30e91336c4447f787d3f8642f7cb2cf00a093b8c90061b3910e3a9dc9a20694e

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 06:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecd6e9e426caf41b36d307acc568d8a0_JaffaCakes118.html
Size

52KB
MD5

ecd6e9e426caf41b36d307acc568d8a0
SHA1

c2efcf82c43aa9f48c91f49105a9851dd995a837
SHA256

30e91336c4447f787d3f8642f7cb2cf00a093b8c90061b3910e3a9dc9a20694e
SHA512

7660439f3f0800eb85d8c2431f76d2bf32cf95070756c6b25d5081d95efb65054969edd8418c366a99751888efd5688fc4c899ae2f8169142a5d7c44f3fc442d
SSDEEP

768:uUANwOvXc5hyv7AK6HIhvtTz5kYTzn1t0:yM5sv7ftkYHn8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2736	msedge.exe
2736	msedge.exe
224	msedge.exe
224	msedge.exe
2176	identity_helper.exe
2176	identity_helper.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 4564	224	msedge.exe	84
PID 224 wrote to memory of 4564	224	msedge.exe	84
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2396	224	msedge.exe	85
PID 224 wrote to memory of 2736	224	msedge.exe	86
PID 224 wrote to memory of 2736	224	msedge.exe	86
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87
PID 224 wrote to memory of 2100	224	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ecd6e9e426caf41b36d307acc568d8a0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffd6ffe46f8,0x7ffd6ffe4708,0x7ffd6ffe4718
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7402581472686535114,1096720180779478102,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,7402581472686535114,1096720180779478102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,7402581472686535114,1096720180779478102,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7402581472686535114,1096720180779478102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7402581472686535114,1096720180779478102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7402581472686535114,1096720180779478102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7402581472686535114,1096720180779478102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7402581472686535114,1096720180779478102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7402581472686535114,1096720180779478102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7402581472686535114,1096720180779478102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7402581472686535114,1096720180779478102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7402581472686535114,1096720180779478102,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7402581472686535114,1096720180779478102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7402581472686535114,1096720180779478102,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7402581472686535114,1096720180779478102,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
53b236923c62e8c0e8fe7a3037aa65cb

SHA1
b2d4c9cec35483999eab391bab7d081c223e84f3

SHA256
1c607eedc3641b37253d7fd70b4559c46960daac71cf7f7cbd641d1326f69e41

SHA512
c0cb532a743e1cd999da7f9f2c5b787dcf5f41a95f3e1d595abb5655314b480cca3642e79018811011ac0510a410b4dc6f8c9cfc910dfa7a861b31f89634fb4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
810e8d0e535c255e0042c599eff3331c

SHA1
603b22237ba07db07cf7fe90780b2c1d1bfe4ed9

SHA256
47906554d0bbd0a89d8ba8f3ed8ee83bf041129f60754a6c0744e46fa8c4ed94

SHA512
341f312e51fdae55fad8b6f6a9b57993a4a930981247c618336da1677d04eba0bf1c1c24163079b7bc0c78ad27bd4e5b916d41f38859816f63d5e65fefbcbf39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4a1bf0b01e93d6862a44a1a6bdaefba5

SHA1
86a35bc62b3332a53763a3508c9d448148218a64

SHA256
fdbd5ff1dbab0b761a3fd2e7efb2b8f163662839e3f666a1da8b899476bb3fb9

SHA512
df28b4ff30a47bfe1a6a9f312dc76ff377d74adfc1c77f16ded521ece7d88d60770f5a0c518203e6e9c493f3f3ba035f1a57d6417ea980d4cbd4faac28c851d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bde528b6788aa6fceea0f7ad9e68bbe6

SHA1
38c7ef6fbb3fb2b9d69b4001f1cd3bb74c8fe2ee

SHA256
594c992adcfd7c63d73e42c180286d47ebe9c5d9f58dd83e22706d1ec14e9279

SHA512
26529eecf0d4b239a824ba51781d269bfeb005fd0c68645a580f0747be5c62b1bf2eb596525b8b6a6de4e161da3208ffbbe5a945725da1de83ab65f415219d88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c8a25276f5f4d16b2080cf1db4c48ed3

SHA1
6bfe73e3a48c6999a1186e02910f296e34faac87

SHA256
a80a06da804637541a7ed73902160d9c11e71243d0348e4a98412039ce1339e0

SHA512
71da257c8c24489ac779c943112140a9df58374b1a94cae3dafaf24c58c57e4277a83ad9fe8661050caab124621d7cb003b99ffd139d41d256d0723b9fb1fd81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f5f4fe0cd324c3a06a324b10e79b0bd9

SHA1
c2669e2e7cc5e62ad899265ef198515f92095cb7

SHA256
76585dcf0893414e383317da8453161c260258a9adaa4b0d395d07e9d1e762ac

SHA512
2f6b490aadfe30b7cb3a72f32eac444e7106e4831d3504c9745863b25282d52f2740a83d3522646872c4656a8aaafa9ef19177e1a2ec859e9130d49e0668b768

Download Submit