e0bcfa22cdab444ce73182621b68cebd0c18fc561780c33b323ccd21ff39021d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2af32bc9e909631d32470c294df8416f_JaffaCakes118.exe
Size

1.3MB
MD5

2af32bc9e909631d32470c294df8416f
SHA1

bc693b209c05c817974b61146e83bb4b680d489d
SHA256

e0bcfa22cdab444ce73182621b68cebd0c18fc561780c33b323ccd21ff39021d
SHA512

9af195b3099e853c068d56c8df5505e0e78712f1679611ec6cba8a74ebc0ab563d1e1cc340818026a63cabeaf44285323352adb2507bbf1c072bec4a6cb6a14e
SSDEEP

24576:MejDKKiDkY2+AhEcy1BirYZqXMrDjUm84QeP3CqkkkkkkkK:MeUDeyLZqcn3CI

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
3024	msedge.exe
3024	msedge.exe
1572	identity_helper.exe
1572	identity_helper.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 3024	2732	2af32bc9e909631d32470c294df8416f_JaffaCakes118.exe	85
PID 2732 wrote to memory of 3024	2732	2af32bc9e909631d32470c294df8416f_JaffaCakes118.exe	85
PID 3024 wrote to memory of 4776	3024	msedge.exe	86
PID 3024 wrote to memory of 4776	3024	msedge.exe	86
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4088	3024	msedge.exe	87
PID 3024 wrote to memory of 4496	3024	msedge.exe	88
PID 3024 wrote to memory of 4496	3024	msedge.exe	88
PID 3024 wrote to memory of 836	3024	msedge.exe	89
PID 3024 wrote to memory of 836	3024	msedge.exe	89
PID 3024 wrote to memory of 836	3024	msedge.exe	89
PID 3024 wrote to memory of 836	3024	msedge.exe	89
PID 3024 wrote to memory of 836	3024	msedge.exe	89
PID 3024 wrote to memory of 836	3024	msedge.exe	89
PID 3024 wrote to memory of 836	3024	msedge.exe	89
PID 3024 wrote to memory of 836	3024	msedge.exe	89
PID 3024 wrote to memory of 836	3024	msedge.exe	89
PID 3024 wrote to memory of 836	3024	msedge.exe	89
PID 3024 wrote to memory of 836	3024	msedge.exe	89
PID 3024 wrote to memory of 836	3024	msedge.exe	89
PID 3024 wrote to memory of 836	3024	msedge.exe	89
PID 3024 wrote to memory of 836	3024	msedge.exe	89
PID 3024 wrote to memory of 836	3024	msedge.exe	89
PID 3024 wrote to memory of 836	3024	msedge.exe	89
PID 3024 wrote to memory of 836	3024	msedge.exe	89
PID 3024 wrote to memory of 836	3024	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\2af32bc9e909631d32470c294df8416f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2af32bc9e909631d32470c294df8416f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://contrev.net/redir332.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae0a746f8,0x7ffae0a74708,0x7ffae0a74718
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14752420238255090384,17423170810613588764,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,14752420238255090384,17423170810613588764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,14752420238255090384,17423170810613588764,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
    3⤵
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14752420238255090384,17423170810613588764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14752420238255090384,17423170810613588764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14752420238255090384,17423170810613588764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14752420238255090384,17423170810613588764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3460 /prefetch:8
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14752420238255090384,17423170810613588764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3460 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14752420238255090384,17423170810613588764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
    3⤵
    PID:1984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14752420238255090384,17423170810613588764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14752420238255090384,17423170810613588764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14752420238255090384,17423170810613588764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14752420238255090384,17423170810613588764,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3156 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbc957a83b42f65c351e04ce810c1c11

SHA1
78dcdf88beec5a9c112c145f239aefb1203d55ad

SHA256
7bb59b74f42792a15762a77ca69f52bf5cc4506261a67f78cd673a2d398e6128

SHA512
efad54eb0bd521c30bc4a96b9d4cb474c4ca42b4c108e08983a60c880817f61bc19d97538cc09a54b2db95ab9c8996f790672e19fb3851a5d93f174acdfac0ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5b6ff6669a863812dff3a9e76cb311e4

SHA1
355f7587ad1759634a95ae191b48b8dbaa2f1631

SHA256
c7fb7eea8bea4488bd4605df51aa560c0e1b11660e9228863eb4ad1be0a07906

SHA512
d153b1412fadda28c0582984e135b819ba330e01d3299bb4887062ffd6d3303da4f2c4b64a3de277773f4756da361e7bc5885c226ae2a5cfdd16ee60512e2e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
4205846b34aa58e4a58ebdf9a04213c5

SHA1
d13bc637678c8457a6b9b64fa83ec1ae3e9bd7fd

SHA256
d2d753a1ebf6416ac48d62ecd8e21bc4183b036e683d95d76cf905c7d3d646a2

SHA512
b7b9406271d2eff573e829f7f5c06f30afaad7c53e89868cdfc8f79c39ed84b9512c0ab4195d272d52c7f19cf7896c2bed9934270db10c7b9bf89dedfc75262f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
96b7fd35d0acf1377165872f3413b4df

SHA1
b0f72876f40af3d3910a09a6a71ed5a54eb4f76b

SHA256
f82829925a2bff715df7fc6dd7f494762f69805406660e5705ac85a613b50f6e

SHA512
217632bc9712942c02c32e81a8934f1cd2b1bb0b3e392cfc93adfb6f93dc54e062cc3922e884a9d34b44bccf3ea22561e2232953b7c2a8819fa513b3ec4f69d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2e38dbb8eb868efbd09c832022966a5f

SHA1
c4515a623ab308b7b8d3d1aaa9eacb56b49a0668

SHA256
029dbae7a19e407c979564d40c12181dae1278fcf1cdce3c3145cd8177b913a1

SHA512
2e79a2c1d5bd0ed8a4404f2fa7fb68e8809bb6d6516cab234c0a6c3d7bafd5a60cce8ff73e7b940d5c93b6ad906efa4cb2ad23042f0c4c254025acdb08e41090

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a07d6b309445885f02b850dfbee75a4b

SHA1
7fd69bd7d84afbc3318cc87a2e4042455330a4e0

SHA256
0dfd993cb7c7786d78821de4bd466be10f4598b0421b9091dfa80b15be6084b8

SHA512
d6a2aae84be1e0a157605d340e1f5d6144e0b4bf5ca6511bef2a296f4864d17959d8bccea0781e0b74e55f2aef8810c814c53003ff59ab81fbf5e7bbbd8a4991

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c4a8dd59-4108-432a-9a2e-5f25b028b788.tmp

Filesize
11KB

MD5
2cf9d17f542ee7d333f74c6c1234171a

SHA1
209d80949eaa7e6ec15154ea30c6a421365f5ee4

SHA256
1ace0ea0529069ea0c4a36ef9e48307048ccc4e6a0f801f3be3841a724193606

SHA512
fec584dc8bd86df0b025e9805ddb1481cc2c4c24ac7d44feb45e0ecaea292e05eaead8cc157c0c8f6eb19f20cd05bca928d8f53d88557246af8132465115a0cf

Download Submit