hxxps://app[.]scalenut[.]com/creator/0949634a-1605-4afe-9b10-a6bd1dcbde8c/kj8jd9r9do

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://app.scalenut.com/creator/0949634a-1605-4afe-9b10-a6bd1dcbde8c/kj8jd9r9do

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: lottie-player@latest
phishing

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
68	ipapi.co
78	ipapi.co

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
4416	msedge.exe
4416	msedge.exe
5880	identity_helper.exe
5880	identity_helper.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe
5772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 4000	4416	msedge.exe	83
PID 4416 wrote to memory of 4000	4416	msedge.exe	83
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 1252	4416	msedge.exe	84
PID 4416 wrote to memory of 2472	4416	msedge.exe	85
PID 4416 wrote to memory of 2472	4416	msedge.exe	85
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86
PID 4416 wrote to memory of 3120	4416	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://app.scalenut.com/creator/0949634a-1605-4afe-9b10-a6bd1dcbde8c/kj8jd9r9do
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffb397546f8,0x7ffb39754708,0x7ffb39754718
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1148 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6616 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,5926635860067708945,5280880501599035434,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:1256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
cde9e185373ab7fac5ba116599022fd8

SHA1
a230bbf9f30e60559b0dd6aa99b57c12b7aeb244

SHA256
80181e346fb4bbec44aae13a1f5a3c3f85abead71821785b1797e926f7a28cc2

SHA512
163fb2d6985aafc10d33bb35f09fa14afb3f1b4b5901d60480a2ab47459787523198b9f053f3abc08428c3d55da5e4996746bbfeffcb982fcf616223dea8590e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b81d9666915a0200a5d4a620dc343d8b

SHA1
4c626ae6f8245d945bc0af93643a2d449db3c0af

SHA256
bb45650997a19d50bb1de16594c2cfc4264233b6a1df0640d71c026e4836b756

SHA512
a2e45703d0c66f713d87a121d6c956570281a7322adb0fa49382670f81f8771f54ded5734e64a747edae33b02c9950652dce05bc93c5caa62c435d6a43b06493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_teams.microsoft.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_teams.microsoft.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
e778ae6e988374bcebcb807704e8d198

SHA1
fa0dbf8828dd69f7e3ef238e2b35cfc7fa8c07d1

SHA256
636e431be59d865e418c320edde2b79423d1d2d94d60a35ee8b679ce130b04c2

SHA512
4cecd6c530f5d95c363387d918531d4035e019ff09971e66cdff4a9cf2762613989a68318138c4858b43197114b0221dd9eafdee325a66a5479b66a8fcc3bc8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
9bea0fdba6679e9fe805cacbfacb6b7d

SHA1
b0af4023a33e02a8eb3ab114154e046b692d0967

SHA256
2c8f3e9e71f1d60f8371a2a76f4c56dee6f41fe5f4ced4578359de7e6312d17d

SHA512
002dba8283f96a85ac98358f590683136a4e4483b98750b60d2ba233a94fa2d7174e8fa8369603a307b5980b16755af8add75f3162e84fe85409d9e24a2ff3f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
4efb17e4b99c7a4033d567144ef6dbd5

SHA1
4daed9906218686bb1e2ac53799c4bbb12619500

SHA256
7a9f62a580125f0e5dc71d2eeb727cbd561022de8df371590f0b7f1de5ab38e1

SHA512
7812ed093d30e83385d2270998b2d8cbe50e0b198065a3ccfe72d47469db8cd74ab41b7d333fe30a12ec9f1686d576ba9fc6f574660ad0a32abf9d61e61d94e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
493c713d46af6dbe4e05db9452488aa0

SHA1
7020a42c99f376a49bd176f4f4fe0d33c9fe7059

SHA256
1507ac93c471f9efa133dd169dfaf665aa36d0c7f1da2edea8f3bb8c776f27ca

SHA512
24f1e10dcb365b1737aa04133007d138eb2d25fee75c7f26822e83962a5414a6c6f0773760f0cd187b858242dc3b09b25a0e3556b653a86c54761c0efc71e62a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
67f55f169d0ed11baa6ace4ad2d32602

SHA1
96cadbbd7afc90f3b33214079876da4e97934094

SHA256
728a62a510dab1cb3cac7b238d2b69cb72a72d597302d5ca443e4f91e4f7b4da

SHA512
2d952fa9b73ab8b0443961381bc040b5d8e83abd5212df38fb5a3116e43c30f9ad88ce231604c00a5e0ec33a43d2cc683b4a7fb9cde2fad420060de58f1898a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
48cc3947a82dc68bb106e6848e1be679

SHA1
bcd09c4e49165c1c26c5115c8c84b8fe95127a3c

SHA256
a7c5f432039de5f687d3019401f6a4dd1ff7a53d9016416b6144e598569224bc

SHA512
38873b7d0d6ef4ec39a017ccdf79f90d7c648a1a8237c3baf33a04f58ee4e633da70ab008b6ee7985a062115443ea5db2818aa220433618ab4c822371fad63e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\691ff029-6d85-4caf-baf6-a5e987048ef5\index-dir\the-real-index

Filesize
96B

MD5
84a59d6110f6656f39073b7fb6dc2464

SHA1
b25241d7dfac345d7bda9bad0bd04b494d15b460

SHA256
ab4e2173d1aacab4af5aba62d547a1a7eccd99f8329db68a9009c57b6971e322

SHA512
e2d17c9c8ee5f20cf8ba0a42e906bc7ccc32c8e28d57164b93df980935776d7489bf69275c2acf7302d88e249ba2b10adf978a98d3cf2282224dde3c37fd3d69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\691ff029-6d85-4caf-baf6-a5e987048ef5\index-dir\the-real-index~RFe591766.TMP

Filesize
48B

MD5
fbff9c099775ff7c4795b1994f65eb8c

SHA1
0163cd7021de8710836e9eda6f701c17ad2bb516

SHA256
07ae6715d8ae4ce5b7f03c964507dd0b1ed46f6572267895f27bdae691e9514b

SHA512
bc736b8f37976ac738c7bfd86c9d229cf3559af356ab7e76d4db328a9cd4674174a2db217142763ae81213500dce11041960554c69ea6b92370d9b3ceafba150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\b898e1ac-bd62-4d38-9702-f6465c108422\index-dir\the-real-index

Filesize
72B

MD5
3ef960940c02a9cd71459d977f9b50c0

SHA1
3724223963544b5cd9cd36f927c33e62e7ba8344

SHA256
bb2f5aabbb936a22afa50a277f9ef55a6257ed50b6fb572a9f53e1123db1f295

SHA512
2f7e15b9011ca2086e7390a7cdb63245619c3be9749644840aa67139b8c058a8571663c7d844e430241aaa395797f57e67f0dd45070de6b70ed22854afa23b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\b898e1ac-bd62-4d38-9702-f6465c108422\index-dir\the-real-index~RFe591776.TMP

Filesize
48B

MD5
86898c48395fc5dfe6aad505edb3fa9a

SHA1
0a2fd8ebbd5e730c211c643013d76ca757eae8db

SHA256
3e720e4815fe8aa351d0aadb90a5605c05382baa414f1634df0972faad5191ec

SHA512
a3b19df1fc81c61af1180b322fe65b2d5d17681a5680df6a3aeb2fddd642c1030e37e62e5037ff87f549ce91630bb590ad51bd41c72d1507708f7e75058571ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt

Filesize
107B

MD5
a53e69874c8b6d5c1e5a18ec3e6464a6

SHA1
e71ea0e6fc0a15acd20ab24258e20bc0dbea8688

SHA256
0e58af64902a58941609f32eba35f0e379a8496e9963e108102a90b4d802e397

SHA512
3fd16ed169c5bacc237908dcf4241cc794ecbb2d6706630be1c1f55fcd3bd87c70c83ac9619ae77f3d1654d5dac6de7571084a87861994938ee245b7c7bd29e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt

Filesize
181B

MD5
7fe1fdf26b8fbbcc832ba29dbf1ffaed

SHA1
1a4dada70e0e8f8b2601c00f8b11450463ffaa88

SHA256
c6348d41f7306ba50e60c54b7839669d026c9f5b12a14b1043d7223f524c6f31

SHA512
f631b359aaf3f4a0f73d61259dce07e733afabb35dce8fbc5d62a19f4334f076937012d1e37019c9753e26c1a24fa2922196ed9ce0de263eed3bcc5e2f132438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt

Filesize
175B

MD5
b630ba89687e14966f9cf3ab281fce08

SHA1
e3f33d85196c3ed0439560efae19c8e7db4ad3c8

SHA256
decfaa1a1313a71379efc28234e3b9c3c9dcee27a7d77070e73b7093f9bfd141

SHA512
f1ad9a8674589cfb53e6ef228143402663a258db71ca27a215db5b09f81e2dba7b3c01938126049f75f99b9d1a7c3f32cf8ec49f4462f0efbe71b6d7683aaef0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
56ae75c8c5a415d1f4457ac642536d15

SHA1
b606befc3279ce4f31584f4f59c13bdc212972b7

SHA256
21e3d7f45dafaa4ba0b8298a10fac78fca04da83ea706b55dea7cf6ceac7665a

SHA512
4cd3a5e76d61bdce826084303f6363b1b823e45b0fe36c982dde385dc1019c4a92a852d1edc69958d9af32f83df4d7837ad2b3aa26184d9cf3161e6bff69ad35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580356.TMP

Filesize
48B

MD5
375d600469c22d8f73159615b2fae643

SHA1
b9a5dea19d3775a65efe61288afc52043c83e46e

SHA256
4bf04cbda76526939f9f107d06af05d38458fc4d9d25ad7645d5a3a31beeb3d7

SHA512
228e3dc448dcdb733936e1660e899282d10bb9cfee6c3dd8a801236ea1876f8e3a5342b46b874f8f295e6bde98d74e49f8974fab9c1d37ceac3da391d4a7a4db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
9b3253c1ba87d336b5ed4cdb6a321436

SHA1
58d80b9de338d4609eccb9ea9cfda79cb4fd9145

SHA256
92a50b2749e13b531b669a139e46f8a29d67bd4b7ec12bb65e26eeffe1ec965f

SHA512
dc1c0e97b8de61ed97a44960d0d6a4d30243e25a2520d9ac25d6ee86f70a6d2ff8bc39fc647838587815c44d66ad23b1fa2afb462491c844f51ce9ebbc8df541

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
22a15104946c216c881f54cc427fe0f3

SHA1
9574182ee1c92e8179733f18bcc780529d365ebc

SHA256
70e7b2a93d406cd01169936f0a73f17743ede9065dcec1be6fcaeb7448f3533e

SHA512
aa619b27d7e3550f924504faae9773fa2eb410e3999f921a88a034815635cface7caa90ee76e20c268e7b81ff7101ef2700ed90503d45675283befd5b134dc23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
f5618116cc111e0da678519c9a1c82c4

SHA1
826d14233cb23573011acdd05c668c2aca863032

SHA256
fe8bc23f26ff3588c8e19ecc5ab7e08b882aca02361566a7d5dccc6548064c61

SHA512
8fc8ef20120389a67fccb32838b1b44f22a8ef5e5e18974b79d80f1a2fe8cb1b4dfeccc6f74d314ad6265a04648523c5ee3b7a741daa1a0716f7144748ae40a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
dcfdfe00003a198aa464553ca5129e51

SHA1
5b528c540c33626394a21f1c7e9d51b4c54d01e2

SHA256
887bae863307d5838cc1f0631c16f93d06909d54f4d5e12211ebd8233b4faaf2

SHA512
04cd0e3ec75426111da0c68348445c4d704f49ea372eb3f3fe1184de0b7ec6d661b9353e10f3e9c452f3d5766df6c66d0ed248a6d159273169e1091ec7cdd707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
08d0a3ab1286d1f7fc5aaadf75f6a4b8

SHA1
bfd76434789db674000e585a10655a6bb454b737

SHA256
7ef904c5977c28b932cce5148a5a0ab1700a3e16449dc9276966cb9165cebfb2

SHA512
8409b28145d4cc1635368fed545a1dcd931330bef950694b53b7f25cc20e8bc8dfe5542b0198d0a3e5c4e0fea720a5f688da0436c3064446457c908b70ca51f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
45bd2dd203b863eeb31715809618eb59

SHA1
cd9dbd183ec6df11513af86dd80dec24e9932ad2

SHA256
f9edd1f45b4d3518e1bc7bfb23a660e17acff261e06a2f9ade3abd5e1b96b928

SHA512
73074fe947ad0f352412a8c7f3af189cdac89fb04c740c5e8db89522b7bbdf9e896fb16569c207263ae8f828c29f1d77b3defe39a5bc725f87e6c5a334917d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
b8d843f579f9368cd78b32cb71b8e5e1

SHA1
adaff1c9844407e9962f1d3b42bfb95b9efeded7

SHA256
6d59dab13e09cc3781424a3a09a8886eee46c7dc3bf54ed481145cd2d0b138c5

SHA512
ab0b2a3443119c252ebe78f6f4394d47a407e611504744361e79fb6b6568dc3be233a3e050983021f743362c55db2f8d3a805392eff821d69ff15aad0204780f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ff40.TMP

Filesize
2KB

MD5
11b600c65a6e029591b250ea0b2f4971

SHA1
71955734a30ee725ac43fbf79462d2f20e2714d7

SHA256
ca36b50a89375d6f9d0adf4ed2c19797ba06ff2f2a6ab9e3ac63c8954b71cee6

SHA512
e5a51909e61ceb948f631de15c6afa08c376844d681aaddfda9620b232e2d84a386fdb7efc8f815aaffae4e6bed6f4abb148118686cd64618fe378b3c9b39d87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d9b68e4118bd0c4703d964918d505c54

SHA1
faf5019ea8d8ebf41ecf040007b474005f90bcdf

SHA256
82179e56b9997d1c13c2caed3d5fa2024cb6608c22c444cef038fbc2e24b2520

SHA512
4f01dc52bb6abd36d44802776d25afef18ee57360cf9edc7685d57810e4a593f2916cf716984dc71ac2432ffabf6ec9749c347d4a39855374235a1f146d053d0

Download Submit