05335023eb83328fba353da948695ccd086b3ee339dfd247923ab7b96514b84e

Analysis

max time kernel
154s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 04:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9303a84a80ad992179510de6593d924a85207bcd28c626a8e8561fbb14dfdf3.pdf
Size

16KB
MD5

0668c1872b871d192fb00131aff3b258
SHA1

a179c77f254402eef002fffbfefbf57f888b6b35
SHA256

c9303a84a80ad992179510de6593d924a85207bcd28c626a8e8561fbb14dfdf3
SHA512

6d5548de37157996a747ae7fa10580e9b33292e44849323ecc480c3e2d044671edf4e9ecb1d098c416e3b3b80264e4c459fbfbfe6b924678d4919a12bbe65519
SSDEEP

384:/8fVsuD4nuVC2GGGGzoTLb1zM7cfZsOvcAQdQ+1DJf:/8GKC2GGGGz8b1zEcjvcRVJf

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
860	identity_helper.exe
860	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4836	AcroRd32.exe
4836	AcroRd32.exe
4836	AcroRd32.exe
4836	AcroRd32.exe
4836	AcroRd32.exe
4836	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 5076	4836	AcroRd32.exe	92
PID 4836 wrote to memory of 5076	4836	AcroRd32.exe	92
PID 5076 wrote to memory of 1020	5076	msedge.exe	93
PID 5076 wrote to memory of 1020	5076	msedge.exe	93
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4012	5076	msedge.exe	94
PID 5076 wrote to memory of 4876	5076	msedge.exe	96
PID 5076 wrote to memory of 4876	5076	msedge.exe	96
PID 5076 wrote to memory of 2600	5076	msedge.exe	95
PID 5076 wrote to memory of 2600	5076	msedge.exe	95
PID 5076 wrote to memory of 2600	5076	msedge.exe	95
PID 5076 wrote to memory of 2600	5076	msedge.exe	95
PID 5076 wrote to memory of 2600	5076	msedge.exe	95
PID 5076 wrote to memory of 2600	5076	msedge.exe	95
PID 5076 wrote to memory of 2600	5076	msedge.exe	95
PID 5076 wrote to memory of 2600	5076	msedge.exe	95
PID 5076 wrote to memory of 2600	5076	msedge.exe	95
PID 5076 wrote to memory of 2600	5076	msedge.exe	95
PID 5076 wrote to memory of 2600	5076	msedge.exe	95
PID 5076 wrote to memory of 2600	5076	msedge.exe	95
PID 5076 wrote to memory of 2600	5076	msedge.exe	95
PID 5076 wrote to memory of 2600	5076	msedge.exe	95
PID 5076 wrote to memory of 2600	5076	msedge.exe	95
PID 5076 wrote to memory of 2600	5076	msedge.exe	95
PID 5076 wrote to memory of 2600	5076	msedge.exe	95
PID 5076 wrote to memory of 2600	5076	msedge.exe	95

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c9303a84a80ad992179510de6593d924a85207bcd28c626a8e8561fbb14dfdf3.pdf"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drakesoftwareinvoice.blogspot.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdaf3346f8,0x7ffdaf334708,0x7ffdaf334718
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10078822249752140993,8380019975798736131,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,10078822249752140993,8380019975798736131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,10078822249752140993,8380019975798736131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10078822249752140993,8380019975798736131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10078822249752140993,8380019975798736131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10078822249752140993,8380019975798736131,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10078822249752140993,8380019975798736131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
    3⤵
    PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10078822249752140993,8380019975798736131,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10078822249752140993,8380019975798736131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10078822249752140993,8380019975798736131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10078822249752140993,8380019975798736131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
5bd61d035e35e26576eb810dc4fa1386

SHA1
a54fba26558dae976f1f8422a866f3c62488150f

SHA256
d427893d165ad91c69e72e4a6833ded4e77175834e8265e374f4d006d39c1a05

SHA512
7d62a695b19f467f916ae617c871aba46c269b5c816de336b8e207a68cd981415c00084f1fa9843173e7afdd234d9e1baf0ace0adf5e121a3491e32115e3ce84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
22689cf6b420a94b607c50088c35e544

SHA1
e83b6656993faadad823ebcdebf85aab2a1727bd

SHA256
f9abce34d7e1e40d7499ca0ac2e60684a20c1fa139ec5c5bfe4046dfe49261f7

SHA512
e5fea62410c367ed73b1a7b326b9ac9687435e566ec9832f2eb615e2131330c49faaefd41890a50ebb1f085ef2174dfe605a0aec95138bf641eea4bf9fec824f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f6ab0c5f0118fb423dd59e0af9ff28f

SHA1
eaeb49f0fd863d8ad06a2474d89e944c2febc508

SHA256
f2acd21dedd0fc5564d50472b7dbbcde59e4f90a102b166885475c90ccf5cb90

SHA512
44677b37c25cfffaa4493c2340f58149146a382a8d642d9a328e1aaf4aef758fdc2e0986fec846cfc6e712583589f837704a6d5412ea5ce3b2c1b0cb2e0983ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
521b783bd6f0ddff4571cbfe1d88e7a2

SHA1
e69e3f4efbd4a1b5fff26ff055b7e0fb235fbd4c

SHA256
556c6b75e64332013b2518e36a05c3c9016410450eacd25c2638dc9b9a97168b

SHA512
8b1e31702c9944baa980e5d634ff4a30bb4b2564382e17a4fcc128c889e675c604e031f7b1498aefd5c9156196e84001826a359b17c15d014bbb63ef9645c0a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79f373a0fe8c59b63a6af3f49fe96082

SHA1
57b544b509db1d0baf7f31aa22b77d684784186b

SHA256
ca19460d042e9ce3feb47d1a0fa272d2fb2302c1258cac111070a3114ef6df89

SHA512
0048bb52b36cdccd886cd5ddad4f35b0e525935fa5b78f3cf4cb5e3794a263c877ce00296b0acd3b1d4964bb7d5a24ac8c84f1510f2364b67ae61db5dd4c04cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
28572b72364eaa6eadeaa4bbbbedf2a6

SHA1
2d4aafe999c2c8d493c80dd6c5df270b1e815765

SHA256
1577a65a5ba847dd738d8aeec5f5782a5d998e11c0ab4708204d3048e8032e99

SHA512
aface52f672e3e5451ee3943d12cd1053690c23c790f3bf7e19efe1a1e2ef7fbdbf73789b4449fbcd8817ffa2df2b51495cb12d447460153f28793115dbdacdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
4a078fb8a7c67594a6c2aa724e2ac684

SHA1
92bc5b49985c8588c60f6f85c50a516fae0332f4

SHA256
c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee

SHA512
188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c4a396c349b1e75207abdd36cf4fabd0

SHA1
6a358bfd62ae7ba9415c713e4093ae28dd1f77a0

SHA256
4b7354545a2f17921dd76fba21db63972f5f6447031e52eb263c7eae4faf3580

SHA512
9a4da67882f1a03e2cae6e20dd6e98e376375e0edd1b0d9279e6ab28c740ddac9e3e7a13054baaa99848297096530bde9eb65d271cdfb2c8ab6de375102b79f5

Download Submit