620b70438ffe23ed78165bb22db9ef4fcc5467ae43657fbdb48749d8d25c9067

Analysis

max time kernel
122s
max time network
180s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

piecharts.html
Size

2KB
MD5

fe43af52410cb56fa3ffe1b9cf9ae4ec
SHA1

93aa905516422f9904e25054cb16030bc21d7362
SHA256

6197ed6e2e0cce7c510e3de197373b8b763787519d9967f32dad42b21a41f1fd
SHA512

0bb7f5f360f25d1a541b427647d55b72bf98407ffb3ffeedae1c232bdce6f175ac55e8fba7599892531e6eb78f8f22771c3d0341d602479d4ddd9184eceaa676

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C27C23C1-6573-11EE-A164-5EF5C936A496} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402887705"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b00000000020000000000106600000001000020000000afec4a186bb5641c51fe477f259b2644ea08e0998e14e013cc8691f398c65804000000000e8000000002000020000000526e03c292ff416fee5de2cbd01cb128fba5a1195916bae8bbb1da4c8e174420900000002d9d0e1b1973a25247b94b32bef7e13f5f6b72c6c91514834c6a8205a1abadfdf8242ab1f70a6b6edcabda38a7a5836369eb801e8ddc938cd8a643e9e7b9967a8c2cac4288f8be01d31f62d0de8eee1751b2b1602e36786135017c5bdaaca1479382d1854f2e517037e153957976937e97eccd0bf1cf92d80026e3963ac0995a2bd1e9cddc9683bd9922633746d8708840000000fbff2273bf63226ace326da29d56c0c000ad5ae5dfc3cbc59d98198c5caab49635a5a743c205e8b7f815f5be6903e933d4972497ed04379d5210385292c181a1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506c8c9880f9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b000000000200000000001066000000010000200000004e63f7fa65d4150b4283c1dcd6982ea46d8350819d322fbdc6717849ad83e151000000000e8000000002000020000000f1dbddaf600446018272163b9bce1efe1492d9d646fc0ffc8b5af33b510036e2200000001d3c1d523001809f057e2a1101c271e1abb66006222565d0c5ae3a5e87361ff5400000009c781235b96ca2ea8e4c2013b6ace1af077e26f8633212362d2ce3dcaebb45da2030b194ea911cb7887bc51073a5d8a45e861f3fee867a9c0123a641411b2381	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2664	iexplore.exe
2664	iexplore.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2024	2664	iexplore.exe	30
PID 2664 wrote to memory of 2024	2664	iexplore.exe	30
PID 2664 wrote to memory of 2024	2664	iexplore.exe	30
PID 2664 wrote to memory of 2024	2664	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\piecharts.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca62715c564a51bdc37544f1e8b58345

SHA1
fcd68e534a9bd2cae5050a5943bb6fbef321fbc1

SHA256
8eab2e2259628f76fad68932dde158c512dad08c4f808624963ff099cd8837d6

SHA512
4304895bcede0f9d437adf7254b2e0f8def604b28126e6316e6facde4218599c5294828e02dcf9bf7b4d512a45b8128e15bf2520fb2ed2b29834d19c8fad1dfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34c79461e124cfa8a94eb4f3a88ee405

SHA1
5450a7248ec842afc460ebcd1ad5b7dea8580de0

SHA256
20cd5aad44cb76962d46cc545c1d5f40a8471240849902b41e23fe240390f74f

SHA512
28dbe2f89a688e2710498c78eb2c456dd6f7e641b3fb8cd6306fa6d98d4de17accafd9939e6d2092ada8ab8af0f461fead23e560f0b7f6d71e346c30da6a8ed0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c808fe0b27d061a33bc2edbaf483cba1

SHA1
1e7e7ae1e1444b04d31f0f101eed6c0d5496e6ce

SHA256
d9585f478b29220dcc1eae650eb8891f512d30526a92ed8c792f3bf9f375803c

SHA512
0e93bd260d1c4fcbefa66c217783f2282715fa2ccfec8d6e6fe5fe962ed6386d0b16d64b3cf66ac60fff9fb9eba2d65f72596567ec0d24fd0255dcf502a9663a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
930a734bdb72873cc3eacc301bf28e85

SHA1
a3b4d0b0dc60437cf4d0f9e71ce073d3b7cabc76

SHA256
80949ad5c4351eb153a149a219d23104655a5380b91d62807e38d70927e31fe1

SHA512
b78ec3344df50ceb87b1d6e134ab77957f7ab3b5aa37c8ffcff6b9029c7f0a8830c1eaeb7518cb2db814eb41b9341bd629300377b93588eb8589c8054aa9505f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47981653f6f9325f7131ee6fb612415a

SHA1
b09a21b8e0a63b8c3e330d54879d0744a588099f

SHA256
c9bc14cd4090c7b897e64933867050ad139e7949726f09651661279083d830f7

SHA512
4b7bf6364efac4c68ed047529d98876acce3dbc2d881f2acaeecfecebfdd11a680ac70656400f92534a01d87b6551ff07549acf5f2c1e9dda79da45e6b4f164e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d737c71d893618d9011721ad76cd8687

SHA1
b9b1b48f9434bf8cce213cbc75eaf63fee731063

SHA256
e5cfb52df996fb5573e6a1746905ad9f38b17abdfe831fe0f5db2ed225f44c78

SHA512
ff31e9f129042346a6300a28d33c192a793b0808fd18fca14492bf2e8059b78fe4e7b3cf85ab58fc0d18b7ba49282595199fccd2afc28c2f3b500fb3e35473c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12cab8603a1afaf95468e8a73fe872f7

SHA1
dc2e73878920a9bbaecd7a7638e843f48c58146f

SHA256
6456f947706ef64a18fc6c61e5d2710776265b6920d5845914d7b5ecf3001974

SHA512
081f3e927ac757e56263aa66e0fc4af44fa2da0a07ee895cdeeab4a51036a563885d75bd5888b08c8ed40a4a763b042d92e333eacb87c8a265e2803be9978ff8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a385c125b97f9243ce7d14c36ea86c1e

SHA1
c04a70639b52bcda466da9e74b40ba669cf7a288

SHA256
1ac19ffb7e7d849b743728be3fbc4e84670098922851825bc21c453d313ffdcf

SHA512
7702a333b886d04f59f4db85628489c7a75249c0af7580a80bb1dad282aacbfd9705ca5fee325787df22868fc44f12beead8d0b16a056b4b310fc24fd90db7b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42d38ae9a8618b33a744e2e839fe167b

SHA1
91cd4a1991c10bf4ee7b109ec968faf4e0f0a3f2

SHA256
ec97a0302000514d0611b7ce900e58ad89ad12681adc80fb0fb7072cc96ae989

SHA512
a06c1a233b25c4b912f9ba2d6b3e70ecb217d09e1544b91c88415b6d49c191d11ed783e17d86d1bac38dddd3fb5769662632e11c9ecc54345c2dc2a26e31f2d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93ec7953602bfc01e31aa6a79c51cb17

SHA1
887e6e511370cecd6837db0a20b0dd98a6c57e3e

SHA256
e8de11c43ecc2baa70d111e1eb7e8069f35613e3f1f8e4f764257d970a1d8a8c

SHA512
0f57abff332e13485b7b28be9583b8c064a2a34f781cb2bc169772a5b09ae917635fdbf104001fd8f64c269a2078d270c8a573c5939b17a6fb4d8f62b8beb21d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4062689f3ce064bcb0351d51513c4b23

SHA1
5ef7d2b1d00a189f8def0fa0b79e02b6860fbceb

SHA256
77c0f1b088a431fa50c05d029f058a4bc74ff1d3be4f5d6ef3e1d402e5464e45

SHA512
d4b5ae57b35b4f67f945099f600e22552bd8f0ed443e004460d531a5238806f41e57c27aae3ae0eb9b9019bab07cd5cb6e8b11fdfa253608a29d5503c4fa6e63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f444884ac33a87d7fcbedd9b1c0028f0

SHA1
7587b64c3ae88656526a0169329fc0b8329bf4aa

SHA256
4119034bb7986996641d7268c93c638ffa0e3332b41824243cd9e17b4f601629

SHA512
f8ad0f41d325279019a3f551d2367b48c33206829dd180eaa5c769a15c9611e4fd32823c60ae6373f42ff67727ae69bac56f5b4b38b8f767d1e5abd771438488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b68b1a0b28a824817f74cbfbcc7340b0

SHA1
32bea1e31903ca55a38eaf4124eb1267cb67e5c8

SHA256
060f2fb980e0dc37b6a62fc3418689d932a5c0a54a9a53adb1677ec8b79b4b6e

SHA512
a4cc3efd5660bc7a7e88c11e9827b1792a6941260e60e0d3f022a492067e5ee0f9300db7b8e849f8f176e6fc9f04d78a50e0d96e7eee4de75391e14ceaf95db9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b795d8837cabf444a039e9c9b9a01842

SHA1
b56dd0b15e6cd8dc573f2d80d8c071eb185b7fef

SHA256
ca2398fd7361f28514751d9e10827590d2738a6352831f112af48a2ad8075f05

SHA512
c049cfb9fca2c76d35f34568e65649b27f7b7f3b9d3b05c6491e36fea260e16004ba4b56dd1d55dc30642d4910fdb1457137f7e92acb0d683d41705203e6ebde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7de30b63fda4d86a9159bbf6ab1f8981

SHA1
7cb585e874e6060ab377117f6cd74487e07d0d8b

SHA256
e370f0be01649642e16140e67bd7974638a3cbd216ea0c80b19d56032f25c767

SHA512
f1bcc9ed7ae3e7f8a20369b3b494fd33c84b9741c5c721096f971d1ebd94dc5bd7b5e7e4885c236533214cf044f4353a719be0755a0a8b2fe99eb4e3102cf16c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcd5b694dd66f8409e4b4a9264dddd21

SHA1
8f6b3b5a274327d82355388c9932b5149d53cc51

SHA256
92821684df9b00dbcfe3ec6de0c2fa8fc5a2755b7ace43a340a5aea4f675b4ca

SHA512
0fac7ccdc8eb1d0ff88953cb4f9bb65ffa6074673a1c66d294719b7e6fa534f6ffe84aba0ec81d28f27da4be176a8b4136699ed6db8f5778342c319a24c1c590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87a2b755727f0ce1c955a9c0a327016e

SHA1
f9da255e2e2da5b3c730f60feb30862dd1a5a154

SHA256
caf73aca09c585fa1f091dc04cadda623b3b5ada144e596ec4a1f4dc970a19fe

SHA512
bcaa5c5b09361783defa6a5c3c6b39b5d7088e4950a6c14c7bac44edb05ae1fc4c14d47f817827915b987a5f73640975ef143b60f47da0cc467a3788e5e26468

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ddbead08c63512e02d198ff03ac865f

SHA1
7894ddb37dad377f2e39667287d6b646e29b5b20

SHA256
61ee4f669a2d1bf605063e56c75950cf95b75f53cf20aa39676fd84c70990da4

SHA512
915958552396f55d584d778fae02e821e8b688108a7548773f0651d69cd00db1bdbe106c34b0b5b3b344587cc522e6dd082e75b1c378a37b2bf6a274f353fcc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6A8.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar766.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit