hxxp://Automotion[.]com/timer

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://Automotion.com/timer

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2500	msedge.exe
2500	msedge.exe
1284	identity_helper.exe
1284	identity_helper.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 904	2500	msedge.exe	85
PID 2500 wrote to memory of 904	2500	msedge.exe	85
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 1184	2500	msedge.exe	86
PID 2500 wrote to memory of 2432	2500	msedge.exe	87
PID 2500 wrote to memory of 2432	2500	msedge.exe	87
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88
PID 2500 wrote to memory of 1264	2500	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://Automotion.com/timer
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe67f346f8,0x7ffe67f34708,0x7ffe67f34718
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,15961600272444900104,17822784772130002545,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,15961600272444900104,17822784772130002545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,15961600272444900104,17822784772130002545,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15961600272444900104,17822784772130002545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15961600272444900104,17822784772130002545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15961600272444900104,17822784772130002545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15961600272444900104,17822784772130002545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15961600272444900104,17822784772130002545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15961600272444900104,17822784772130002545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,15961600272444900104,17822784772130002545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,15961600272444900104,17822784772130002545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15961600272444900104,17822784772130002545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,15961600272444900104,17822784772130002545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,15961600272444900104,17822784772130002545,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
99b6aac81fd0630b891d495431458050

SHA1
51dab2ae9855b603ca2e4a462a126afe4a7cdc1f

SHA256
456fc52bb4be03459614c7719e635e2e4d24d89d809b5b5d6201387fafb63984

SHA512
2fe4269ba1008ff6e77887393a50d097c9619c48c80ad4fed6be056616df01bbedbe8b050f491cc188f2b13bf226b75cb1787386a5fc693d9060ce955123d863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
972B

MD5
cd090ec42008bb91c506fa2dc2691bdc

SHA1
34048b9bf5cd15cfbd7513821721f111cd6b038a

SHA256
66e6c2607ce68c312347a9491fcfbb999878397fa62d02aba7d6aa51c1d04087

SHA512
a0dcf635357c536e44558c38b05a3a00863c37075aa2e83ec76ac402954e92043d2f7e33610160da03fdf1a79ca1152e49a6391de18e21b8d5dd442e4dd65b5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8a5eb8bf22dc9e2b0a3e642fa7b6c5e6

SHA1
ae15ec9321bf60100e4afe8881569a2e67ad6c3e

SHA256
970796c790ad168cc51671b7bf0530c70379ed296050580c80a0eacf2d1cfd15

SHA512
3ef175c94593eb69609ed153249076ca0f64ee2c4aa4a847b957936bbb0262757cd2a98784a4a2896a9112fa6db014223f5a3687c3c606c7ad1d7c969be44630

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
31b8bcad3fed3a8f9ed236974c7eb2f4

SHA1
d841c73f4718ab74870f62a72d13fa64cff5a9a3

SHA256
999e1ab5d12b21dab1d353a4f9fba08422d8cb0dc7e938b6d9c2b46f93bd6354

SHA512
7215e475618bbeaf0843effbed87e83b9ea2fa06b236635bcc8dcabee93842da62148747b2bc23559052d0802650c54620635b1d2d642bdd984f68cdafeaaee5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c8e02ef58953bfb776e86a2e322afb1d

SHA1
a3d9c22f4a4f11e7d17ce48ee49a80e8952c2a72

SHA256
88a2e65756d3ce68f48d082426b35463672b632bb3cd4d3bd1a6cce8383ff830

SHA512
5c068299dae7139cde024fac4ef034be352e5586b5c550a1d89449bf52fe24bfac4377d6fc1fe705fc6f7061c8da688bc0395c84f4d70f272f4497d9b3c0a077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f472.TMP

Filesize
48B

MD5
5965080a8451db9c4088bf0ed66abf41

SHA1
c52a9c7f1d748b56f414be7a0ecd3725a24d7ea4

SHA256
0ff68f1af6b402b1ccc85907cc2e472db709d3928e052714dd4b9a148714de25

SHA512
5b6964b3236b118a3b20d2110e4369f7bcfba5a7e27ff184490b950c2c921bcb7ec9cd2a1006edd717553bfb89f9d05dfd8097a25edc144c5defb08979f70f5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
806af8ec9754dc20a45915c482df8bb4

SHA1
05c609af18d7e3790fec69b77280a29ae21ca6fb

SHA256
6d60ee534ae5fc4d066c892dbc28bc2c8ac2c3729fc6caaf69593e55e7c2c0ea

SHA512
ffe80f12a99b0c5b44ef6846b430864a7581ae74784165708e016180959c8242c9af2638e16a4cb44c83e2c43c074adf524517c4cfa1090989a59485fd040c9b

Download Submit