hxxps://www[.]tourismandsocietytt[.]com/i-ciclo-de-conferencias-magistrales

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2023, 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.tourismandsocietytt.com/i-ciclo-de-conferencias-magistrales

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
2152	msedge.exe
2152	msedge.exe
3224	identity_helper.exe
3224	identity_helper.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2864	2152	msedge.exe	62
PID 2152 wrote to memory of 2864	2152	msedge.exe	62
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 4092	2152	msedge.exe	82
PID 2152 wrote to memory of 3732	2152	msedge.exe	83
PID 2152 wrote to memory of 3732	2152	msedge.exe	83
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84
PID 2152 wrote to memory of 4896	2152	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tourismandsocietytt.com/i-ciclo-de-conferencias-magistrales
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8541246f8,0x7ff854124708,0x7ff854124718
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14957473874947904086,5914702956353632668,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,14957473874947904086,5914702956353632668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,14957473874947904086,5914702956353632668,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14957473874947904086,5914702956353632668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14957473874947904086,5914702956353632668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14957473874947904086,5914702956353632668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14957473874947904086,5914702956353632668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14957473874947904086,5914702956353632668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14957473874947904086,5914702956353632668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14957473874947904086,5914702956353632668,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14957473874947904086,5914702956353632668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14957473874947904086,5914702956353632668,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14957473874947904086,5914702956353632668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14957473874947904086,5914702956353632668,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5f5369274e3bfbc449588bbb57bd383

SHA1
58bb46d57bd70c1c0bcbad619353cbe185f34c3b

SHA256
4190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464

SHA512
04a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
27KB

MD5
038d7de6e915f46d3e84acd8c9d734d3

SHA1
21015a337fad36efbfe137801ba2acd542e875de

SHA256
5e15a12a648f505b01b2076bf02ecd0a5e79dd1364e685c9f245bd21cfb42e3e

SHA512
2c0aef4805d9612dab7c14684a490bb5132d78894d5a933c9aebd703c69bb692379513dc9b226732c189be23bce656baf082a5418219c0852d5b5d200d15fd08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
13001de5da31324c3292fff61b85f5d8

SHA1
99164e99fb7a7be9a9eaaac625863cdbe27e57d9

SHA256
31b6336ae43b45cd7607272055448dff6c96884de844d28614f45db7f925e995

SHA512
26ae7592c2802da123a0954d4f0e524ea36e5492a7dbdd390e926edcb334699e1c3ea1f60c17b00342f05351f0c14dc936e81e38ffa49ac9ca36253104f0d914

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
0ba81aa7acf64bfe9e8282f15022d108

SHA1
f5210a9907dbf60160e1548dca3db57442b08830

SHA256
097ddda6c2a4625264367de612a44bcaee7675914fdabb4bb6b4ca05db4c5060

SHA512
c8560dd25ad6118edf90b26f1d327214c8b1eccc8b7cf6719924aeace5f7b4111a9f9df8ee8b3443d6cee423be1e179a442ee32610e205a721d875692503b92b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
cb938fd6f57677030fd8137c0ad26b3d

SHA1
ec9ec5b8a1a9fa2f78709017922fae28df3d46cc

SHA256
cd99a725a858209ebcea2a79cf1323a3bab21c009ae4546a4b27bc078d30c370

SHA512
b9d57d2e736637cfcfeaeafc7aaaa8d6766a5dfb2423a77fb3b49169f68409d0feb03bc3e904e2793365f2a7da409ad9e5605fb93fafe807a05f1892e9043c37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aa5991f579bed6dadabee4218cb93121

SHA1
491eaf0e2c3985bd83f671342fd1f20c12a7110a

SHA256
7a1d62db4abb16cbc06642e3ad5c024c8ec56e02f7fafb7f2c2a6fa6d900dd10

SHA512
be924467e0dedf7875ef220c635c0042a5ab6facaa33f45c2f522da6bd609fc939c9398d363ba5a8aa9b4c1098e727c4ce1620f6ee59f4c44cd9dda001254091

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cda2c42378761b0e23333a35870cd9d0

SHA1
d92f60f8b02a88245a6098973a35fab8a00c1873

SHA256
2506a21b0fc8c24a213a245cc1febd210b3eed383be223a8c23b7d8b37008151

SHA512
1ccc41d76e56c9ed5549722d02443e89a7c608215fce4d1fe953aac60c41447a1ff4aea863fd5c9535f2504e140abf3865c60dd4c2f9a07e0694fe4cdaff042c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
29213338df67d29d6454ee5d61ad3970

SHA1
8c69ca76a2e639060d5ce835a9600e6ea3764a83

SHA256
d29fc0d97fa74d382d0f557ecea4e42b7d50dbce43915bfc0c114c16e532aa51

SHA512
14db25eba8a863d390b97fce4315402ed7c249598ff6c31d5a191b0f71c274eead42ba0658403e744110de072e6ff1cac3bccee1e48875bde6b1fe39a60d2407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cbe966af0297b17ef22cd987145cbf08

SHA1
942656dcfda7ec0c4b2a3bb001129cb945047892

SHA256
02127d830e16ee9523d24591b4868ae49453f6cd303794f448bb2bef6c4066c2

SHA512
213bfa22948d77a7f3c9e7787f9aa48349eea7975b96277dfb75aae00e91cfe36ec5ec4de7e35ef0fc3be80980c48314539ae26f98df82a6c69cd3d161cd085e

Download Submit