042ce1ebd6d05c56f3422ef01b782f2925fc96e343ac25ed3fc5eaded6da6419

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5d186c5d7642263aae1257de4589bfd3_JaffaCakes118.html
Size

26KB
MD5

5d186c5d7642263aae1257de4589bfd3
SHA1

443535dcd0779c32624292732f9e413afc17e9fa
SHA256

042ce1ebd6d05c56f3422ef01b782f2925fc96e343ac25ed3fc5eaded6da6419
SHA512

4f64c7063aa63d9bf4bdf3230bed08ed6a053b9a28a78a394e9c13f9b6b9cb9d935a1a7fb9fb6109cdb82ea0906fe9399062da1fcc377e8ab5135dfcd93e76d0
SSDEEP

768:SFQvwtSjySxLpvOwOs+IO8uQfJv1HhX1Vbsmx:SFQvwPe

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
4980	msedge.exe
4980	msedge.exe
1612	identity_helper.exe
1612	identity_helper.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 712	4980	msedge.exe	82
PID 4980 wrote to memory of 712	4980	msedge.exe	82
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 408	4980	msedge.exe	83
PID 4980 wrote to memory of 3156	4980	msedge.exe	84
PID 4980 wrote to memory of 3156	4980	msedge.exe	84
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85
PID 4980 wrote to memory of 4316	4980	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5d186c5d7642263aae1257de4589bfd3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ad3946f8,0x7ff8ad394708,0x7ff8ad394718
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15828583833149861640,12569700132632382263,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,15828583833149861640,12569700132632382263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2592 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,15828583833149861640,12569700132632382263,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15828583833149861640,12569700132632382263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15828583833149861640,12569700132632382263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15828583833149861640,12569700132632382263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15828583833149861640,12569700132632382263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15828583833149861640,12569700132632382263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15828583833149861640,12569700132632382263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15828583833149861640,12569700132632382263,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2224 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15828583833149861640,12569700132632382263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15828583833149861640,12569700132632382263,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15828583833149861640,12569700132632382263,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
176e152364feaf5234c6d167b85701aa

SHA1
aad3f647ef90975be7425d6547980588653e2e0e

SHA256
6e300967a918672edf873556ec2662852e301b2ab6257f7f2b3dd402af8565e6

SHA512
2d4cf973ac8ee49b08ded57b58f18d6a2a27478360f4267bd4715cd0607b9c77c204fc784ec48c24db9ee4e3fdd9bb4bff954601b7573e62a4b84e90f06ba545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
718B

MD5
81c44388418111363b01419264852ead

SHA1
d63b8434eb59091151d5e5aa8577e67584a4cf0d

SHA256
a56d92a79ebf96a61c8780edbbe46e8072877f1b6103c64669053fadfd84f730

SHA512
fb68c751d9e6283890215ff496c4b6b83448980e5bcb7ad0785b0cb2ba02f38cfa5cbdc132bd3c60699d1543acfd7c885421b2fd221640f56289ff543d5ac8d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9204b32b2d316b0f2fc564a69d034ba5

SHA1
38cfd55cfee85c9590f15c34d908b627c813f500

SHA256
be1ce358fc66b847537e06b99d1f2f5a83d014c4fa2954a724ea82d2d42193ee

SHA512
5171757de7571a23d153ecb087588c9dbd7f20c77e53f4d73004b89254e3c49faab4ef24fd52d5ebd63422c349bafdc73723dad14677f7c102de9d544b6e9713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25a5437bce0f88b4ee8452c6452fc0d1

SHA1
b92c625081fc2f944704fa99b5def184fc9c0a9b

SHA256
9ceba23a2fda006a3a4bef9c29dbbb12ed01221e40383a5f4c039fff32cd5e07

SHA512
275c0a00eb7823e13dded11915fcf2008708be7552e3f72799b65bcf0f5dc79a8d526dd9feaafac29eeb088eb93ce1e720c256f7228b3644f0c344467e68b83d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c8561ec7-526b-434f-a7c8-a47b71e24e00.tmp

Filesize
6KB

MD5
43e9c5449d3b2c9c9ca2151ac4d85928

SHA1
f95e1977a2b6b7acc68d34d8a339c8ff19481ed8

SHA256
10e21fa98dcae6751dcd64f8d332768bf2329fea0562f7ac11e3294830e82a31

SHA512
0534cea73c9dca9d18ccea51f2e100365435bad058f491f25559eee0ca70d933c5dc701663d6e447ca508e9aee32c9af5d0c9503505637f4825e399fdb4afc61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e4175c084bf464e8f20636f3c06dc9d6

SHA1
c45e7a37bc7affd739a0190a046aa1cfe91a4f48

SHA256
312eb2e95274c2c969bc339d0de61ff726a68b3aaecf380b9dd66641a5322bc3

SHA512
e311b93dd67b2ac9c9cb0d7206c2e7aae6496665639f64f08158d08997cdd9ea070e2164d8b55d73681b8a569e1e3f6fcb5ca99f4af99356e31b579f33dc96fc

Download Submit