hxxp://tsrpcf[.]xyz

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://tsrpcf.xyz

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2212	msedge.exe
2212	msedge.exe
1516	msedge.exe
1516	msedge.exe
2688	identity_helper.exe
2688	identity_helper.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 1932	1516	msedge.exe	88
PID 1516 wrote to memory of 1932	1516	msedge.exe	88
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2136	1516	msedge.exe	89
PID 1516 wrote to memory of 2212	1516	msedge.exe	90
PID 1516 wrote to memory of 2212	1516	msedge.exe	90
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91
PID 1516 wrote to memory of 1068	1516	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://tsrpcf.xyz
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff814c546f8,0x7ff814c54708,0x7ff814c54718
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11043932393387497430,1813848146474796990,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11043932393387497430,1813848146474796990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11043932393387497430,1813848146474796990,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11043932393387497430,1813848146474796990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11043932393387497430,1813848146474796990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11043932393387497430,1813848146474796990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11043932393387497430,1813848146474796990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11043932393387497430,1813848146474796990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11043932393387497430,1813848146474796990,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11043932393387497430,1813848146474796990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11043932393387497430,1813848146474796990,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,11043932393387497430,1813848146474796990,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11043932393387497430,1813848146474796990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2924 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11043932393387497430,1813848146474796990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11043932393387497430,1813848146474796990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11043932393387497430,1813848146474796990,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
190B

MD5
bf4072f178d5242c5781510b22dfcff0

SHA1
56b4f1b44945c22ebe874fedde4d3080546b5dee

SHA256
ae2a8c83f22cab93043de13c954e5e1ff30915fe8139fc07f66c7958b6efa207

SHA512
b2aa160bdd65089d7c3f2a68d94b36b529eb90b1da79bd0fd32198c93f9290be5b078ce0ea2341a7729983ac66a190596d200a16030d0d486bb8dd955a301ce9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b3b002ee88b588d9b16c5d216752b7cf

SHA1
576f4c07eefdb3e84623f5c078384face819914c

SHA256
4414d7e10d8ee5b31d2bfadec14bb62e2d618f2a87f814359e53991c8cfe8a4e

SHA512
43c07aade8e2c9b7d135348d9ebf330d951b5e3b4fbdce555d7760e04a57dab11baabec69faed1eef54c9b01a884d92121a3dbabcb19a030b216702aafa56789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5e23d3478121d572b202be2eab98e3b7

SHA1
57847a3c9e6a8a8114b726cb5bedbbc9a6227a17

SHA256
2da7d89fc74f43a27e24c26d4adbea024cd6c5a05fc6a344f538516fbe273d59

SHA512
f894b13f3e7af3ed70227fbb93532cedba94735663af92f32dc86f4749132711c19f63b5312344787bc01cbfcf280cd913c82c7afb72a1766fcb917059632eaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e2d4561a3ee57e6497e758ece847ca24

SHA1
439aecf95ce80d632ec082434e7a4b3c91c4e896

SHA256
1953891557462b7dac41e4939294a94cb1f336b65db33d077e853092e427cea7

SHA512
2522de6abe3e4108e74c27dd6da4b5ab725aa0bd11fa513055bf7a2a9fb7a206cf64759869bb5114edf723a45b61753a2abde1028d0f7fbd13bf621d0edfd8ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ea6b74e61e1d25ae5e1c00646258cfcf

SHA1
fc3f45fba0dc02758fe001a4f8ca45ba9e7110ac

SHA256
836bfee369a88dd7821272681866e6ea65a455aa7b6fd4390563b658c7ade187

SHA512
51ce4b8a276843494e0009fa7f96d99d4014ac7103b6d7afe855c4db7d83fcc50b7de3fac5e1f09de73cc6002dd0cfea2506ce9105477e9246eaee999e128a42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
677c969fa6bfad608c1d36dbbc439fba

SHA1
e4c70c3c32c0c741525c7a5bc356101e6adfa9a8

SHA256
c88dd7b5abc6bd16163fdb0cf0ed65f181ca54dac20cb450b6d3e48accec5793

SHA512
ff6e8ccab8555e92bdde126cf9dbaefb6bdc1e124f9ceef1ad0a2fc9641077f5b8f11c396709e8ed90f58761f93dcbcb5acb98160fd1a295f45192123551524e

Download Submit