56b072ea0410c5e194d607d7b360e1f7e046f56f8dd2885aa6332e0198cb4562

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 18:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c470da96b0f971bc247396463c148d1_JaffaCakes118.html
Size

32KB
MD5

3c470da96b0f971bc247396463c148d1
SHA1

65101d9b868d0917618a3aa90d430a86bd2d9a66
SHA256

56b072ea0410c5e194d607d7b360e1f7e046f56f8dd2885aa6332e0198cb4562
SHA512

e439acfa4f35ff3620d746f8f874f7471de18830f5c7ed3b97498f1de7c68d9aebcd99a7a4f7512fa7f80ab7295e835d9559d6c64e70f4fb4b77254a9902b334
SSDEEP

768:SFRiUXKCLCTCvCfCgCNCYSa9v37+jozQebIWn6BYJ:SFRZKYC2QBCfSa9vr+jozmWn6BYJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
4144	msedge.exe
4144	msedge.exe
516	identity_helper.exe
516	identity_helper.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 1224	4144	msedge.exe	83
PID 4144 wrote to memory of 1224	4144	msedge.exe	83
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 3740	4144	msedge.exe	84
PID 4144 wrote to memory of 1640	4144	msedge.exe	85
PID 4144 wrote to memory of 1640	4144	msedge.exe	85
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86
PID 4144 wrote to memory of 1888	4144	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3c470da96b0f971bc247396463c148d1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7a7146f8,0x7ffc7a714708,0x7ffc7a714718
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2352,4931499947867547351,11706422777655057455,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2368 /prefetch:2
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2352,4931499947867547351,11706422777655057455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2352,4931499947867547351,11706422777655057455,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2352,4931499947867547351,11706422777655057455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2352,4931499947867547351,11706422777655057455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2352,4931499947867547351,11706422777655057455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2352,4931499947867547351,11706422777655057455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2352,4931499947867547351,11706422777655057455,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2352,4931499947867547351,11706422777655057455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2352,4931499947867547351,11706422777655057455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2352,4931499947867547351,11706422777655057455,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2352,4931499947867547351,11706422777655057455,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2352,4931499947867547351,11706422777655057455,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0df2951a-152e-4902-badc-dc91144cf9cb.tmp

Filesize
6KB

MD5
d48e052e62437448b1be5c2ba31da308

SHA1
eb84bd7f356cabca30a8fe4bb1ac9fb879e89821

SHA256
355f45896a5ee3f94de53ffa7971ccc51b46d013dbc8197b3a3264ef13a47520

SHA512
593ce2f27a63f99aadd1063a88e605e6b159f7dd3b0233d8915864a3443a03f59da490d910948bec6e63d5f4c2cb66446c4896e65b38b1f4523103fa1f2ee44c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
ff81b1893a61f68664aa11c217273c09

SHA1
af8f379a8463233651aa5d7a7e087971b9f69e5a

SHA256
6b2e1024cfb3020a84c055d06cb6f4e8e13cd7aeb1d516d4884fd1ea6d0c50df

SHA512
4bf1199d56987518646fed7bb16fa5ef9fa8e87d61b857efb9e8be60e8e9f62b80b4b9e69fd5d8055f3757362dd9fc8f7988b899cacc9f105fcb0a60164de208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
333B

MD5
3387ea7a3564b78f09ea5d79ed0b85f8

SHA1
02449ed045dc45e3df0cf33aca7ab10aa10b7b0f

SHA256
5e21dae89f836c8063338ce598a2f4c2aa9e9eae9b69bcb81d058add377e2cb1

SHA512
ba8b53d7db7c575342625014fd46d1e99403b08843b765732a95a3fdc0972d10d20c05886c761a25e726358ce34574c5602dada84b7219bf442a676beb869ce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5a465854b629d219b38a8bf910e107d

SHA1
32906c9fa8f83ca88b7bf51dbbb55b6884899f15

SHA256
dcb713f5066b7e02cd85e08156fe538cf919314749c84de05a642e7e7e02b05b

SHA512
22c97d46d078f1a44b0c695732143e7f712e3ba8d598cfde853b3a83d3a362f2f48ee31fc1b241f7c81713b459dd6b0e29541ef9b545ab41a8367ddae0e7714d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
890e91fb810eabfca28c7d70fb7a626b

SHA1
7621ea245fed239410fe44ca53c369d569b958a6

SHA256
8ae87a72bdc8eeb48d74cb1c6a9d9e36e413eba4fb3f4957c99097c781ab44d0

SHA512
d5a736fb44a6b0553dbe87199930fd5c9f9d0a206030689a8168f5f453b2b6aaa2c92db0e06a6960f97048cdc7e6cce2c30fd49c721992e8d415656d29621296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1bcf3b32e45349e1a6af852cb5e82cae

SHA1
fc71489b65349d9832b524d7d419b1fe274ffb5e

SHA256
82f9604c7699dae604f461d8dc44c2492e787aa59d925ec1165a8644b8a4c300

SHA512
af548b471feee56363cfb6b3a77c81540fefbd7a88ab4dad5c3342ecb52ea25ba9e1beb0119cb4c6cf9c6b3bdfd8767465e35e383f049fd9818cd020a8130619

Download Submit