hxxps://cloudflare-ipfs[.]com/ipfs/bafkreihrqhiwqme7jp7scyopalaf6biqk7y7c3cqaydjsdmrkfkffn5dmu

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
04-04-2024 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cloudflare-ipfs.com/ipfs/bafkreihrqhiwqme7jp7scyopalaf6biqk7y7c3cqaydjsdmrkfkffn5dmu

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

1 cloudflare-ipfs.com
4 cloudflare-ipfs.com

flow	ioc
1	cloudflare-ipfs.com
4	cloudflare-ipfs.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
4320	msedge.exe
4320	msedge.exe
780	msedge.exe
780	msedge.exe
2072	identity_helper.exe
2072	identity_helper.exe
1988	msedge.exe
1988	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

780 msedge.exe
780 msedge.exe
780 msedge.exe
780 msedge.exe
780 msedge.exe
780 msedge.exe
780 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 780 wrote to memory of 4060	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 4060	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2400	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 4320	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 4320	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe
PID 780 wrote to memory of 2832	780	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloudflare-ipfs.com/ipfs/bafkreihrqhiwqme7jp7scyopalaf6biqk7y7c3cqaydjsdmrkfkffn5dmu
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff989373cb8,0x7ff989373cc8,0x7ff989373cd8
2⤵
PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,7467960089284969055,5504676569945866176,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1808 /prefetch:2
2⤵
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,7467960089284969055,5504676569945866176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1836,7467960089284969055,5504676569945866176,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
2⤵
PID:2832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7467960089284969055,5504676569945866176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
2⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7467960089284969055,5504676569945866176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:3280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7467960089284969055,5504676569945866176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
2⤵
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,7467960089284969055,5504676569945866176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1836,7467960089284969055,5504676569945866176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3456 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7467960089284969055,5504676569945866176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
2⤵
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7467960089284969055,5504676569945866176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
2⤵
PID:700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7467960089284969055,5504676569945866176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
2⤵
PID:908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,7467960089284969055,5504676569945866176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
2⤵
PID:3912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,7467960089284969055,5504676569945866176,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3428 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4376

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a0407c5de270b9ae0ceee6cb9b61bbf1

SHA1
fb2bb8184c1b8e680bf873e5537e1260f057751e

SHA256
a56989933628f6a677ad09f634fc9b7dd9cf7d06c72a76ddbb8221bc4a62ffcd

SHA512
65162bf07705dfdd348d4eaf0a3feba08dc2c0942a3a052b4492d0675ab803b104c03c945f5608fac9544681e0fe8b81d1aaca859663e79aa87fcb591ddb8136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ded21ddc295846e2b00e1fd766c807db

SHA1
497eb7c9c09cb2a247b4a3663ce808869872b410

SHA256
26025f86effef56caa2ee50a64e219c762944b1e50e465be3a6b454bc0ed7305

SHA512
ddfaa73032590de904bba398331fdbf188741d96a17116ada50298b42d6eb7b20d6e50b0cfae8b17e2f145997b8ebce6c8196e6f46fbe11f133d3d82ce3656db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b98c52f-1b84-4f4d-80fe-500bc7113196.tmp
Filesize
6KB

MD5
204d85e7c605064c88a4aa582d5efecc

SHA1
252c8f955f2117aa438b5a036ea1efc52b2620d3

SHA256
b32895b39438f3e6d5ca2eda6ddeb753d7249116c6720bf0f24fbee4205a69de

SHA512
665589e819f3522171744e20a662ae3f098d467f7a904903c74a575e28894f7644b496ed150f01f5745067f135d92e0cec4f6470cfa8e85ea4bf4a68011d28aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
264B

MD5
81fb6988eb807e08aeef1dda1e083a49

SHA1
95188d9039a419ecf4cc1a4996ce19aa08113a0b

SHA256
14641da6d353c40a9e2cbc265c6e67bf1829a18334048389a6093e35c5858982

SHA512
a686b95fb929eedaff652cfa6aeaf3acd59be1c86c3ea4e41a7c8edb84ca00cbb9bdc47df2eb94b92d29e6e9b66bc236f27ebc9e66775bdd60af57129eaee410

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
747B

MD5
f2b1c397ef580571b437c4deb3cbdd69

SHA1
fcfc606e391805d217038523a4223b3659446152

SHA256
4824c69e7eeb6f050e2e7e423dec0fc89f65f5e61a92dd1f2fbb9be87b6f79cc

SHA512
510e510b18bfe01d18447feac74de0d50a9f7c736737f34849debef8c1ac2c00e3dd7a5f088a81c30c823916840f0adad78fd96af73dcab8b3d34df1179482c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
aa00428e82ab57b348b5f1837df51250

SHA1
3d2948a59d703cc78375b9894ef253d50d8374f0

SHA256
054873749446b75430d3f5440ea9bf00dd54f4099e3e3fa9e6f3d3e4b0bde218

SHA512
5318194e718e4e9b85da7b2687e8170537c1d90190e5397ad5873c3226027e372737adf4f3e69d967f93f2db16e3624d80d0768cd13238a0aa5fc2374d66b020

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
75d76823a86d679c260d34c43457bbd4

SHA1
41fc6a82f46529d6f4bfbbc763f31c0414272425

SHA256
87b441e6e3c310b6d0d4e23708ba9764125ff4960ed3f604be916edef41d8e16

SHA512
2d513cafbb9ea9cb281ca35f9ca21c7711f6f7c41bd0729c2da06e19ddaf2170e5fc5878e4e82af361c14033de0cc40e0a1229f067a0b364077d2e709b49d654

Download Submit
\??\pipe\LOCAL\crashpad_780_COICESWFCZQQIPQW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit