4e1e73f350d76157501255e9866e5b50bfeccaf7221da1595c28362da8c41de6

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8575b284d31130168c565f1a7c4e58a0_JaffaCakes118.exe
Size

1.3MB
MD5

8575b284d31130168c565f1a7c4e58a0
SHA1

fbbbeb0ca1d6135bcff9ba1d8af9f2f361c9b432
SHA256

4e1e73f350d76157501255e9866e5b50bfeccaf7221da1595c28362da8c41de6
SHA512

a71270e42eb90ccf74a056d8f1656dad9f2be987929928510e952ec59fe0adaffa4646d885d85eff9359ac69b1cf9395c33d627cc9fc2d4cbaeb39b1cb43b34e
SSDEEP

24576:MejDKKiDkY2+AhEcy1BirYZqXMrDjUm84QeP3Cqkkkkkkkf:MeUDeyLZqcn3Ch

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8575b284d31130168c565f1a7c4e58a0_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
2100	msedge.exe
2100	msedge.exe
4440	identity_helper.exe
4440	identity_helper.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2100	2332	8575b284d31130168c565f1a7c4e58a0_JaffaCakes118.exe	87
PID 2332 wrote to memory of 2100	2332	8575b284d31130168c565f1a7c4e58a0_JaffaCakes118.exe	87
PID 2100 wrote to memory of 2484	2100	msedge.exe	88
PID 2100 wrote to memory of 2484	2100	msedge.exe	88
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 3676	2100	msedge.exe	89
PID 2100 wrote to memory of 1604	2100	msedge.exe	90
PID 2100 wrote to memory of 1604	2100	msedge.exe	90
PID 2100 wrote to memory of 3736	2100	msedge.exe	91
PID 2100 wrote to memory of 3736	2100	msedge.exe	91
PID 2100 wrote to memory of 3736	2100	msedge.exe	91
PID 2100 wrote to memory of 3736	2100	msedge.exe	91
PID 2100 wrote to memory of 3736	2100	msedge.exe	91
PID 2100 wrote to memory of 3736	2100	msedge.exe	91
PID 2100 wrote to memory of 3736	2100	msedge.exe	91
PID 2100 wrote to memory of 3736	2100	msedge.exe	91
PID 2100 wrote to memory of 3736	2100	msedge.exe	91
PID 2100 wrote to memory of 3736	2100	msedge.exe	91
PID 2100 wrote to memory of 3736	2100	msedge.exe	91
PID 2100 wrote to memory of 3736	2100	msedge.exe	91
PID 2100 wrote to memory of 3736	2100	msedge.exe	91
PID 2100 wrote to memory of 3736	2100	msedge.exe	91
PID 2100 wrote to memory of 3736	2100	msedge.exe	91
PID 2100 wrote to memory of 3736	2100	msedge.exe	91
PID 2100 wrote to memory of 3736	2100	msedge.exe	91
PID 2100 wrote to memory of 3736	2100	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\8575b284d31130168c565f1a7c4e58a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8575b284d31130168c565f1a7c4e58a0_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://contrev.net/redir348.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e88346f8,0x7ff8e8834708,0x7ff8e8834718
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7027382407429005057,7426866500535863690,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,7027382407429005057,7426866500535863690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,7027382407429005057,7426866500535863690,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
    3⤵
    PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7027382407429005057,7426866500535863690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7027382407429005057,7426866500535863690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7027382407429005057,7426866500535863690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7027382407429005057,7426866500535863690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7027382407429005057,7426866500535863690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7027382407429005057,7426866500535863690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7027382407429005057,7426866500535863690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7027382407429005057,7426866500535863690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7027382407429005057,7426866500535863690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7027382407429005057,7426866500535863690,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
0d43be8b14cf7e2b915548a68f9921db

SHA1
4a9318085d864f5b25b978fb1380e9f38465675d

SHA256
273343b422255391344c73eb96ee5e0b778de174acc44c15114d8233e40505e2

SHA512
3faf1b66ea33e5df3ac8e02391f362a2de01f3ae568015a6f1b2ca9c71d25224fd3bb64b706b51f9c55d293f450697dda147b5f06293d172807a3bc81be9f948

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1023B

MD5
8fe60b79f5679844f1e624b6305f6eb0

SHA1
c40588a3642985c78eb2c50a98cfc8ffe6ca3962

SHA256
cb29effd43bf7ac7d7db1b90b0e0d30f29b4012c8a76b7d06b41c976250a4888

SHA512
07f2cfda67c73a48a1ebf9f35898cf9393fffa30de1f80f6243e1a062c1d6aaf50b16c37663f3c33c4de0c0fd6cab0fba5f37477b829458bb40cd8c0cc2322df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c5a7dfb618368a11458e3cad37268e9

SHA1
6342fee49afa0d5831624283b398b2394ac6c561

SHA256
228f9b5db68af63c1b4b0d2cbde7eabbbc8302404ce634458f68c003bda7663c

SHA512
b535c6fa90763f680f9667e40b5180d601f03d61146a5fa79c6569c9f56f3a69d66a9fa47cd07f4f00fe065fa4669eba74eb878c4608156b2999b6b50d653140

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c443c407bbe67f058d3565a4338f0493

SHA1
f9aa1aaa070f8112e01f49a8913b3a33074823d6

SHA256
54ee7498f0731077193aff34ef5e3ab9ac1e4f73133e0b2e35e70633547c2de1

SHA512
0abf9b0c335d87275fe1b6c2b43f97ffab047941bf78b4d78d535a42ab866e8c3b21c100dbaecf030195201133b813b673d2eda0e1b6d5a646ea2f44d5c21723

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7e46f65f6986405b16f38db331e35db4

SHA1
6c3847806bb4bb5fac50863140aeffefe1f6cd0d

SHA256
c20a52fc5cc4875637638744643d8972df308b6ec5290fe702b4fd62655d2b3b

SHA512
30acf704c21e7d21a63856fecaba93e0ce4c20f94102a78a8fe5efa1d5762923fa2472f26e963697a473f2d2c4f60527ac5e72760169b2d6f26151ffd5d74421

Download Submit