hxxps://www[.]dprojects[.]org/minios

Analysis

max time kernel
7s
max time network
73s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2023, 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dprojects.org/minios

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1580	1528	msedge.exe	15
PID 1528 wrote to memory of 1580	1528	msedge.exe	15
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 3984	1528	msedge.exe	54
PID 1528 wrote to memory of 4136	1528	msedge.exe	56
PID 1528 wrote to memory of 4136	1528	msedge.exe	56
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55
PID 1528 wrote to memory of 4504	1528	msedge.exe	55

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dprojects.org/minios
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe091946f8,0x7ffe09194708,0x7ffe09194718
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,10193847843809663135,17884238771985814411,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,10193847843809663135,17884238771985814411,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,10193847843809663135,17884238771985814411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10193847843809663135,17884238771985814411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10193847843809663135,17884238771985814411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,10193847843809663135,17884238771985814411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,10193847843809663135,17884238771985814411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10193847843809663135,17884238771985814411,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10193847843809663135,17884238771985814411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10193847843809663135,17884238771985814411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10193847843809663135,17884238771985814411,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10193847843809663135,17884238771985814411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:1912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
64ef7666a5007074aba6ce01b9c928f1

SHA1
e954f9aa64f40e8ce0c9bc1a68124ebf14d99ffa

SHA256
6c5900f3dc95d88e10ecaf03cac05bb4d232ad863700830a47f7ee81a08eda5b

SHA512
85e3492a84575e74718ff417dc92ea770646a0b4b9257145716d1c1f08b0d843b6af78ddf32b936599d21f61f12925e37bf6d509a917bc05e03ccef77494f6ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wkeys.net_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8a3049010c1ebbb289a145914291f58e

SHA1
5b0728be20aedc54bfe650f96a0f79f0e5176a7a

SHA256
ec6b4eae19cff396c40a85d199be31c60aeedcef16cf42a3cb2a9ef65054648b

SHA512
b61f1025ae0336beae2606a61c19517397f9e64db5b9e682cfd6776d507563984312ef40addc1838ed7e2632b2a1be95c5087719615779dbe128b745e5a277c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ceb7aba9a503a877755e9ec9159b3f8c

SHA1
023bf5759bea713461797ee8ee894b8adbe3b882

SHA256
9920dfc0fb297ad57b8a232d890b9dbb1fe776638e2e0c99894c4578b5e26764

SHA512
9fe1854d51196465ce597a8224beacad14e3ac44be52380eff91423ff01628e59b5ffe1796bbd825acfc459e07a65029a76bf60c7d15dd177ea5073a971c0043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
969fe92c731190d2e4f92b3539c3bba6

SHA1
c9f7e31818e370470a0e804dcb73de31b5a4588f

SHA256
26d2400a4713046d047630260357b03cdae242d5de68466784df6d2cb2f42019

SHA512
64b9db7378dc1364eae907b395a70047a263efc51763ab1d01493556da37195930be7f41613298126dbc096acea32c772b429260ab9f74e246e6577196d2cb3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1fcc7a85b043f168c1c59913254d7db9

SHA1
d2704d49a308c4555b6ae7e32550bed023a020d1

SHA256
4c1e11f8813a8c2f9fec3ff2f248b441cac315a560a44e23572cb937b42fab24

SHA512
266dcff7dd9e59e68e0256d3c96aacc578f8be875010ea731adb2c87534c97c0c92f21d6632e841adf6eec0f2124eecdd23ccfbf1d7b020e3249d96f5b299e31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3a748249c8b0e04e77ad0d6723e564ff

SHA1
5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

SHA256
f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

SHA512
53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2277e6f1d4218a915b5641937ff903f8

SHA1
258234aea285aa66ce452d1c05034bb4e65e1990

SHA256
f210a7aaf9d18972a54ad7380ecdc95f799504ab27eb3934c7d1ef1c459a7935

SHA512
3a0f68805835cdc13aaf9c03eed24b1f02d71a5036c79788b5786a0787a7112146a8dcaafa04f41b670416cf92f531394a59ac06f2e93d347673e8b293b07cec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586ada.TMP

Filesize
1KB

MD5
3148297d7e5a5dac234ff822b40e77b9

SHA1
063d30d86f7fea964eabc8e67d9fc1de3bbf69cf

SHA256
6fde28bccb045171cfd1dc0d2a578a9345a3c73759fe38e270cd4f4da7a534d3

SHA512
0264bc3a5f50e284f6359c1ac16782ce6fc92d2a386090006b244dfa5fa0380f446db967c14323355058b9c6fea1ca9b461c644740e5813febce871f88829cfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cada28dc83ad8111ef390cc67fd05096

SHA1
032cbeb268810ec68d7ed8f4fe8f0c1742596b9b

SHA256
b48faf4b4d308e0fff925adafc310e07966eb3bda75c5ae1d921018a0594cbb7

SHA512
89d335a8cbc513ef858b58b47b31e31abc81ea57a704f4b6904c173639880e149da78a73ee30a03a9acc2f63913505fb6b09c2a21ffdeb0c50811f818022087e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6f054f3eba0265844ec301b7f3ce0b01

SHA1
b763a9abf324a56fa36861b1051c9deaedbd96cc

SHA256
8e371f81268a035400e5b6edfa2926e8a025d39fbfa1f29ce73c2d36957d1e92

SHA512
c5b0a3ec9737a20aa16ac658e9b47aca8a1f41f6ac20ba6d3354be3773a7394bb7ee1d87953cd4fbdfd8361a62cc8b8b92d1591836b858f6d40b01142326ee12

Download Submit