a4e4f46de2860c6b1f6027eae89a2d2a6132f5c82571e33dd1bd5419157c0993

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

118e56cb23739f1ef6bebcd5f45401ea_JaffaCakes118.html
Size

724B
MD5

118e56cb23739f1ef6bebcd5f45401ea
SHA1

711e58bf8e375bfe960a5c3ab476d7d5bf095feb
SHA256

a4e4f46de2860c6b1f6027eae89a2d2a6132f5c82571e33dd1bd5419157c0993
SHA512

b29d2ead083ef98d593d6f776c6870de1286fe83c3a59b64beea158059f2fe584e074d5f98fa488a0324535b3853bb54200a87f0fbaf75dd6e59853b1a9d75f6

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
4888	msedge.exe
4888	msedge.exe
3996	identity_helper.exe
3996	identity_helper.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 432	4888	msedge.exe	82
PID 4888 wrote to memory of 432	4888	msedge.exe	82
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 4856	4888	msedge.exe	83
PID 4888 wrote to memory of 3968	4888	msedge.exe	84
PID 4888 wrote to memory of 3968	4888	msedge.exe	84
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85
PID 4888 wrote to memory of 5068	4888	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\118e56cb23739f1ef6bebcd5f45401ea_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc0da46f8,0x7ffcc0da4708,0x7ffcc0da4718
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,8444281539988710205,617431560858346552,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,8444281539988710205,617431560858346552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,8444281539988710205,617431560858346552,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8444281539988710205,617431560858346552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8444281539988710205,617431560858346552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8444281539988710205,617431560858346552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8444281539988710205,617431560858346552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,8444281539988710205,617431560858346552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,8444281539988710205,617431560858346552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8444281539988710205,617431560858346552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8444281539988710205,617431560858346552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8444281539988710205,617431560858346552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,8444281539988710205,617431560858346552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,8444281539988710205,617431560858346552,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1296 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\330b3c0a-3b09-495e-9101-871ede579c63.tmp

Filesize
10KB

MD5
4c65499d0b3ab4050f4fdac47ca67f12

SHA1
de7401921ac3bffa45c03e2ce2a6a04d0a02a299

SHA256
93c476fecd52595e2fb76d5dfd11058821728085b62a4ba7d75631ccfd07dfdc

SHA512
1a31df2c7b57a42fb367fa3150ca2f807acb89c505c7c25543df204de0d33c338bcad656c61a88aaf54511a4dace1b006f14c59917154caa6320cb52ac835bbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
bc0d046e7dee0ecd1a44af40abd56ed5

SHA1
c86badb340530b88b85b8e66bc135d6e5ec41151

SHA256
afffb39e69d0e0984998eeee3197dbfdea89e22c2f624c685a4bc9d9cea90395

SHA512
9fc957b8753130bb58b87eb4df10a3439a496d4e1aa63c91e27079f6c66f9c27ebe70d986d430e56ad9b47659de49d3d4298f257629993c74d69bdfc8d7be6f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
986B

MD5
06af2d530b0a93909872ba7d7b21d296

SHA1
892a6d122e590d7bc56949fbc52f0a6680eb3e4e

SHA256
a4430ea24f8d7996ad0cafc833377bec6b0564a71eab29c76b53cbde6846aed8

SHA512
bf2096b82187b80df589954db9396b3ca19af97c989982f6a65488ee844d6404b433a710d49ffcf37dd062fd321cc03174d480c68a35be6dcdb2447915b5bd23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4c79319e3d811493bfc19cc7f82ce7c9

SHA1
d448d004a7b9b080640cb225bc422f9fbc18f68b

SHA256
7cc69d5a4276dd7f7806b8aba34d182127f506893f4158ce14b747a9ec174ba4

SHA512
481b22e00800335d2939ffc1cc28e88824d9d0a7c418020bec10b8615ab5f4dfd084d6d6d039edb261e17a3bef714481f7c66a0cd894cfd41c154ac25314dd0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0095d0bb26de91db4c96a9d01da8e5d3

SHA1
5a1094c563702a45a28f1a94feedaad6a2d9cfb4

SHA256
cee545a8572cd89434b672cdb30a1834a25fe06fdde58c563482f3360da48c21

SHA512
deebdad25817a5bb4d0105e58347a2fc9451e213a5727aa82af22d95f3ba7908d619bd0b214f0af007c332c4b1249f1f4d94c290210c5c56cc82ea97bb540c42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit