hxxps://drive[.]google[.]com/drive/folders/1efGAsrPnPEls9UXx2mj9hOtFJMPaDG8P?usp=sharing

Analysis

max time kernel
78s
max time network
70s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
10-12-2024 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/folders/1efGAsrPnPEls9UXx2mj9hOtFJMPaDG8P?usp=sharing

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
3	drive.google.com
6	drive.google.com
8	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4300	msedge.exe
4300	msedge.exe
3904	msedge.exe
3904	msedge.exe
4764	identity_helper.exe
4764	identity_helper.exe
572	msedge.exe
572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 4676	3904	msedge.exe	77
PID 3904 wrote to memory of 4676	3904	msedge.exe	77
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4580	3904	msedge.exe	78
PID 3904 wrote to memory of 4300	3904	msedge.exe	79
PID 3904 wrote to memory of 4300	3904	msedge.exe	79
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80
PID 3904 wrote to memory of 1440	3904	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/drive/folders/1efGAsrPnPEls9UXx2mj9hOtFJMPaDG8P?usp=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa3c4a3cb8,0x7ffa3c4a3cc8,0x7ffa3c4a3cd8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,9616551613243077696,5104436393650118758,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,9616551613243077696,5104436393650118758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,9616551613243077696,5104436393650118758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,9616551613243077696,5104436393650118758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,9616551613243077696,5104436393650118758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,9616551613243077696,5104436393650118758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,9616551613243077696,5104436393650118758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,9616551613243077696,5104436393650118758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,9616551613243077696,5104436393650118758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,9616551613243077696,5104436393650118758,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,9616551613243077696,5104436393650118758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,9616551613243077696,5104436393650118758,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
caa848242b2d02694138d43fe2dd477f

SHA1
33ce0d2ce07bc0a475863d05b18cb0b90faf92ac

SHA256
b532e094ee67bd1f1e249dff01fa2a3ed025e364d75db3cbea2039dd1b120a17

SHA512
a246e3e286a021f8a914da8a6b440a40b879caab10c05ecc3cafa09dbb2a84d3d7e7517d43e685d4fd9cfc98a818c9eb546f2aa82daedb965d0b2568e9bcfb15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
80eb305875be87eb1b77941f067190e1

SHA1
eecdf8c0a896048f2a06ae4acf0977b615628648

SHA256
6974b1e7ea1c0a6bfe96bb161b07b6e992223c178ba5ff1b0e78acc4a7d53c4b

SHA512
8aa0212de4371f0632361fe05e49383410458290b0e9e4e28238b1465e3b19a4d55f19a9136abceaa2f7bec86aa111aa94adb5d1e4f684a7ba034be40f841fd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
05475ad387517557e9c000bcfd4e7c01

SHA1
9fb27a2f6a5df56869be8c27910edbcd7897ecf6

SHA256
eb29764e2bac7833215d247bb828dbe94f0085369a0af9fdf3096b254fbad096

SHA512
e6272de2cee760c3c0e44d81ce3f8e3bc366dc6b1a4d2834c66e4102aa567b85db8b814c400f8ed16966eab04090990c7b16f3546e523a258aa6f840f09f410f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad4bf72926e3d03840edc40a8508e767

SHA1
4abd701c2d0d2380970f1d243928311285c78701

SHA256
9442422b15e05006d23cb8f85682160d571f157acc8d398712fb96e906ddd2b0

SHA512
e899f48bc56991be66d83eee9a66411c72853d20eae2afdaf22a1c9f730cf28719218d2f6afbde2eda9efcd62fd27ed3e0d8664337b4c8f603b231d9759dc42e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6042ee8c2a3d95c0e15cb84a7943b1d6

SHA1
ce3bc30be3a530681d428fdfda4a064809568c54

SHA256
f92f00dba5eafe303162d1d5a6f14422ae390842f7d3f3b34ec1ec5ff4002b2a

SHA512
f265c0973b309b47a0c89cb88e91f730f0d6c8d6be5065fc700eb14ddcfcc273557f62d0aca03f64bf42c17fdd1a4dba1a1ead85293d25d3815e5c017fe4260e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7ed63ec056c19599da64f3ea91db18e5

SHA1
3df2c8804eeba011f2c4a15e7e6abefa91cc9eca

SHA256
ad9ed47e3a74a19d5b5ec0313b078e0e4d6ca9bd04f59f3bbc13360b5a8e0a99

SHA512
ad3e3a0f4909e58d99aeae8f6baf575f03d942117a187b0dd07f3d71621897bcdede45f0bf99b6325834449de04a62ff08260c40f70035b9e7422648170f3d0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
58055c6397b799748ed6a7fc32c96cb0

SHA1
386b856ed4708d6cd827343338bd57d717d32a8b

SHA256
07acd0754a42249b0cd443e42f68b9e7a9ba43cc93d4d36b72494eb3bb8a37a5

SHA512
a24b5cea364b5fc9e2778987d80991c1f642d23df2e8b279fb09205a6aa46393442d5c1e770bfd35bf7ec76bfbd97a8c92c669c06c7ee9b02a05a2e772eb896f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5310670904181395332d069fac4eb282

SHA1
ff895df6405d48c12d44b8729e0173a17b126c65

SHA256
e5bb36126e8eafc6a4f036035b2d1be3ed6cf131e2d5f74c9ce445faf2ed251b

SHA512
1956ac5d26837bd71a0cdf7c2e7b1663bc7031b4f47fef09ff572b7f8f6688798da50ba8cf2af79e0dbf37a122d0cc930c1295159e9e842cded90cad1bec8988

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
58afef7f467d35a834eb42e6a129c8fb

SHA1
32a65b94baffe2a53c5c99b4c93f1e8dc463f937

SHA256
25d7a9dbec9443577f12efe45baba64d3c8be61c2b4b8e39874a280af4d7d0de

SHA512
08a829e97368e7de11944a17e15ccc8934e099b412443eb188acd4da4dd3739957783fde41fccad774a9c4189037e9f09732b3a1cffe322ffb5f26f5332410cd

Download Submit