec1e32319bed4a382648dc8c8241189be2962a7654528d32b2a18284
SSDEEP

1536:j0U3FF/7AdFUSWhY4IqeEfuqY92cew00TGWMP8DUVrjIZiAG2+WPwqRQb7hjeTwe:mtMP8DcraiAG2vRCQSI90VeT5I9SyKFp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
5012	msedge.exe
5012	msedge.exe
2488	identity_helper.exe
2488	identity_helper.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 1240	5012	msedge.exe	83
PID 5012 wrote to memory of 1240	5012	msedge.exe	83
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 3688	5012	msedge.exe	85
PID 5012 wrote to memory of 1836	5012	msedge.exe	86
PID 5012 wrote to memory of 1836	5012	msedge.exe	86
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87
PID 5012 wrote to memory of 372	5012	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\823feac4fc70357513d929d8fd6cbd95_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe4d6046f8,0x7ffe4d604708,0x7ffe4d604718
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,3652024096340957508,15334569139890221464,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,3652024096340957508,15334569139890221464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,3652024096340957508,15334569139890221464,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3652024096340957508,15334569139890221464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3652024096340957508,15334569139890221464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3652024096340957508,15334569139890221464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3652024096340957508,15334569139890221464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,3652024096340957508,15334569139890221464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,3652024096340957508,15334569139890221464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3652024096340957508,15334569139890221464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3652024096340957508,15334569139890221464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3652024096340957508,15334569139890221464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,3652024096340957508,15334569139890221464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,3652024096340957508,15334569139890221464,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
624B

MD5
05aab5a504f589694fb436f4f15c2f71

SHA1
5c95e56d74c5f83c78fc0914c65e71aaab600aa0

SHA256
dc22905250fb488f53c1f6b78c3e994895d6330f5fc97d6df62ad9235c58ae9f

SHA512
6916975d0205201732901d980adb99ff6ce14a93bcd69e72c2ef538fda3f6bb6fe2bc198118b9176b74158988654067e3b437562a8544d97aaf1d76fda46268f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1e9ccba06096640104a3b36b3bea3dc8

SHA1
db1bf50a7c4a8340254aa91f41bb5e69d24649a8

SHA256
d013ad348696bd398224c05caeae5e46cba571c49272d37a20125188dfa1ec73

SHA512
5da740f625a1f90164dc1948479116117eb9f95a34589558be5b7d9d35b0fcd66994e356814307278e2ab91647a005468e07abe631dbce4c10958ce28d97227f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
074d05b4dd441aa23e0710df6e1abb5e

SHA1
ea23dc3f8c6e837101aaedaee19fbad624d7953e

SHA256
3d4dfd1543c3075a817bcfe4376e12eb3d7eb87d510ea37b88820fd296658b4e

SHA512
957bf07e5ed08bc6fc8f68627a916066a35020e1922e0d9375076d1e12f791a144e0ad716a4d7a939ab5a8f4646d4e48b748713c1da07b3a0f326175214080ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
283a6bf1fa695b4c28a1ac8357909bf2

SHA1
ed75c4a108506edaf3eabf50027ed4442f3f16f8

SHA256
b19e06be131c40394c109a485f9075f2a0e804e4cb9cf1cdbd6b677a8f978725

SHA512
989a30943f4857716d533092abbe7bbb4c13f2c8ee92b334dd9e91bebfd40fd265729f91a8802ead99584ec6f057dc7971e4c8f667f53065f7e0dd8b394cd2de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
63d465c37a6021f5f3d17cea8be2174c

SHA1
c89e820ed4bd3c5c6684ffcabe5ff5a8b9aac4a0

SHA256
82781e380ac55b632b01dea2cc8887aa40ade59c550e4a13e12b4ba9997f8189

SHA512
1b3348755d0e7f3d824d0be473c306a8ac3bbc830fd874269fe5a0494ced3a17377567ef5e63eb0a9a6be1bad7338f9e0d7dc5bf06154be28b05093937eeacd0

Download Submit