hxxp://roblox[.]com[.]kz/users/15437256959/profile

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2023, 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://roblox.com.kz/users/15437256959/profile

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3936660601-1848837011-2142350499-1000\{C3D5858B-30BC-4CD2-92B3-AA4117F214F2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
4476	msedge.exe
4476	msedge.exe
4348	msedge.exe
4348	msedge.exe
3896	identity_helper.exe
3896	identity_helper.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe
1832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3532	4476	msedge.exe	16
PID 4476 wrote to memory of 3532	4476	msedge.exe	16
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2004	4476	msedge.exe	36
PID 4476 wrote to memory of 2312	4476	msedge.exe	34
PID 4476 wrote to memory of 2312	4476	msedge.exe	34
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35
PID 4476 wrote to memory of 5116	4476	msedge.exe	35

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://roblox.com.kz/users/15437256959/profile
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa272f46f8,0x7ffa272f4708,0x7ffa272f4718
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,18324446288793607243,18021368128249233341,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,18324446288793607243,18021368128249233341,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,18324446288793607243,18021368128249233341,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18324446288793607243,18021368128249233341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18324446288793607243,18021368128249233341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18324446288793607243,18021368128249233341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2176,18324446288793607243,18021368128249233341,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2176,18324446288793607243,18021368128249233341,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,18324446288793607243,18021368128249233341,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,18324446288793607243,18021368128249233341,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18324446288793607243,18021368128249233341,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18324446288793607243,18021368128249233341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18324446288793607243,18021368128249233341,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,18324446288793607243,18021368128249233341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,18324446288793607243,18021368128249233341,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
58a9ee207caef8b6881b10e37b4cbc97

SHA1
fa5f0c8626915f39161abb48df2212a79c9c6abb

SHA256
fa60e147e18bd39cb6ce21d725ef37a2072d1d682547d9f7393d3f99e63711f4

SHA512
dd20d10299a8c628c74adb51239c3869a01a731e42946f0039c9138c03524d8c8a940716226f10aab0b0c7aa230195a27e91aea54eed611c6e5dc9f02fa90355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
03c5a42a253c0aca26eca3a8f2dec5df

SHA1
e5494b68a2430db555d1d6ede5a7748c869fc5a4

SHA256
56df48a5d3a29496464063dbd20fa19406eb73aa063f7b29e957cbc806a7393e

SHA512
37c32a4d787c7bb41d9ee6feadaade69b27e425627f4039bf29a39cdce14df629795c94adb1824325279524e04296b5e4271bfbf52d7d8e43df98bec6cfe4566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
537B

MD5
9431c341136821f89c0fc197bd10e199

SHA1
a865d7d2e499e4351337ae1ac564640ceaacbdb8

SHA256
5e4872dbe4e73729a60e223ab9e372e20768dbc6db8da9d2fdcbc3e270e602fe

SHA512
8735177c1172cdbe8350feee496917cb0227fc83c01d8986e065f218b23cffe2b6177a60d5ce27acb57181226baed3bfb98328c66a6c5308508933767465d52d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
99e15ccd656d563997e9410bb1b719a5

SHA1
6341021c5cd0856a27a680c7eae9a93ab7ed8f70

SHA256
555d4e606f7f6d95df001eecfa21d2199343ce49bb9151dc6ff0932d31939453

SHA512
97b6bdfc0740df433bcc51d6ce4e56c8aefcd45084afbd5c3ef281432c7c5d182ea35815826ccf1c3cf6002cba379351b1693bbc83384d6e989f00e2de8155c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9509ee411515f63d7219182bb9b4c9f4

SHA1
0a6280725fd11043ba402396aa86035f0701ef11

SHA256
23242b903050035cf2f27652efe271540b5a018b09e2807d57246aba934882e0

SHA512
47728ae7c78cd63517acc098c7ed0feabf669f781c4fbda2a7263e597bd6b8254257d033d7f7655b45810f6bfba453f67b81790fc19459ca798abd5176189e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7be049d7c959fde1e41f35b7a720efe9

SHA1
52ad63c6660922da4e8f6adeb3ffc02c4680b5f6

SHA256
3e0f584c3f5eed5d694d28d0341dbeccd25f72ffc95dd44082cd087a8e7dddb3

SHA512
4d46689ec5be60bc5e4de95f0547bde8670a99c483fe9395f2df77e78a4f1f438d5865a024a6daecce3c0e7314d006b3e84682bc7e201e521f7c33b3343590da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b9bcb9b70046d84cf064837a6a9d2211

SHA1
fa3b54c1a10755846276eeb384942ea469bb77a2

SHA256
247a5e9c5f49863fd5e8ef3420e3e564e98dc1b8b248eb230797f97ddf8c133a

SHA512
ea2750ff220d1148ca3d8302dfed1133ecc2d28bef1a9dd075ea1ec8d440b82cc52d06fc9719c8dd0cac73396c72a12408673865436a613d9283eecc28b49bc6

Download Submit