0134cadf86b4631844975aa0b1a0cb90156381900f2dfea99e25c0b0c9e5d0ac

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe
Size

16KB
MD5

2fbb1192373c4219baed34d251d1a532
SHA1

d660428452a4d95ca043df222fce28dfe234feaa
SHA256

0134cadf86b4631844975aa0b1a0cb90156381900f2dfea99e25c0b0c9e5d0ac
SHA512

aef0f3033af058f5d17817d1349a739272a0e5c3d4393ebac05a309f10c4f8851a6fce4da5629d11650fcc12f30f40869b9076726ee6af1c4d271e64b83316c7
SSDEEP

24:eFGSpNtdi9ym230J4w0Qb0EVM208hElHGSYpKV:iddGym2Aghr7YA

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation	2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
4280	msedge.exe
4280	msedge.exe
2580	identity_helper.exe
2580	identity_helper.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1020	1584	2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe	85
PID 1584 wrote to memory of 1020	1584	2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe	85
PID 1584 wrote to memory of 1020	1584	2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe	85
PID 3600 wrote to memory of 4280	3600	explorer.exe	87
PID 3600 wrote to memory of 4280	3600	explorer.exe	87
PID 4280 wrote to memory of 3088	4280	msedge.exe	89
PID 4280 wrote to memory of 3088	4280	msedge.exe	89
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 2276	4280	msedge.exe	90
PID 4280 wrote to memory of 3752	4280	msedge.exe	91
PID 4280 wrote to memory of 3752	4280	msedge.exe	91
PID 4280 wrote to memory of 2304	4280	msedge.exe	92
PID 4280 wrote to memory of 2304	4280	msedge.exe	92
PID 4280 wrote to memory of 2304	4280	msedge.exe	92
PID 4280 wrote to memory of 2304	4280	msedge.exe	92
PID 4280 wrote to memory of 2304	4280	msedge.exe	92
PID 4280 wrote to memory of 2304	4280	msedge.exe	92
PID 4280 wrote to memory of 2304	4280	msedge.exe	92
PID 4280 wrote to memory of 2304	4280	msedge.exe	92
PID 4280 wrote to memory of 2304	4280	msedge.exe	92
PID 4280 wrote to memory of 2304	4280	msedge.exe	92
PID 4280 wrote to memory of 2304	4280	msedge.exe	92
PID 4280 wrote to memory of 2304	4280	msedge.exe	92
PID 4280 wrote to memory of 2304	4280	msedge.exe	92
PID 4280 wrote to memory of 2304	4280	msedge.exe	92
PID 4280 wrote to memory of 2304	4280	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2fbb1192373c4219baed34d251d1a532_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" http://lapublichealth.net/a.html
  2⤵
  PID:1020

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://lapublichealth.net/a.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa497d46f8,0x7ffa497d4708,0x7ffa497d4718
    3⤵
    PID:3088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,4672767210223212605,17964597640030148263,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,4672767210223212605,17964597640030148263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,4672767210223212605,17964597640030148263,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4672767210223212605,17964597640030148263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4672767210223212605,17964597640030148263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,4672767210223212605,17964597640030148263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 /prefetch:8
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,4672767210223212605,17964597640030148263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4672767210223212605,17964597640030148263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4672767210223212605,17964597640030148263,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4672767210223212605,17964597640030148263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4672767210223212605,17964597640030148263,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4672767210223212605,17964597640030148263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
    3⤵
    PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4672767210223212605,17964597640030148263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4672767210223212605,17964597640030148263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4672767210223212605,17964597640030148263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1076 /prefetch:1
    3⤵
    PID:1208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,4672767210223212605,17964597640030148263,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5560 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9abb787f6c5a61faf4408f694e89b50e

SHA1
914247144868a2ff909207305255ab9bbca33d7e

SHA256
ecfd876b653319de412bf6be83bd824dda753b4d9090007231a335819d29ea07

SHA512
0f8139c45a7efab6de03fd9ebfe152e183ff155f20b03d4fac4a52cbbf8a3779302fed56facc9c7678a2dcf4f1ee89a26efd5bada485214edd9bf6b5cd238a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a5693031b47378530b48cec8021a80ba

SHA1
7a960be10560a363e5dd6d88e8dcae2ee7703234

SHA256
7c64944e99cb4048cde20bf5ec407cf1cc4ec29d847c2f1fb70e796b7bb08ccc

SHA512
0a0d6f97aca19e1c945977f66d7d35ba22486a4752816d5018954d503d91d87e0387e5fceea41735f8770975c5867508ff2cfbe986b08327dc8e35d87f5ecd27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0d72af39ff1eb2d2e246d38119a101a2

SHA1
0a9b8591d167ba31755e79909c296463b9df9bcd

SHA256
47ea7e723a78dac0be3ed16571c2c308d8aeb25a3593a991aa6b2b0f686fc271

SHA512
905fc7478dad234baf1717ace6556e5bcd9ef186dd2b9805c9116c3408605a9e1ac991e1c648d3c5f4ea8fa1d62fdd1228e7e79f183e274667aca806bc1e9703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6d0919345ea794c9e351a05ad742808d

SHA1
c41a0e6f60b1fd94c4b43cb233e14e4e26435dbb

SHA256
229421e4b70d16f80e60e9c054cc72a62a0f253fea4a91dcd4413cb65f821fc9

SHA512
1d7cfe8c05d5830d60876191b438487dd2e96ca678968566b3589bd630ababbf5d757e8faba388c48619853923c4d925206f2f6986afd7b28c28f4325f9e91c3

Download Submit