hxxps://drive[.]google[.]com/drive/folders/1iS9HLpa6Tov_lbA4ZWExrWge7M9ndJPS

Analysis

max time kernel
33s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1iS9HLpa6Tov_lbA4ZWExrWge7M9ndJPS

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	drive.google.com
9	drive.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3684	msedge.exe
3684	msedge.exe
3704	msedge.exe
3704	msedge.exe
836	identity_helper.exe
836	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 3560	3704	msedge.exe	82
PID 3704 wrote to memory of 3560	3704	msedge.exe	82
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 4664	3704	msedge.exe	83
PID 3704 wrote to memory of 3684	3704	msedge.exe	84
PID 3704 wrote to memory of 3684	3704	msedge.exe	84
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85
PID 3704 wrote to memory of 4840	3704	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/drive/folders/1iS9HLpa6Tov_lbA4ZWExrWge7M9ndJPS
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0xb8,0x7ff83e1046f8,0x7ff83e104708,0x7ff83e104718
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1281217764963110466,12472990324140623360,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,1281217764963110466,12472990324140623360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,1281217764963110466,12472990324140623360,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1281217764963110466,12472990324140623360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1281217764963110466,12472990324140623360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1281217764963110466,12472990324140623360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1281217764963110466,12472990324140623360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1281217764963110466,12472990324140623360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1281217764963110466,12472990324140623360,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1281217764963110466,12472990324140623360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1281217764963110466,12472990324140623360,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
27KB

MD5
97f07e182259f3e5f7cf67865bb1d8f0

SHA1
78c49303cb2a9121087a45770389ca1da03cbcdf

SHA256
c3a70f23a2cf331852a818d3f2a0cf7f048753c9b47aa4e7f0fee234c46b226c

SHA512
10056ad3a71ee806a8d8aff04d513a079568bf11799016f76f27c4255be2141a4c2d99c1f46bbfde9c99ba0f8b44e780a92b59f514d3cc1c248ead915c31b5dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a929ce5fb8fb33098f4b626a9584320e

SHA1
5ce5c6c86a92a99d671a4237975ab850164502e0

SHA256
9b51f29fe86817b38084ed461ab5b0dc385996dcc8bf96eb88110ac6b8b265c5

SHA512
2e061539a300cae05a51387742def3ebc990221b2ae0362b39c126af0e079a84a6ca8d13fe073df4393f5d45bdb0b06382adc41c72d19bbc6c44c8e863b7cd22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
e7f109bd2ade7dddcad95e4fedcdd5bb

SHA1
e6143692dabd87a6a32719e32a76c7f39e7c7c21

SHA256
f4104770ab8746e3df06470fe6991d1aec1312dd44a195fd3c38716f3475dc8d

SHA512
846ee514c901d8d32b57f7e502f88164b0095ab41dc9248e5e54764bbbf423e22f114d0c8cefb30fca9016533ac06e037d23a9978f2da4bc09597e993bbb9899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c4bc250f167e25c8f4c5c2fe10b6b7b1

SHA1
d05024b779349deb6e1e7eaa810052b60e235e33

SHA256
d87930883d9b8031153e5b4497bb013eed05968abb38ce7b53d7c9b13eef6730

SHA512
2484bc2d5d1fcbbed19f78aabf0f70bad7a6d7957043b211d3de44833cd67b8a3499f09f1ac55349543c0b78727bb65df10f69b8e07d2ab0fd60b6dc833b5c48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1ddb8973aaa792d37bcb35dd47afc659

SHA1
2b80c10a7eb49083c7a349e8d48fe717c433389c

SHA256
c765d07157763c097d2a5246cf280f123d93d59e35bbb8d7d8e2d55283fea827

SHA512
7d1f6f9060298554c0b9b2e840b5c94a65ee51ff81ba587eda27f0b241e1cc6f4f3ade479cfeb5d5ecd67611455cca7a108d55ddf1f055b3536c5e1a030f8949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56917cbd6953975c69787e1afa7d753a

SHA1
e30caee29410fde67266b6fbda3bd0bc52aa76cc

SHA256
24285e5a5d3084df20417725dc88d847e244d90226f6a3e68486b7c070e4010e

SHA512
75e781bab03fec617b3d15bba6e68c580eb07164e148dea89f2077f2244c6d06f454ffe701f202b4ec650edc06345e4915f1d788e867eab8c508b4a9e5d11f82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
205c6d63f4dba23ea4a923439b2fa179

SHA1
9397b7e8c9bce8b70e0af5ceab40f6fee9bcfdd5

SHA256
98bf664eece6398c45a12c8139f8e7f409097debf769e781cde22680f2712005

SHA512
5bd79610127356664ede0e62925d32688123f27fa627da306b5e4cc01d67b1a10fd744c6d78697b3a291045bddb7b97c0e46b8e338dcb9898f5725d9a1122996

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3f46dcac6cd0c75138f66875659c0f7a

SHA1
533e29ca204978cb5064e703d95399dac2e48d03

SHA256
6a886fe089f5b74cd5196be8d9557c6df971f9f26037770f3272b40e7b82cdbe

SHA512
86faba71035281eb67c1e04d1962d6f91a92e9d67e015bacfe0ce6688d16b4c62c255b31ae048a713fedfd92de7d97c4125a285cdd769765793b48abf3143c8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a930.TMP

Filesize
1KB

MD5
45ca5987b5bbb257b6266f3f25e08ff2

SHA1
154f87e212248860474a42a4409e505dfa9669d6

SHA256
0d676884fd8013a9b6fde79de7b5040e47f4ea6e766209dc10bf491066cba49c

SHA512
af536eee71303edb652e50cee0fcad273bc6685238ee02a48163e0ae3c2b5ed47f4626f9ade5d102e3f6f8de2e8b4b0431e6cd0e93484ca9c1af3bbbe28d1358

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5ad5e9cb2bbec23708be7ab49f9f6832

SHA1
3747b61953d341ed9efc64e82caed8859eae0bf8

SHA256
7b3cf8db94a72c9be818926f245577367c7905165ae23f75dc1d709ae2ca416f

SHA512
cf97f9dcfa871d09835a4ae1d98e457d8b2fbbfc5b057cf56671840e8d4173befa70f7731c088acd4162e19eb9f74c2efc99273332bb1ee34063a54c7d6f02a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7ad3db906e0fdc3c6001b32d35114c07

SHA1
c458429a4494a25e23a02c3a0b6f16512d74198b

SHA256
db5ea8746abe7522c6682aa1f5137bb25672fa37fec5efb012b96db48c5e2563

SHA512
66d5b9e1f59abbe4152e424f5df17f1d336f6e99d97e07d2d96eed8a675bb9a10a174a8a41f657f963a293667b237bf8ad054be235b53d8a311781b1b49b731a

Download Submit