hxxps://dev-vlogsmevlogs[.]pantheonsite[.]io/

Analysis

max time kernel
68s
max time network
72s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
24/02/2024, 09:43

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://dev-vlogsmevlogs.pantheonsite.io/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "156"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
2656	msedge.exe
2656	msedge.exe
2680	msedge.exe
2680	msedge.exe
3716	identity_helper.exe
3716	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4008	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2352	2656	msedge.exe	79
PID 2656 wrote to memory of 2352	2656	msedge.exe	79
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1472	2656	msedge.exe	80
PID 2656 wrote to memory of 1128	2656	msedge.exe	81
PID 2656 wrote to memory of 1128	2656	msedge.exe	81
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82
PID 2656 wrote to memory of 244	2656	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dev-vlogsmevlogs.pantheonsite.io/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb484a3cb8,0x7ffb484a3cc8,0x7ffb484a3cd8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,4570861563837262992,10540562587494436570,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,4570861563837262992,10540562587494436570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,4570861563837262992,10540562587494436570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4570861563837262992,10540562587494436570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4570861563837262992,10540562587494436570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,4570861563837262992,10540562587494436570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4570861563837262992,10540562587494436570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4570861563837262992,10540562587494436570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,4570861563837262992,10540562587494436570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4570861563837262992,10540562587494436570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4570861563837262992,10540562587494436570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1424

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a1d055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d459a8c16562fb3f4b1d7cadaca620aa

SHA1
7810bf83e8c362e0c69298e8c16964ed48a90d3a

SHA256
fa31bc49a2f9af06d325871104e36dd69bfe3847cd521059b62461a92912331a

SHA512
35cb00c21908e1332c3439af1ec9867c81befcc4792248ee392080b455b1f5ce2b0c0c2415e344d91537469b5eb72f330b79feb7e8a86eeb6cf41ec5be5dfd2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
656bb397c72d15efa159441f116440a6

SHA1
5b57747d6fdd99160af6d3e580114dbbd351921f

SHA256
770ed0fcd22783f60407cdc55b5998b08e37b3e06efb3d1168ffed8768751fab

SHA512
5923db1d102f99d0b29d60916b183b92e6be12cc55733998d3da36d796d6158c76e385cef320ec0e9afa242a42bfb596f7233b60b548f719f7d41cb8f404e73c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
156d3803e68497b4fa433bc309474128

SHA1
ca1476719c74a4f87ec79fc506756f0e663766d9

SHA256
0e3413eb102e62b0ab35bf9d2d9f647cf1d37352406b204862c4a0cb76e8e2f8

SHA512
f99b0a982ae3f502fb08a3c0ccd7662e9557d0dfb2e222a9a1f937ed8bb7a57784636e7bd4940de88bfbdc6fea50a1965b16e2bcaaf0b1056426108aa6ffe40f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
200B

MD5
881647b2974a9ca288b1622216970719

SHA1
452f5a203268cdc9e4fedcc97fa4e193e0ee7dc7

SHA256
33b628bf53520253a3cac673ba5d1db7e7cf71a5d48685c3c305f0a8694e7a1b

SHA512
2412a77de96ffe1847d49b4e3e8680353043627fd315d40db2fc5c41d979eec4eebd509e638a3ce56bc04d51951f7d257b608d48ce502699178658b95c57e205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
292189ec83365fbf99142735b1a6c74a

SHA1
0dea9767d7a2fef95c0f0c29a0e104ddfae4993c

SHA256
2e278f59cb1a3ac49a2735c970570e4d75aaa9b88908af7ed8ce610f631388cf

SHA512
502833a251b547c8f9c6f8067ef31e4cc355feda0a6ce95e584666e9048a6d0fbc2f504eaf7bf6d3be33d3b18973497a2f073140bb83a5e7376b22edad429f46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9dc44c653a47362204ba3ba039fc429a

SHA1
1e0eef3d3f6c0595442901020536fafeb3b3fba3

SHA256
0773b0450bb6c6a102f3688fc99b3d75dfc4d72dbb303d00a6f87dd98f93e38e

SHA512
0c6e352eebfff71ec764821d690deb95fa9f941e24827bc9e53b6a2c1393202968ba016d4d7ed946b65720e86dde63682f64b8f65c7215a86a22b5c93a985266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0ffa0661d557949ec753f723f47dc885

SHA1
0bb671e53c7984cc0f2eb7d334aab6ece470e2f6

SHA256
6ba4b51902d68e111c1db15bbf055456d6b49b0288c5c85643906cc45c7c3f88

SHA512
719d6279492b2d126bb1134737a244fb1e6cfae522c7bda994424684cd19985d82085929be89d69ba09b270b8f3059192f35349842e0fd4b93e70bccc9763427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2500a01f9c72da552f23379e56d7c8c0

SHA1
522a63a0a9e0f480d8cf841841a9b33368b00b12

SHA256
bdc6ac0a3bc3db534f68c8b913a9d2dfbdc2f448b36ba517188e7de8c16adcc8

SHA512
3a800348c8c14c9396c480b2b5b256a93a75bbab69dcc59c064d91b531c4a50372a141e64b6babb29ea1a34efbcae66ab2ea4be0b48045c11422e280d6c5fbe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
da242f197e98080e0afdcf0303ca16a2

SHA1
17537585a1101d1ee6637cdbe6651664fb7d8993

SHA256
70c9784e617f56a419c1db6790743470da0cc3d04df87339d72e9187b54629f6

SHA512
a2b0f81d17a5a88d0be252017832df73cc059a5f7a618bd53cc8801dd0510e42c7da66ffb4ede14b8f6403b994ec5b76fe235b50a9f92ba0a405cb54b5e17d80

Download Submit