0ec87e23086f2954dccd869ed920c070a200ebe5592e41ae9ae1c5cd8013d8b3

Analysis

max time kernel
1799s
max time network
1688s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2023 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

disable-devtool.html
Size

6KB
MD5

52e11736d611c09aef6081ae8655387e
SHA1

240254d8a05b2da8fa268093d6d8f5e5e53d7c5f
SHA256

0ec87e23086f2954dccd869ed920c070a200ebe5592e41ae9ae1c5cd8013d8b3
SHA512

4d66419e762ef0b85fab9fdb10bafcd070a7998d5186e770b1269e21d65debe9c10f9157b9deb08426b596689631d8a08da2817711caf06147f2975d4ea229e2
SSDEEP

192:1d/tFvaJB5fqAMbRe5P8CoLzBIqgD+5PHUhM:jlF5rCoLzBIqN+M

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133248917994422784"	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

452 chrome.exe
452 chrome.exe
3316 chrome.exe
3316 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

452 chrome.exe
452 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe
Token: SeShutdownPrivilege	452	chrome.exe
Token: SeCreatePagefilePrivilege	452	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe
452	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 452 wrote to memory of 4684	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 4684	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 948	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 2236	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 2236	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe
PID 452 wrote to memory of 3248	452	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\disable-devtool.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc97cd9758,0x7ffc97cd9768,0x7ffc97cd9778
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1788,i,14455907569957007358,11499087310466366863,131072 /prefetch:2
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1788,i,14455907569957007358,11499087310466366863,131072 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1788,i,14455907569957007358,11499087310466366863,131072 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3208 --field-trial-handle=1788,i,14455907569957007358,11499087310466366863,131072 /prefetch:1
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3216 --field-trial-handle=1788,i,14455907569957007358,11499087310466366863,131072 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1788,i,14455907569957007358,11499087310466366863,131072 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5160 --field-trial-handle=1788,i,14455907569957007358,11499087310466366863,131072 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 --field-trial-handle=1788,i,14455907569957007358,11499087310466366863,131072 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 --field-trial-handle=1788,i,14455907569957007358,11499087310466366863,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3316

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b978bc33e2f93862d75532294442a17c

SHA1
e5971509067829d12f85f99674ce88a3fff8b6ac

SHA256
15bebb22987e00a4072fcaa4f0dcf0e47ef59c2c45c3d935365a1308b5da936a

SHA512
8c37a7e1d5a2ce2fc145ffd6912b13ebb13ece7154d6dda9e739a030d366dbe8daf045b56eeb0aef541f854288941f0343149425f60797e099ecab29d29a46c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
536B

MD5
5ba7f8b1446888a756689f969892f5a2

SHA1
187025aa2ede9d4ff5a7a623089344fe1a4312fb

SHA256
d0bb6f56749612603497a864e7fef1d9a8103a8123e087ccc09f56db43719f2b

SHA512
7e10ecc720aa59d72aa5b568eee7ea31a1b13ec3f53138f7e4cc53e26408c8441992ab39c8f67783c64adb9789f41296cc425eb481ce0fea0ae59eb19f56e8ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
493f1ce2c9bdd555ca5b8b6b911ffe0b

SHA1
4dd62ec58b2d188bbec31c537998b1d5d216ebd0

SHA256
b79d0f63ee0fccbff43acb11b70d0270885c89e05bc0aad40a1822c9949b3da8

SHA512
2835c2c2d656163882f92cb985bba14e055bf55fc26559dc0c08790aeb57b23f2708af278e99bebe7f9e8d03098b5e3bdc962241b3b621f53df8e32432f787b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d25ea2149f0c27c91cf2c56c33e28070

SHA1
c5275fe263a0de28d1fd273ece44696967a017bd

SHA256
a26be8e87b06cae7745cb0c8c8858cf7718fb6011d08df398e51f1de30562926

SHA512
c40e720ad50fa06b0399093517c587b80fb4adecf8bc10ff6fbeae412e06b0bb591612042d6f5a602c9d1b2de7660f93ff7da22a6f9ed75e2bafc38045b66a71

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
d4a04c6f9f2329b3147d19523febedb8

SHA1
4d6d144371b31ca4c0facb84e4a8e747b0ac03ab

SHA256
13afc648d3a0173c80a5ef1a698a1842d57156b934cc419bc71e18f14784941f

SHA512
c929a169df7ed4135b03ef0ba9799cecf4dd68ca9d9f14b4b8b44e39fefaa94c3fbbd3ee54b794d33f7702a38d61b517bf5191e323d0148edec0108384af609e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
173KB

MD5
9a584cc78fe07afe203463f1bb724eb8

SHA1
339f801f62bc5a7978118f7fd905bc81a8487a1a

SHA256
30d937b6fbdfdfec484d8300a586fc41720e653bd4df18fd03e6d778ab597dc3

SHA512
82b989cbaaac96cc7afc605db9aa988f44c90568ff3c19dd2ec4434a69c9a2bb09c45988bec500b2aa85694ea9cedf0b161e3f700275a6b82b1dbb11b5cbfa19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
\??\pipe\crashpad_452_QVWESHISVVYFADCN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit