758499bd520906e9bdadc7550f2d5d4c02ce25798e82a15e50c96642210acb87

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 05:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e8965021fd16fc3bebd9d1ddf6c0dbd_JaffaCakes118.html
Size

109KB
MD5

4e8965021fd16fc3bebd9d1ddf6c0dbd
SHA1

4d3e8de87e72c081dd77106eb126f423a25a36f1
SHA256

758499bd520906e9bdadc7550f2d5d4c02ce25798e82a15e50c96642210acb87
SHA512

9a56c21b7f2b6b8368f5849ffbd5e8ca007d1508c405554adf0bdea8ac8f857ef03c7e75f0d7359eb3c49a40f2ddc11a7b8a7e5e7648fae568f571c9ff92a995
SSDEEP

3072:aC1ByvyKYyLkmIqjsaAM9ysbKfKtGHxmUqNbrZSn:LYvyKYyLXbY1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
64	msedge.exe
64	msedge.exe
4860	identity_helper.exe
4860	identity_helper.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 728	64	msedge.exe	82
PID 64 wrote to memory of 728	64	msedge.exe	82
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4504	64	msedge.exe	85
PID 64 wrote to memory of 4060	64	msedge.exe	86
PID 64 wrote to memory of 4060	64	msedge.exe	86
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87
PID 64 wrote to memory of 5008	64	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4e8965021fd16fc3bebd9d1ddf6c0dbd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea93746f8,0x7ffea9374708,0x7ffea9374718
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,5777320336982460139,14947740360125223331,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,5777320336982460139,14947740360125223331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,5777320336982460139,14947740360125223331,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5777320336982460139,14947740360125223331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5777320336982460139,14947740360125223331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2196 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5777320336982460139,14947740360125223331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1324 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5777320336982460139,14947740360125223331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5777320336982460139,14947740360125223331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,5777320336982460139,14947740360125223331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,5777320336982460139,14947740360125223331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5777320336982460139,14947740360125223331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5777320336982460139,14947740360125223331,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5777320336982460139,14947740360125223331,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,5777320336982460139,14947740360125223331,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,5777320336982460139,14947740360125223331,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
537a9d3b96c947c1c7107cb9983ced92

SHA1
3a586d11ec10e61fca3ae3e618da95963a5552f0

SHA256
c1f3ba3067cf1f4274cbc13c5660ad725489f7a4c48ac05e98d0211d87844ff3

SHA512
57d6b56b85cfcabe89c0311af547a2dcbaf569856ea5604bc43903ffd299d7a68cf668118b396eb2db0bf7481a0876301d313e717eb882b8d35c769b42810eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4eab87013c1aeb857aac9e4eeaed6be9

SHA1
f632b638d8f9a0ad1becb319fe219ee55202b8d7

SHA256
127538ed3ef8cc184052c06527d2ace6ed89f1f8d5b7be974dd6ef3e95f3b6d8

SHA512
e505ef2e5eb851572557a960921f12a06170c8a99da410adb413da665f4c11741968cda46850dd3024a4a43210e75ac95f353a3b92af465f4537333ed6872980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
263b3b2f2a41e9993780e2d7376c2fea

SHA1
c556fc0fd5b4745eebbbc4375971562a1288960f

SHA256
4d352761a6fe665cb2aef097bf5bb10031539328f56a14a8110551f7d50f1fd8

SHA512
b80dabea7d607b5013c236a4ea28f8c6c2d2537c9a2b2fccdb74a2146a46b28028349accd5044089ab28de07795c3d6ad6469ee09d330ca7fd942559bbc0c7c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c1f8e6c5ae4868ec6a1587877576df6d

SHA1
cf1246c6b89c8d575eea8ac65fc60b9f303ee6f3

SHA256
79f3bc257b4d4fbedf59c1c3daedd6179d8c9d701e6cd489c552cdc1f838fada

SHA512
5c342cb363cab21a4983a89018a27cd077f87bd6f79b7a0481bcc2f21faadffc278d66e4b0a5a771b23b50c527ace4bae0cdf4d74176cbb062ac6d3727b3ddda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c31b74ea465a5a6dae04d5aa92cfc285

SHA1
8f7ca0ba59306a4b8f630bbc202e727f474df59b

SHA256
725e5b5c4eb4e51ce68ed967f75436f4c24809357a8b618fa39172d89a72b960

SHA512
b49988e71ddb067f7a6dc3fc915f32aadbe0f3a0a669ddaf79528a64367616e5a82fdc381d3de3d3e8c9138ffc24dcaec95e9c528048d3f9d5e37c1649354958

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9c045a8059e30321a9732fb65f350150

SHA1
a6abdeaed181212ec543e4896f00fdb1b933ac21

SHA256
123c323efb2f69a8af30200a49b8c76cfb3e49be6bab57272be445ce3ec38a8d

SHA512
998d79336d1dcb08615b2a0fdc51fb1e2ad2f6d31796528f14bb96b6f44fa414ae053337f94303a43341fde224c3a8fb4d15971d91798eee5f371d5fe781dcc7

Download Submit