hxxps://emails[.]fx-markets[.]com/e3t/Ctc/2K+113/cCF4R04/VX6nYx7yqXM_W35bcsr7LQ4L1W3cF4jk5l6-N0N3_3-Hz3lYMRW6N1vHY6lZ3mQW5z9zkN3nSp09W5B7-Yj8_Tl9hW8kz83W4C104MW3tlqHR21vN1JW8PH__J477QsZW5Kqnbs4P-7PgW2hQPdY79Q2-GW7wSSZm1VB5PCW4BgJDB1l_P4LW33pXyj1nCJXcW7WHhqw96_J4NW47Lm3778H301W1ldsSB46Gw4XW2_HR135s11wNW6f00GY1TXsffW8TMVm-3QnR08W98Q1mP5y8qmZW3WdWdx3jW6x9W31w-cg1JQhgYVGkH6n62QwqjW7jwS-W7zkWDvW4wTRF13nqlQGf7TgGMn04

Analysis

max time kernel
31s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://emails.fx-markets.com/e3t/Ctc/2K+113/cCF4R04/VX6nYx7yqXM_W35bcsr7LQ4L1W3cF4jk5l6-N0N3_3-Hz3lYMRW6N1vHY6lZ3mQW5z9zkN3nSp09W5B7-Yj8_Tl9hW8kz83W4C104MW3tlqHR21vN1JW8PH__J477QsZW5Kqnbs4P-7PgW2hQPdY79Q2-GW7wSSZm1VB5PCW4BgJDB1l_P4LW33pXyj1nCJXcW7WHhqw96_J4NW47Lm3778H301W1ldsSB46Gw4XW2_HR135s11wNW6f00GY1TXsffW8TMVm-3QnR08W98Q1mP5y8qmZW3WdWdx3jW6x9W31w-cg1JQhgYVGkH6n62QwqjW7jwS-W7zkWDvW4wTRF13nqlQGf7TgGMn04

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133712069572631364"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe
Token: SeShutdownPrivilege	5004	chrome.exe
Token: SeCreatePagefilePrivilege	5004	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe
5004	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 744	5004	chrome.exe	82
PID 5004 wrote to memory of 744	5004	chrome.exe	82
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 4624	5004	chrome.exe	83
PID 5004 wrote to memory of 2080	5004	chrome.exe	84
PID 5004 wrote to memory of 2080	5004	chrome.exe	84
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85
PID 5004 wrote to memory of 1560	5004	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://emails.fx-markets.com/e3t/Ctc/2K+113/cCF4R04/VX6nYx7yqXM_W35bcsr7LQ4L1W3cF4jk5l6-N0N3_3-Hz3lYMRW6N1vHY6lZ3mQW5z9zkN3nSp09W5B7-Yj8_Tl9hW8kz83W4C104MW3tlqHR21vN1JW8PH__J477QsZW5Kqnbs4P-7PgW2hQPdY79Q2-GW7wSSZm1VB5PCW4BgJDB1l_P4LW33pXyj1nCJXcW7WHhqw96_J4NW47Lm3778H301W1ldsSB46Gw4XW2_HR135s11wNW6f00GY1TXsffW8TMVm-3QnR08W98Q1mP5y8qmZW3WdWdx3jW6x9W31w-cg1JQhgYVGkH6n62QwqjW7jwS-W7zkWDvW4wTRF13nqlQGf7TgGMn04
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe15eacc40,0x7ffe15eacc4c,0x7ffe15eacc58
  2⤵
  PID:744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,2089940566224305883,7292798563195334249,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2128,i,2089940566224305883,7292798563195334249,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,2089940566224305883,7292798563195334249,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2396 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,2089940566224305883,7292798563195334249,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,2089940566224305883,7292798563195334249,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4384,i,2089940566224305883,7292798563195334249,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4824,i,2089940566224305883,7292798563195334249,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:4472

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
5ae664fb2321b215b8acf8a690d3dff3

SHA1
71aed7135d1150a5dc5ea986db966cc96eb0a8ca

SHA256
ebf13f58ee33cad7e2f74538180ef45d51bfb82ef697081f0d06c871d2c6ea8f

SHA512
7461e200898b05c6cd1e258a833479eb2220fc716f337892f55e530d54d7a76e64ce885226b71178f7ae0ca2ebd22d7b704eb8decf3e3032369bc6d629ff55d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
9fb38be4a0f0caf1ed247e7096e2a9ca

SHA1
e544e4843653771d79cd7d06316c0857c13d7179

SHA256
ffa3801e8321fb470a9a7fd7e05f22978eadae5d100391562ef557ea21da3b52

SHA512
2a737065a0d46831b3e6c095d28cf78303e9f03985e6de9fcdbe3c60a576f716a0a0380b7da5f422b8e3c6b6909b420048f26dc392d427c75cf0d384d431582b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
d077d484f3e83b7b766977a61d6446d6

SHA1
85288359dee16f1dca36cfa292e343db733dd91d

SHA256
da9f6e1bdca750084f0aa8d3ca938f083702b3abb1fccab3265bf608b401c7f5

SHA512
2ca4bcb6632f5c7bc40ffb0078a2d9d3028a2246412041a0223df8653fec75c2d83400154e844f06a00f19dd6ece19cd2f5e4cd9fcecc170f14a18e4c0175b67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
32e0d145173d3e887ce223e01a149c43

SHA1
904b3af235e3bb85b23dc011a74d65fecfd65b4c

SHA256
5e239608e1ee557c99b7bf12b4871700d5c84690cb56cdbd27d58b803271f3f4

SHA512
85b7c1350b8d66ee348ef8c8d36ef9c24e775875cf5e5c83e9643056e7639aabd535f00aeb4e2e5694a72d4d0bb1354056835fffd4a0745095e63da2467fcfbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e312592c77f81832b0b2b1d98548486b

SHA1
c8032da7da62b44d25d0378fe1e8429b95e3e7a1

SHA256
5a95831f3e1d4a8a198b96f5ffa5034c26517ed4e332cdeba459c820cab195f0

SHA512
c6c0de69e471ccdb7c9e273225bc12e50ae1212d89fbf50a5520cacbd178eb0f9225289362dca62adddf662e3420f00c3755354264af63805559fbfde63a4850

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
106c7a939610d726854d14d99cd2197e

SHA1
b8bcb0756f1c1a29e87c81bd2eea297b616d04d7

SHA256
609e6273b2b66038440d5f07b5795ac9c31a3796d4d5eed82b1744178fedb64f

SHA512
d5b078d0d6a961c8a20ec2635c2db7a47ca94406e65e27348c56319cb3c4cbb5bd17348cb93d053a78a1b6af19a6e0a89e3d33a57d7bfeddcabc9ccf3c58f009

Download Submit