hxxps://www[.]virustotal[.]com/gui/url/37fb7f07ba194b17379cd69436466f0386b48bafa8306a96f2f884f583f4c0e7/details

Analysis

max time kernel
194s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.virustotal.com/gui/url/37fb7f07ba194b17379cd69436466f0386b48bafa8306a96f2f884f583f4c0e7/details

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
1360	msedge.exe
1360	msedge.exe
1752	identity_helper.exe
1752	identity_helper.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe
3800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 232	1360	msedge.exe	82
PID 1360 wrote to memory of 232	1360	msedge.exe	82
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 116	1360	msedge.exe	83
PID 1360 wrote to memory of 208	1360	msedge.exe	84
PID 1360 wrote to memory of 208	1360	msedge.exe	84
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85
PID 1360 wrote to memory of 1816	1360	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.virustotal.com/gui/url/37fb7f07ba194b17379cd69436466f0386b48bafa8306a96f2f884f583f4c0e7/details
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85d2746f8,0x7ff85d274708,0x7ff85d274718
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18028839422806660716,3750607992916194294,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,18028839422806660716,3750607992916194294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,18028839422806660716,3750607992916194294,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18028839422806660716,3750607992916194294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18028839422806660716,3750607992916194294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18028839422806660716,3750607992916194294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,18028839422806660716,3750607992916194294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,18028839422806660716,3750607992916194294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18028839422806660716,3750607992916194294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18028839422806660716,3750607992916194294,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18028839422806660716,3750607992916194294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18028839422806660716,3750607992916194294,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18028839422806660716,3750607992916194294,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4660 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
47a66c8e680ab6f326182a82e846706f

SHA1
a7ad0e8e0aba4b5a8ed9c51e7c39dfdfde945254

SHA256
e746af963240f61ecd03fa7d3954b90924abddb7ac245c2446390b8ff85d2510

SHA512
e0921ed9fb45c14b40a1dde1384f55dcacfb57c9ffcc9ddab005b7db5ac642116dfc1f447c5e2d37ca0e3d4f85f62a1dfb04f504a37c51a0c08d179613272933

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
57a497fea2a76892ba2f5443ed5bf1e3

SHA1
87e35239138a2840b5ff66818d542431a48cf929

SHA256
8d82a98f91e3b178d97aff833f8387a1f261edaed35d7bcda9ead71674fbc8d6

SHA512
525b8662ee3dc7fb82353707173554b7962dec50578f0e95a409adf4ade0afc0bac35167c305e15c16e8bbdcfbe4edd0a9bdf45eb954f0941a3f1c2d5ad31020

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3886d567329882ebe0daadc7d3c517c3

SHA1
95c552c82b98dd7350bd2410f25045d8af47bcf5

SHA256
325eee1952f2dc12d89e892ed7287b767ef3714116d2dea585a91725a4e0eb65

SHA512
03418e406ac630716eca7efa90c143f66841eecdbc0acd635a24e58d270d12710f6c220b7b581636b25ad64bf2e172bd673c63b7de274643f7828a73d1841fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ab4e9de946106fa31d0ef8b9efcc3b2a

SHA1
3a0488f442cc84fb6ca63b212d30c6c7ffd8d4c5

SHA256
2874e96ffa7c461cb0d8e562c7f2a2fe293832c29fe30b97996354f0b2d970e9

SHA512
7a07a426ce69c0a04380f31fadeed194b7a89ab5152cdf6d4d943a9a708edc5ff310a8f1b741bd1c4c0f67a16911fa66df2e50244c2f252b4745913f86716bb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c47e83e02d7a3132f60b869bb8458e3c

SHA1
4c5ba251e854dd7d6bd3c5136ff7a26e84ee038f

SHA256
3e799dc07035395ee57652895b560c99e2eae988f5c4f25d8a89e1f3de07d52e

SHA512
bedab596f377edea65a0ef689a0b6fcef62eb0794875dd73e0cd075061a7606110ef855b52b394e311e3829789e25fc6e3eb7acfdbefedde1bd0a4707ac611e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57b016.TMP

Filesize
48B

MD5
d40b118018b831482265adaddb1fac18

SHA1
5e53bd3a90425806f1df0487e0e182e15ec2f147

SHA256
8b6d92380199fa81d395441bdb1da1a6e0ed509bc75426bfe60c78af31bef083

SHA512
433862a6c7b50d4f95e84bf59d1b3e2bd22317225321cda43ae52a8bf4419b21f8d83580abeec861827f3a94cae9830d94dc4bf3e7a6fb574eed72f0c1582e09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e52fcafab4f19f0a96afb7155b9d7ce4

SHA1
ca913d201d3f5395df30197b71d8478c84a6c517

SHA256
4bc4feb8c6d9a0d171114d349801eeaced5bbd7c376b68600155a8dc14f4a62a

SHA512
31ad8437de2964589f81af21a9caac83defa3055c80dfef98538883ad3f775fb883df5787790b5b156617dc4cdef084f142ee3c7526c51ac9fea5ec7684d763f

Download Submit