b38081ab83a9156cc3489eca5d04009d45d65f042b93b8b8f39572865f528c98

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75a57553ef80fc2ec2581d2fb3bca847_JaffaCakes118.html
Size

128KB
MD5

75a57553ef80fc2ec2581d2fb3bca847
SHA1

9a13fe90ca3da2c30d6f33b2724b9e6f670b58e5
SHA256

b38081ab83a9156cc3489eca5d04009d45d65f042b93b8b8f39572865f528c98
SHA512

6571bf6d48c8de54d8c832bd60f2f4edc2944434c11928ef967c4e00f1bcf7e60bfd46d271cc46e7404f6c9ba2896c89279979f4e5c1ca524ed82412e8a88b5b
SSDEEP

1536:az2Kh0MWocBSYcqyBbOU/lJ+QHmyEjUIxpvWg1danHsjIRM+m/clkCrTxNxnJJSG:a1bAswaXp871uKTI3

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
1476	msedge.exe
1476	msedge.exe
3000	identity_helper.exe
3000	identity_helper.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe
324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 2424	1476	msedge.exe	82
PID 1476 wrote to memory of 2424	1476	msedge.exe	82
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 1564	1476	msedge.exe	83
PID 1476 wrote to memory of 3304	1476	msedge.exe	84
PID 1476 wrote to memory of 3304	1476	msedge.exe	84
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85
PID 1476 wrote to memory of 4056	1476	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\75a57553ef80fc2ec2581d2fb3bca847_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea93746f8,0x7ffea9374708,0x7ffea9374718
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,1770574570655625616,17526015786959810672,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,1770574570655625616,17526015786959810672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,1770574570655625616,17526015786959810672,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1770574570655625616,17526015786959810672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1770574570655625616,17526015786959810672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1770574570655625616,17526015786959810672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1770574570655625616,17526015786959810672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,1770574570655625616,17526015786959810672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,1770574570655625616,17526015786959810672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1770574570655625616,17526015786959810672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1770574570655625616,17526015786959810672,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1770574570655625616,17526015786959810672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1770574570655625616,17526015786959810672,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,1770574570655625616,17526015786959810672,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
9be58924ef72c3f7db8100b1556b4a7d

SHA1
2c7fdcf0f3cc33b7e61d759162e288ec4e27c8cc

SHA256
4aef3742116bfee58f43eedb8312686ceedc09bfa6f4cccb291057162c7498a6

SHA512
7d292f542e03a8fe5a07368eddc67ce848428ad4cfd2a6b77af4f8e2a243eae027d96eb5f6ec77b3743321274ad0ea82f8504b951657e21d24729fd09e15fa3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
1d976b8f4a9f7cc9109c8b11106d77f2

SHA1
e5ca394eed3cebd8115fdc2b18070ab696a50719

SHA256
24ebca9ef9769b3bd71320f683a15bb196178720d72ec6a12202f139b3caf4ff

SHA512
955f1f84dfdd0230469e093247f6ad8b36377b49231d69d83e163b86b3c6564196622cf3aeee9b8d966d9711906d7ecda3eea973df8cfed49dbb9da5c31df59e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d3038d4da2bb848bd8b7a97aff87bc74

SHA1
276a0e55b9fff626bad080fa7604a52cbc5bfc84

SHA256
2c6efd74b006840f8ac45f306dea2a83891f0715e75f10bdeba74ebd79ad080c

SHA512
805035f8ae8bb3ded17f9ea16a3dd5f6e12250d6a557ac217d9f14c7eb266dfe2dcb842db31525d947bdd0f494d734a375a330eaf5650fb736e23c9d6113cae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df4e61b0b6a6335609e968a2e42f3af5

SHA1
e40983991c8297dd81a697306a590f6573521740

SHA256
8868c6e47c61ea6aba58deb2058bcc4a88365a7ad86d38c84b14bef7540398ad

SHA512
071ff830cb07abcee0577c5dd74f6694b6ba863219ed5528be78cc4f413788fffc29e16e1b007853f923af24a618d4935a9096471fa60095cb266bab58c1ed5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc2ffa4170598eb7dc6f0da70de3e673

SHA1
3e2bc50f505b54cfbea4c84a686a9dbfac614cf0

SHA256
fa15975d65a0c6964fd8b3b18725b7b31229aafdea19625cca8573b0c7c696c6

SHA512
1fe576bafe7e284722d81e1d684f739ac9bf293cd0c59f87edae5608aa77593378fcf344b916110992c2deccdff410b4fc91561a5bb79365fdcbe12363ab6c6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c4d885448e310c12313252bbd18549b0

SHA1
7728bd20ca7979bd5c5e0ce2e38895ef46ad943a

SHA256
b020e4983d3066013f3329fe738239673983bb0b83e87b3b8516d90c41cb34a2

SHA512
7b985634e3a657dc4acc07f0e70cfb1097ec75de8ace8bcc0bfeb0789e88912734ef7d0935384d2756f4ab36323a634119655236247979913fcd3df5d472b3f5

Download Submit