6e84ea003b2987f5b3350cced94eb8ec5a50ed7cdd33ffae2f95f4d7fad4f3c3

Resubmissions

22-05-2024 03:34

240522-d45j3aag46 1

22-05-2024 03:33

240522-d37b9sah6z 1

Analysis

max time kernel
78s
max time network
74s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dvd-video-screensaver.html
Size

29KB
MD5

a1dc8ace8bcb14c4d7f3e411e3891e4a
SHA1

1c2cabf45e32cf84dd187808a60fbc1261dc3998
SHA256

6e84ea003b2987f5b3350cced94eb8ec5a50ed7cdd33ffae2f95f4d7fad4f3c3
SHA512

b17543e6243bd326dbf862042616d53713bc911743d22a6f2ddfc5c72f838c0beaf236d787b4fdf27fe773f220793109aa8f03eef94487cf6cd056b8b0869837
SSDEEP

768:yiA1a3fGqiD57beGK0aXiAEzqw0uM1O9sbeGK5:BA1a3fGBtEXX0muM1O9Ck

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

668 msedge.exe
668 msedge.exe
3436 msedge.exe
3436 msedge.exe
4884 identity_helper.exe
4884 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3436 msedge.exe
3436 msedge.exe
3436 msedge.exe
3436 msedge.exe
3436 msedge.exe
3436 msedge.exe
3436 msedge.exe

pid	process
668	msedge.exe
668	msedge.exe
3436	msedge.exe
3436	msedge.exe
4884	identity_helper.exe
4884	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3436 wrote to memory of 3032	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 3032	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 1076	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 668	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 668	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe
PID 3436 wrote to memory of 2520	3436	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dvd-video-screensaver.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c3c46f8,0x7fff8c3c4708,0x7fff8c3c4718
2⤵
PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10969329617328488639,12876750870069673371,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
2⤵
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,10969329617328488639,12876750870069673371,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,10969329617328488639,12876750870069673371,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
2⤵
PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10969329617328488639,12876750870069673371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
2⤵
PID:1324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10969329617328488639,12876750870069673371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10969329617328488639,12876750870069673371,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
2⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10969329617328488639,12876750870069673371,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10969329617328488639,12876750870069673371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
2⤵
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10969329617328488639,12876750870069673371,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
2⤵
PID:408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10969329617328488639,12876750870069673371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10969329617328488639,12876750870069673371,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:1172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,10969329617328488639,12876750870069673371,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2216 /prefetch:8
2⤵
PID:1120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10969329617328488639,12876750870069673371,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1472 /prefetch:1
2⤵
PID:3840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3268

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
851B

MD5
1cc5fa69009d30bc36df566d1f52a233

SHA1
b8629badb910b1e23923873f64da9cb3274aff60

SHA256
667bebb219f4892e076ea5da72e9aa720d763dfd32be8af3bd38fd4d5fb91272

SHA512
c35e67393a3fad8bdb24cc87ff02f27056e2784c3ad853d76ba507a14a84bf0bcf4346bbae4af50e18bf31a2ca30533bd33b893a77be489d4885d2a4e1c8e783

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
616aa7c739bd33dde7222d792bb2a7bb

SHA1
3b69f2aea6dda1899235699e14a77f35989ce2c3

SHA256
d3e5d03707d762d6e78dacbe1ce6520ce3c830627fdc4050af9ba41a98116006

SHA512
c4b04fcb7ac9d4ad533d2bad9d80a8b0b828f635a0c892f1219ce43c814d23b693be3958348c124c54790494c715c662d8c97617b0c4b81118f46846f64d6ee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b011bebe1f3eea73f635cd47a85ef245

SHA1
4d351b04911d07f7504d3f7aa118f707618a4944

SHA256
e59f8dccbf4bb64f57125fe7f3182d44d505875896de1b7c2f0431fe0a55260b

SHA512
55436ba9f52a6495ff798b4456cc01489850ec474b4623ec5e9370578db7d84f01047b5f8400f97bd8af413084817dea27a1632b91e0bb154ff0f60778b8fb07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dd047679-9b74-421c-9050-c78b1ec7e794.tmp
Filesize
6KB

MD5
a81df0b659397b3513d005dfbb5940f3

SHA1
86d75d50409b291824e8ffe28c8cdbde5400497e

SHA256
0743f424bd86ba47dccbe92033961b5ae3835bfb7f0a18edabb7334f064dcae2

SHA512
ef836622cc966ace2dba5013ffd4df2297cc65a2456c2699241e3d3e6825fba04ae31b9e76edf3d5d9b44146b6ff7b9583042c5bd4993357aba41570cd1fb19b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
eff30ed32c13ea58c43cb6778fb34c1c

SHA1
72716a548e5ee26d60ae5e37462278cf3a1649cf

SHA256
1b271ffbe7346df17871d3f32ac65945c0e40b8305babb955c673a9002c4e5d8

SHA512
da1d9044d77a6073778e8ba70a2c061381a8adbed201535cdba119cc50609bbc47c7ba707e5552714c3d1bf840e51de02a0289aec32101db46a845d13b802361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
4481f497d7b9128632c01a1cacb31aff

SHA1
71d075e3991e84dd988bb44825bf1ceebe6d1541

SHA256
2703bab88fc046f83641ee69f87ceb34ff393deedac470c960b77a2b89e63e0c

SHA512
f03a1d756a3b64c2d2797733c635bfbc0ead428d78db293a97d241b9e2f5dd443936bd410eb27cbde8501669f8d0352882353fec46140c597e27a5ed1fb1a715

Download Submit
\??\pipe\LOCAL\crashpad_3436_WMHLOZKKLVKJRXFI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit