fd3b564660f7d0ce684eec7adce6588a8221ed9dfe6607aadd2ceaa51277ec85

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2024 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f67d74ac7abe20b52f481197ecd345a_JaffaCakes118.html
Size

132KB
MD5

6f67d74ac7abe20b52f481197ecd345a
SHA1

e915f675a74a0fc55dcfd8d54049e175218d00d8
SHA256

fd3b564660f7d0ce684eec7adce6588a8221ed9dfe6607aadd2ceaa51277ec85
SHA512

a70c3031dd8979cf33414a6363c9d4581537c984bddfa3edb4f1698bfe453a163f1dd437548317c0f608dde1b4df0c20cb52884094e325247be2768c0aeaf7a7
SSDEEP

768:23k1ATx+Bw24Tp7VhOPqcipt+CpC0/gAtnEktNYkmQBDCheNQzDXB9kCjclp06co:2JHhOPfCpBgfktZ05jclpXcDOctPNC

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
1688	msedge.exe
1688	msedge.exe
1636	identity_helper.exe
1636	identity_helper.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 3544	1688	msedge.exe	84
PID 1688 wrote to memory of 3544	1688	msedge.exe	84
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2208	1688	msedge.exe	85
PID 1688 wrote to memory of 2064	1688	msedge.exe	86
PID 1688 wrote to memory of 2064	1688	msedge.exe	86
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87
PID 1688 wrote to memory of 216	1688	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\6f67d74ac7abe20b52f481197ecd345a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe67d946f8,0x7ffe67d94708,0x7ffe67d94718
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,10304029899767258873,12725765890141964963,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,10304029899767258873,12725765890141964963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,10304029899767258873,12725765890141964963,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10304029899767258873,12725765890141964963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10304029899767258873,12725765890141964963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10304029899767258873,12725765890141964963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,10304029899767258873,12725765890141964963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,10304029899767258873,12725765890141964963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10304029899767258873,12725765890141964963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10304029899767258873,12725765890141964963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10304029899767258873,12725765890141964963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10304029899767258873,12725765890141964963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,10304029899767258873,12725765890141964963,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
395B

MD5
33893b0c2cb41f1589d2f37560abe74b

SHA1
b39c456415b6a6c8c669258dae6a6d15b43ed93d

SHA256
a13af0e826f9605972b1498f3e5485026b959cf240491fe3b21d5dacfe5a8127

SHA512
454da02cba78b83dfc82c41c6c0699bc1014bca033a653fa785378e8a911e7825ce0d476c384fa904fe2c49273d4490f0f51860b28e5ece002c19df3d68233c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
212c7f8f2fa10ef909d01785747f64f3

SHA1
6314d4a42e20a849d37d682acbf79e2427f9bdbf

SHA256
8305e43e7585100c813841de8eed5e80f744489218db3bbe730ed6a18949084b

SHA512
b1ca7b312753ce29568de3f1b96d22cad6f90583767269d7c3c6b7a306e0786ac261d11481eb777a842288b67e79745ff7226f3ac1fbb562c67e5b527363c633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
74b7defbdbcd417615008beda56eb3e5

SHA1
1aaea0e40502327afa9e3afc8164d5e4c3df641f

SHA256
396ab8fb86cc4c70fe3a76cfb4618fb463c7168e4ed233b93187f5761451d443

SHA512
7d863e29cb7b370af81feb019344f11d8cbe7686acbc272c8b6dc6e0ca7b8547c81efbbc1d48cbc17958ec86b6a99ed54e7866507871cd7d4f0cc1dcdb45e675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a618781e03e37409b26d8ac665301f8e

SHA1
4a3a60d26c8be20085a9d104f55f11ce29eeee0f

SHA256
4da1b3e24143e2e8ae8bb85532ad2873fc27a971cc181f3ac5f11009d1a04aae

SHA512
94c4cd7b81b4b740079a5a2b79be8448a15c0f5627a2bc0ba1c54a2e692a60544e8784c2691f261c471d8d4350dd4cd200b98636e6842e8fc70ae858e398c1e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04f2232aac40e42152e7f86ee518cbb9

SHA1
b84ad0893aab3a9d7aa74b227ab7472a25fef12c

SHA256
35e905b6b6a28497be881fcd920b73484c17b11138ea458145f8b7d9f223f586

SHA512
00d8669d5c43d24fdcb2a486b35fcbf3349b14a8c1a7c5051fc7b13305d024c9eecdd68e004545effe7486d30c1bff149c6edf00d7213bcb6eb01dedc570720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d9e152a199944969286ed65c5609779f

SHA1
7592e006aa6f71c8439c538cceebde5d67567b4f

SHA256
b933cd861b7670481151ae9e4ef29c7642fb31ad48e854c779777f1b49ad3846

SHA512
3feba946c423d9250eff15bba81037990453eb66d8b712acbf85d3030dd562812916f88c307955cc96e1299211f9a0985167732402910a4365e0ffd7087ca98e

Download Submit