460aa164e77b0f7c2139400e47562802195cf1fbdbe1fc39e07db49a17363493

Analysis

max time kernel
137s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

index.html
Size

1KB
MD5

5ca59d3aea3c0974a70fa422c6b3834d
SHA1

6c9eb1e7d43052194b11d9db8e850161602001fe
SHA256

af5120e463c1007205f96035d5ea5baff06c64b092fea1d7005aa074c6d516c0
SHA512

fc4d3187dc77d2053ae2ff40d7340db20995274b1c36131ccb8fe6f136faa395695d916ce4f32a45d517a063898f1d161cd1a7c68bb57c69def825460dd6ca47

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b0000000002000000000010660000000100002000000092442438beebb39dbc48019ad9ee6fd2fcc925b774c370ddcf405ad2ef7b84c3000000000e8000000002000020000000a474436f6225cf441c6f5ce55df0ff41112693f727d43f1cae9f463d086c8cee900000000a56e6056daacc49677da2fd2718f1117289d0e236bb2098a8642c7a8b4d4ba65c082b1f5a1fa295d560ecac969da5b31d348b82c2018a51abee9decc4f0e702e8a81a779c79160843bda26da78a241880ee7c01d7d5f46d4a3dd419a39a29861b274197f748a86e23f9fecc75f7166327a4606d962e51b077b8da3e56a5a025e39a0ea9630140430d4935a1be595d2c400000003406f1ebf06099b9ca381dbcef287e0f8b7e369a099e27895932312016d98b66fe2131f30f03547a520138b9b579f94edb7a7e5d25117785f2e95bf0d55979c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5015762353ffd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A6ADC41-6B46-11EE-8434-DE7401637261} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bbd2da6efca7814e97bd67c6ea97aa8b00000000020000000000106600000001000020000000aa87ab85fa4438b1f2f17c7a96db6d1d7f651488f91fab8c4c2f7082cd4394dc000000000e80000000020000200000008563f85e1ff1b95726e07c53d334718555b492c58e61070b09c05530f37712ec200000004eca231d02cd09bb19c60b1743c1e5c5c472d2d0c91d2ced07b2e475a031cf7c4000000063ec02973f9b058447c8c9b1a01d3cd16c6db01e5863cbf02c05559e04ae1d045cb06d5377f67254cc823cc0d8d2636673ddb285beca69c1cc647dbd8eaa7d6b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403527885"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2988	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2988	iexplore.exe
2988	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3004	2988	iexplore.exe	28
PID 2988 wrote to memory of 3004	2988	iexplore.exe	28
PID 2988 wrote to memory of 3004	2988	iexplore.exe	28
PID 2988 wrote to memory of 3004	2988	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60c79057d1990337f2c83b7f2528bbb5

SHA1
5266f8a140f9f4953327db5d47656e7965a17e2a

SHA256
378374f70ad4bcb9c4930726db4736e052c0f3556cfef612908d5b9ae72acbe7

SHA512
37507d290a5522343c864781c49aee694d9dded42f1705435b70c4d8c6edba652092858c7e4e0b51d88d04b818d4450e3cadb738809594d91b6b5032020cf92e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ede1eeda4000e9e646f42c493a4fb1e9

SHA1
86ca7db3cff9d2c20c7c421053c37c732d064566

SHA256
4a975d0ab255f4194d7bd3ef6a4af3e8f39a5d39442f729d20591612f2ab7f4e

SHA512
3beaa3584ae6b4082944a1f374d6ef4025b85f73827910d114e02f3c8af876c7fb1ba9b57809acf86bba767b736f8f255c3a83e0c0dad573c6161e8b8e633d5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f465febc34cc6b633a5a3d0067d4a030

SHA1
886bbbff6b36fb51f8bc44536cbfab51ede8f681

SHA256
8ab617906314c810092acc8c43c602fc57b21deeb031a525fa99806ad10362fd

SHA512
ebc57d24990ac955387c489bb4c53e479be4fad7a61513f1d1bf73078abb0a5e802f9cca08349c4b086461f17f0c9ce11613fb46a1840d2b9cb19f8f5993d0dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1aafe8eaa41cd9c88ce190717f87007e

SHA1
ff4a3eb3dab231adc9c98001a1a4f1873a69e30d

SHA256
8de89490915a5700b050a8631780832c46f8ae282c580332b45b2a66078db074

SHA512
8cf1ea91ee14b8689bd2ec7b68fd65d31f450df36420658e3d4948c6ea3fd7be653c3a14632d00c7bc9e58751fe18d853fde280f4b8cd771d3b35fc390e2f9f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
431e73c8bca06beb1c8b882fa0db83b3

SHA1
b28b31ec66c40e663760aa33b18fd639c33aa420

SHA256
949252fac042da54fb8494d2ea1d48eef93ac5511a43dbbd380b01e0b40f4ca8

SHA512
0a397d2ee1d8e1c599061ce9e5af3e3daf225f8593509f2cdea2484aa26e5cede775780aeec380897f1eb5684da3cff6998f108ad49e92ad21c70297544ef4dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d1d4fab914e843af2d6b1cb093448f5

SHA1
309bbbefbc21e74c8a0b029299bb06f7b4344e95

SHA256
a33b055bc3b725f3e136c45f0cb30d6aba6838dbd208b5293676584d17e99ce3

SHA512
34e830dffc7c284d4086c09ea122a942ce99aaba3f32bea963ec349cdc1b0e3b915f09dc6208f147196d1a9185cb8d1c2f3defe35e397ce067c3f090c13ecc15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
549030bd3b372f6f35402a72a659875d

SHA1
ee13581810d1cb44e1164c937275a63f88a7bf98

SHA256
c2a4ed401964f374ce641437b5b130a5cafad5f983add45c8a70b9619ecd6408

SHA512
77e598ae5926a802cc37178529b71860cf46e32cc565dea3dddeaf76d29a930d006c4dffbadf40e2642adbef1bd4d12c68c00b6bbd442f5d9e060716863167a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b9e72ad1a50d8bc548cffe15283d47b

SHA1
5056878b953fda19b8caf179a8a20a01c81c1175

SHA256
fb2e66fd8c5204b985b91f6017ad021fcf03c14cc5bc998f64b491ee32786d37

SHA512
0b94a5615c7beae60c886e42186e5f2c9c3196b972c77183e091eecb0990a71165dd354a7ac8b04fc2315ea0fdac9440a2756dd3df90a14bd8d2b5f982e6cd1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca17581ac3acae097954c5c3c82c05e8

SHA1
fb529cb517a4f8a20b97a3f5495d6be488a8352e

SHA256
313b6b71d70d06d923425fac0beb31c92e6d35f1a17a1ee6cae5c637308418c7

SHA512
8e236de6a1c88037cfedb3172fd47f6bcb2a4afaf88c39086c705a37415a14b3dac9bdbab56e076d93a9bf9d26d4751e300616edb63b101682ff097354922c3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74aa3db8e20bacce9f0f7b907c05d62e

SHA1
da1fb376d78919baeaa5545c574ad16d76e54f6f

SHA256
d8d5aec4e6a6bd7558163212b2744e8d4b87bc06fdb92289ddb5304fee8601a4

SHA512
93d30fe2e991b5981f3120913b784d36316090d0044b950d3e65f2f57a5d505aa0a606a364cfa9f7d773ce6113de79a3ff59d172962cbd7d2b9130af3aa6bc96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9df0bc00b94ccf862742d6b3daf01f42

SHA1
3c27ba997175e16417a988349e7796b14424debf

SHA256
4f9936dddcc2b0cd64100ca17ac64f0f486d1d950c3ba266e34229e580d9cc51

SHA512
fe7d2cc913bccd4d994573220d763bc2ea0a8733769807a12e3e1b598c1ffdf0f89eff5c19348f2336ff0790a12eca4332323d92cdd345d2d3f3670be7073db1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c74f1504e33831cf5d5435bba00db1f1

SHA1
2b95951fae3dceb8d894b0b1b9fcb18450df4be3

SHA256
59ce210c9343f9731b73fa1426f7b29646a27ba30365eafba5b9067ef67a78cd

SHA512
061274406429bc40ce43340a90d16f6dae2772b41d130e93bdc4ad12e6f77f628786eb801794fcd3c9620391e2c22814c9783e3db61367cc809fc80f708d96f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1c450725cfa280756fcab5b0e2b840e

SHA1
42e166b3b84bac8251d835f63a009ce83a9feabe

SHA256
c0a9ce602373b1761c5be41a78e02b93ca61439f3951d1f917b6e4d910764a5e

SHA512
deeff53d12fc3e52b9d74155107ac70ab0c1d3bb5dcaea613183182aef365c038bb62b724e91c850ad927f889e31c32e09af9211e51a2761e123e48b5fe6bdab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f84f92f5cd8eb05234a297e15c824986

SHA1
c535c301de048c14308184e72f95f9099e911ce6

SHA256
05c81a85043552a98a2bd833f0fb6d43e6a4696aec0f75d3096d5d77475a5849

SHA512
1ab9f1bcd577925ecccbd25a5f6b00d6a1e6171751b7f08d5a12330ecdef081c1120a858761897505b8740455e3eeb321b1ec803024b81121442e16d344aae57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98c5ff1ef328cebf97c3b7049dbde7bd

SHA1
29712f77b51fae74021099369900af992811cfb6

SHA256
b6ed474399662df82b52686f8b4d8aa4aae1ead95927de69f4dd89d740474838

SHA512
eab0f11beaba93d5105704e630a1a784cc8489c396bea9971a417ea80b90ef7a9e59b414452904e7ba12274908a50a72f757e8bd5783b9234b9fc85cbc1379f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89f41181355de6c7b1dd7a5e83b3dab6

SHA1
35a692f599dbd561d59f48e8d06b6902212093ba

SHA256
8240d50c5b3919eef287600252db7487b8e724517fc74cf202f99f3ea6da4dd2

SHA512
4ba4a8de4db0bb5ee4b4de77614317328dd24a6d0e75f956fb8f9447356eebe9ebd509ddcaca3478f22369fb805e1365b389b5712357277387601016435764c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
634116671e67e5772f8280b32835f582

SHA1
5f3fe8f5ab2372fd8472c846aef4cd1229c6116b

SHA256
bf6e43d15886782cab4cda771c9ef09fc2f76b787c2463416f774e446888614a

SHA512
0b515df1f876fc5d84cc22ee5d203c7a4e062ceee435f984acef0f2edc332d783416057c33ec4ce7f604eb508f1d1aee08e5ae1b9253a2a39a555098c691a99b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a79f4c2ef1984039cf741059abda17ac

SHA1
fe8534b13404349d24e07e42a9e6f829b8f9a863

SHA256
d1cf845cdcb439be6e429cfd5fe1b4a7edc04b9c75e5ec794ada4b163431550b

SHA512
c14f50cb5f5e87ede6124b80ea270b91028469e21650e18ca81acba27517250f5a433103c62cf061009e11ebe69780b420393fca06e8aebd6e273abd5d0dc1db

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA9A8.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB58F.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit