ea82a98a0f5a55a83a41910428aed9a59c777d63dfe59795b4742e5b9e07dc20

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fcfebfa390b430b699490fe4dfbfe61_JaffaCakes118.html
Size

86KB
MD5

0fcfebfa390b430b699490fe4dfbfe61
SHA1

392c28a02ac869481a4471123135f7df7da416c6
SHA256

ea82a98a0f5a55a83a41910428aed9a59c777d63dfe59795b4742e5b9e07dc20
SHA512

ba3129a3fe6975e66a3d1426de66c8de460eca41bffe680aafb0f498a2bf8e03d5d98a78af74e9cb572df3dad6407d8b44ec2e6a92e217aebed3ca0dfe014fe0
SSDEEP

1536:lAaqHv7oeFU5IdTJMp+CAzXy//VWC1pS4R7B24:eaqHTH+yNzy/NR1pS4R7B24

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
4416	msedge.exe
4416	msedge.exe
3936	identity_helper.exe
3936	identity_helper.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 1952	4416	msedge.exe	84
PID 4416 wrote to memory of 1952	4416	msedge.exe	84
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 468	4416	msedge.exe	85
PID 4416 wrote to memory of 1724	4416	msedge.exe	86
PID 4416 wrote to memory of 1724	4416	msedge.exe	86
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87
PID 4416 wrote to memory of 4532	4416	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0fcfebfa390b430b699490fe4dfbfe61_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca25746f8,0x7ffca2574708,0x7ffca2574718
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6789613307745300950,2685747632510200945,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6789613307745300950,2685747632510200945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6789613307745300950,2685747632510200945,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6789613307745300950,2685747632510200945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6789613307745300950,2685747632510200945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6789613307745300950,2685747632510200945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6789613307745300950,2685747632510200945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6789613307745300950,2685747632510200945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6789613307745300950,2685747632510200945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6789613307745300950,2685747632510200945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6789613307745300950,2685747632510200945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6789613307745300950,2685747632510200945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6789613307745300950,2685747632510200945,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5348 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
82702fbef48d57143a9001650d24c983

SHA1
818a39a4fdc1fe14bae0a862c032f1c38edde6a9

SHA256
95b08cc2ba35417f7d3999e944904a386f18c54c1179d0eb9b92aca14833fe64

SHA512
7c74c9157eff6de70befae1a5a9d3ff8dccf9b017707b35ad711a348c69433aa631b240b7bcf3d2722758f5554604183081b1bbb8ba5b7289d32e831065ef220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
5ec6f1f5a15aece8b958da4be1dcdbed

SHA1
89d73fdcb17660b24b9780ff40417853b346e6de

SHA256
4a5c7a08e5a5582c673181ba67ed1da76ccbeb69b74ed4bd7aee64cc58535837

SHA512
6ec637f5b1962f077141bdf11ce07608a10efe55465c5b723cece18013bffca669f7e1cb290f16f759208420e0b09ade3c9585008491f3ced1e475e73e5128d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c43174a339741b6506cb73801c4f7722

SHA1
464c019e51964f9a0c2b3a3e5cdfedced22039eb

SHA256
a8d95d15d8c8ba6c78de4ed61fb842952c2098cc814a57df430353cd461faaf5

SHA512
9a7b30487c0302d2257bb24fb1fbce1356b53c8d17085eafec4a913a8c434583f3f1923f09bdff68928fc25661860bc8726f47ff1eb40e1ef98beaf9091ceb6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b6e40ebbcf03c952c26d80830b6d751a

SHA1
18ec995686b11f0933211d3af6a8495c6156d9a7

SHA256
6273d3dfacd4df8ba80a5153f5b7f812eb3d102fe064c3ec7cec6a66fad1b09a

SHA512
6fe234c98973260f4b8018e82a5ea28d27b28d229626bd94151f74d065094721057cdf53e3a6b65f5c2c4a76c9c5d9078139adebde6908731c140017788c5d8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6e9fe3d307125acc74b3b2307eb7d000

SHA1
9bbe35a889763a39409ef82d418d2117461a37e9

SHA256
4f10c731bca51e78aa733e0d8da52fb641028729f2d3d570e3d848c65aba22a1

SHA512
b5d9bf8effb5f0bbc7e9a3e8b9bce13cf8129d118b3e9b6cbd4c3582505e5a273ebba8e0b3787622f90fb2be5ee49cd2dcf00f450583da06e6de131bc3fc4c09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4492144f60fea0aaeed7b16a43bfad59

SHA1
96d95ad0b78f8e9b41260e67177b7acdc53978a8

SHA256
c2d69987791ad28783e4b53b1bac40ce08113362daf3064133d57032a2b646df

SHA512
7c2b44151bec79b1ffa0004ec5ebac58d60c4860d227719fbd7993aa2b2f38bb9cc1fc8cc896ad9ded4e3b5ab2af544b4a7fc86131b20bcea531ffbda7044655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1f24d60c58e73dad772924b922ea17d2

SHA1
f537fed5a59fb35cc1dc1e8c627ab0c0683745fd

SHA256
788493afdc4968968bf1007b70f822e2b5f7d3719e2e790a81771d747c6c6ebe

SHA512
2718b0f54cfa5f94dd443d1e20bf464e3ad0b80c55046700791cee99ceeddfc22df1ebde48b6c61427ccefd8030dc0fa54f0ff9377fe3da1e4baabee82830b35

Download Submit