d0d67aa3f62e8e280b6a55c9523c8d82159deab4fd1693a15b6b478d47279148

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[email protected]
Size

3KB
MD5

55acfe384eae522d3d9e0c046ef9bd53
SHA1

fbcf05fd0ad0569b4afc35c3bd8885b042832b77
SHA256

62ffd64e012a83d114bd8e15c45808773d66852ce385599a8f8a0fd5d7acc87b
SHA512

32043682d12cd10e24ea18d9a636b7f03ef688596818b1e2f15b090bdf69251fb2b69136231c418616fa95d3d3d514ae98b529c7a76d3f286828029cc574c0b3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20101DA1-6855-11EE-A059-FAEDD45E79E3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 805b72f561fcd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000119653acc8d3cd91251d6f8a6cb4503fbae206d9d0a29e75d00db093a75b2b65000000000e80000000020000200000005797b9a023866f2db61af98b20c9177b9945e931f27cdc7669225fa8d98d0d77200000001fefd8b4a369e809b804d5dc7edac873a457b524d3222d319e4f83ff80ca37ff400000005e5e0f3a740e3d5e3bf515b6932849fd8aed2a7ff77d6de2f72769f7f7f7d2abec1e39ded7c4d2188047740e01f1d3fb31933e0565079cd86b8f835db32182ef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b0000000002000000000010660000000100002000000076450e9010910056447b963c255ea618ea65eccbec5978a162f8f2ee5355a11a000000000e8000000002000020000000906059b23bf28d820659bfd39e4ad079b8bf5635dacace6d2f169d2f613e5e38900000008f0fbbc576b66dbedd4114fd3401229de59a1669d27c8296de6ec2c13f76798ad16579939ea81f2c1efd6d7f31e94628113e873bcdfc6e6a9f5502bb3b15372d9e030c92246e2963a6ac444b6780b1e713a5c5dc0d91ce0797098accb6b7df9772420572aa79960df3a859f3d1f933be126261858fa5846da7cc8c1136c973fbce49a7652ddd4d80e1cbbcef4e9ae0e24000000014fc8157ef8373c409af9150a7c6804535c0662057c5e08b4574c2b27c0485dae7da5dc09810ecece9ac0f93a1a0fb5e10902725fea01b0615011caa8f2ee5a5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403204399"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

1496 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1496 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1496 iexplore.exe
1496 iexplore.exe
2772 IEXPLORE.EXE
2772 IEXPLORE.EXE
2772 IEXPLORE.EXE
2772 IEXPLORE.EXE

pid	process
1496	iexplore.exe

pid	process
1496	iexplore.exe

pid	process
1496	iexplore.exe
1496	iexplore.exe
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1496 wrote to memory of 2772	1496	iexplore.exe	IEXPLORE.EXE
PID 1496 wrote to memory of 2772	1496	iexplore.exe	IEXPLORE.EXE
PID 1496 wrote to memory of 2772	1496	iexplore.exe	IEXPLORE.EXE
PID 1496 wrote to memory of 2772	1496	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\[email protected]
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1496 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c933193506c915e88cd4e2d780e0c399

SHA1
83cd92ffcacfe7dbad926ca105c1ea821a086ade

SHA256
8bc978e4fbc3d4e3bb01d10db175db1f4905c48dc1c36b74c6192a26b46892c5

SHA512
577660c070693421383fdf8d4e2e2c75e80fdf1343bf4f2f34ced43519d7b698849924468c1102f413087da2783fb7284c49e7a3a9e2635c4016896fe1683e63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a6ec86ef6a4a3c4a6b25edd6aa31b22f

SHA1
37ad6d9f8a402546226fb7a95f3fc3e37dae06cc

SHA256
9f3d536b9d576c57027dab6f4b00fec2b57424bb52356bed29645de62b0a7c05

SHA512
339e2bd98bb9fed56a566406f71350f3fb5d70849d2ef44b27027dc397a92e9c3deaeecffed38ad46aa666f5f15143380a9260a471802131d682e82ef6d0f1f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
342aabacc9b79f8a2551bbab48bce92a

SHA1
0c0de9589e1918aeb61878da8cf7b18e43da27d0

SHA256
0a0ba9e0ddc2deef6a9f84986cb670f3ee9820adfc59b6bc95cf31afb1829b75

SHA512
d8b3d9d94931a25951be47fbd6dfe54a674633e2e96ceb5cc21bbb553c1fd5d7afbe2e8ba58220f4b1380072a5cb0cf88e853879a017b4e1bd9e7e74de78ac7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2f1abf5c20f4369c57c51e38760c9d47

SHA1
8d580e9a5e6f801c90dc5cd3ed61614df43aab3d

SHA256
2ce7acba3a031bbdfd0902c044724b1226c9da492d77a739d12b1fa4cab05cd3

SHA512
f0ef1bc25882272e9f5ea10cbfd00c831f3b9c15372db4d771a20baa8e5595eedff3fe95f4611296d5eaa8333eca4c1dd272feff82fbd1fed9900059b534e04e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ce2e31c5e1f3407861d8f90e0bfbf4a9

SHA1
674b1d8f6f34f3bcac592cd7ffdb920b6e3af6be

SHA256
fbdc727945ca50723b34c950cfcaf864982aab145f389600cb08a18b5bedae7f

SHA512
76dd9fc204f99427570a628ec479f1b064f8f224863d4ab2f19c9dbafd9a06d2131a0dc1c484f2438f7de3fb4cf355af09e3233d25557cd6c22eadb186fc9d0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
42d7bfca5639ac7684ad29d805ef2638

SHA1
e13f48ebf91968003d92e766af99583836f13837

SHA256
206aab25c03e18f58f14ac7f0fafbb2309ef51504fefe8918780c94ef0f25900

SHA512
f722d49c503a3c14c76bf17ce497d33ac2e73c714596204fc1158c6b78b1fa1a260a203614df4b623b287b03fbbf70c090a8ced8cef4f72cb18963b3f03a485d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a06b46f89bdd61c322106db30c6e2773

SHA1
8ec88269665c9988a25556507af9269ae290f302

SHA256
ffad07a4172a956c5194423fbacb05502f801bd3026a695ce350c53481ea342b

SHA512
8585ad9ddf0c51f4df7e9ee751ef4881d984d2ec2c8ff5b7ffb8385cb7dc7e9084bafd290e45e6d45b9e23001b4429a22a8686b15fb813b471ab7f26891c149c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5c588eeab2a4325a3d71437b1c49a895

SHA1
6aaa99703f00d41d23fa9e048bb62087d88031bb

SHA256
efaee085eb82abc150ed9a6e172022d8ef55680a4bf99012bc49e06731a325fa

SHA512
45a4c0448e6bdf5d6a70a7a89fa12a7e797ebd5ddcf265e45dcd8dbd95aa369530a973815d4f4900ac1c4f5d8b715365bddd1773f0c475a1bd6ffc91266b27ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4027ddb1fbc5c0baf1c0b21f8d23340d

SHA1
13924be8cd747b5d49d52924b0ed1c0890e2d4fe

SHA256
80a7957ed681655fd4433aaaac5bc27cb8988e74a8dbd6fe5e838b805d017cd4

SHA512
49d2e4b6897bc58a762ed9821614f94be83273aae8be372176153bc107d635cad3db827da0482d7cc30b434809bb5c0edc2e516184b7ab87b91e49358c7c8c51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b270285b21a17a5f5564d6bf007234b1

SHA1
fa2c6c84dbab2e11d0bcaef92209819c4336e762

SHA256
7912e43742ddbd5c99d476b3019be29ab6c8fb31fd6078955f3ae3e11280da46

SHA512
d12e741a19135c5ab572c191a890256aca92fd76753520ffa28f0b4f293e59e91f9af47ef700fa7c1cfa66c9d26a16b57750b13f9aff56f44d43c3eab555b95d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5a23c5b947a1bb61eee8b06eda6b036a

SHA1
6b4af872bb12defb777841758eec553617978102

SHA256
9dd3ecedaba5f9bb058244148d77e131cd290f8de8f0eb7aee7e7652c8bb973b

SHA512
56693bc49e03381fd93d551448523ca9535b90d36c4ac75aab9dee7438bfe95261f3f38cb1ae87382216b64ea70a2e922892e67f5685382ec01830be6b0ced55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1c5993344dff8f277cfdfbec6e226e1b

SHA1
a132180bc2dd6c01cfa4d19f987f17395e3a8085

SHA256
409a37ccd5f6929b7b181b08c7afecf908a68e283db9ff2a54e46d0f9d5a68c6

SHA512
f31b38b8272e5c4cc3095ecc19c2c08da53e87bf1a3f930c5d671ecaf8a5655dcef53cfb19be819693b98fe8354c80519ed0a10f9f42edc8145f36efe9e043f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
994dc23b142d47be6944e7d314801d1a

SHA1
b60e3fdcfbb23b03a50800dca15b19db6dcea56b

SHA256
b545461e5740571bdda672e9ad305658bb6e23e7c57829574025086c25197067

SHA512
39d57aa3dc5b1946dd415dfc48be9e8ee4002c0375301330aa07d4a616d876c18a92a7543a2c90e8d0f24d09b0a5a623ced644608755993f8c8a0db7e21e5d8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f690fb4a3eff784e692c88f58514da4e

SHA1
ddbcbac67250d33adc8458dc4e1e11119043e835

SHA256
f10b2777cfaaeebe69078813e50bfe7f760b074863472adf1dbea85878a02c09

SHA512
3694410ea6f6a08cb51ea54921913486a9e47fbf44e94db10ae53e1a02a7f4df88c7642cbe3111117fdefe5038c04ea08e4c14063a088f52db4c59c4207861bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
34b7f97abedc338c6a03438779d39e14

SHA1
81eea80778a8bd1f631ece78220261aa3b518ae3

SHA256
c70d6d842b6511a242c0ef206e8dee08231aa8ad246a563fb40ec9466dc3843b

SHA512
f3c4520cd030c89cf3e121abd96826d007eae4f0fb02a4fe72ba6f1c213e97fc60ef1963f45afffd879619c228e2bc0f3f03c4a4434eac1a0df5a439522a32b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
928072a152b4cb13753b9292d9fbcb12

SHA1
78ef34536260746e12f0f79d6bac66cd68ae503a

SHA256
f9d4dfa3c694bc693ff43c41c86ece71c4a8a584a6625362b0e58d4b22df0ade

SHA512
32361bebd447fa6cb8e3efa5def42e3e0e5f8ba58541b337ec5b3699becd25bd313de83d5d4b7116d044e82c88d227bbf57fee696c14db019816b25b34529025

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a257eb3f61f6e96d51ad8bb50a0a2f31

SHA1
3879bba4562683704736c8594bc3fccfc53da469

SHA256
f3ea92122ea60caa88cda1972ee3140f07c9ff2861a045d4234e7fe19576324e

SHA512
c87d1d35edc71cd7a26047366b0fc348a252067ff9f01def15cfd5de6647c6c79daf705de844c478551667f82b618c6d27dadc52f7a315542c2100d2c6080de5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9149.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar91AB.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit