70996ec284ccfde11356dcdeafde84178b175810db4fb80a3dafdfd78e36f4df

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2024, 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e47b46660c20aeff753f9118f007fa7_JaffaCakes118.html
Size

16KB
MD5

8e47b46660c20aeff753f9118f007fa7
SHA1

66f61359015a8b01cb29f35ca50ecf362ff1583c
SHA256

70996ec284ccfde11356dcdeafde84178b175810db4fb80a3dafdfd78e36f4df
SHA512

278b90846e2742cd614775a24dbaceac154b5d17bf5cc8d816c3b47b2ccd8fb7faa4503cf8eeb7db12948ce4fd20ec8e3976811720123a6af038c710b3247fe0
SSDEEP

384:FJbzKuZcOlr8a0NRGsX66nXOKxNEgFxSpQIxpDBbQ3gpwZEhQr:HbzzcOlh0NIMXNF8tMzr

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe
2868	msedge.exe
2868	msedge.exe
1604	identity_helper.exe
1604	identity_helper.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe
2608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 976	2868	msedge.exe	88
PID 2868 wrote to memory of 976	2868	msedge.exe	88
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 4308	2868	msedge.exe	89
PID 2868 wrote to memory of 1580	2868	msedge.exe	90
PID 2868 wrote to memory of 1580	2868	msedge.exe	90
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91
PID 2868 wrote to memory of 4372	2868	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8e47b46660c20aeff753f9118f007fa7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb95f46f8,0x7ffbb95f4708,0x7ffbb95f4718
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12930041689100463446,8441344054586756366,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,12930041689100463446,8441344054586756366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,12930041689100463446,8441344054586756366,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12930041689100463446,8441344054586756366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12930041689100463446,8441344054586756366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12930041689100463446,8441344054586756366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12930041689100463446,8441344054586756366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12930041689100463446,8441344054586756366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12930041689100463446,8441344054586756366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12930041689100463446,8441344054586756366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,12930041689100463446,8441344054586756366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,12930041689100463446,8441344054586756366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12930041689100463446,8441344054586756366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12930041689100463446,8441344054586756366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12930041689100463446,8441344054586756366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2804 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12930041689100463446,8441344054586756366,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7076 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4055c65bd274d7bd26e37d3af956287d

SHA1
e2deccbcc0167ef6b1bd641dba6e9348f493c15c

SHA256
9b9f211455464155695af6ba18cb31f47e5d41fd40c83a6f6eec92cfe636c742

SHA512
7192771eec294a521eef125eeb51b1b999d1286db67195b41e321e893102b5988599ce565e1effdc2547dff44ff9d0312636347aa6ad2442569c13e10085f37b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4d03681e6db3f26154f6f525ba36823d

SHA1
776ddbcd29adcec69c81b6eeccdb6a327b13ac60

SHA256
4260d1f70ccdf6ad069b62da1de03b9ef53d77bdf5396fd9ddfba67d63ffa01c

SHA512
fd80338e89a06d0d934f8955d56805fb4bc736dd49c9e5f988de047b8f29c49f7debcfe8bd3ea067304a8e751f57e28d58808cd1af8365f0419db55cddda8040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97fac6d93f98270a281a52fd7b7b0a00

SHA1
efdeff4ebf3e83aa8e44b892fbe62127adbab023

SHA256
c54868d89de18e8b029ea3cb7720b7b24c5306abead03de159db754a3654250e

SHA512
c3b977d21491b99b35578f07c77dfc0e2e9f4a140c0c98e469fef96b8c58f1be6e087b3be6c029b6181f1f2267f417874f0d8b629e15fea9c525e5cd2daeaae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a2c018af-ce85-4aaf-a323-dd2d85499bce.tmp

Filesize
10KB

MD5
87bed08184a0b97d5cdc663aef3ee139

SHA1
6c8f5ff8282f4e75cd37d97f3d67972ba6df0513

SHA256
89889c55a826c46d256f64a7961672e7f4ebb26651aa696ff510d6a79d82342c

SHA512
b43e935d5bb6c52c40e2661d4834b789d602d9f210c58128a1eb5eeda30bf03a2c401115a84b6904599be48e69fd5f28ef41b94816a4cb13d5482955fbd669df

Download Submit