38221c27321a72395ed70e3d0290fd22d4349b5c1317443bcf0b69ee5eef37bf

Analysis

max time kernel
121s
max time network
174s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
24/10/2023, 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

activity-dialog.html
Size

1KB
MD5

4db032e63fb4a60f629384acc6553f06
SHA1

e1713981f36f8eba533c906609ec264d60730596
SHA256

9f733ea4819d6ee3c4047d787c67684030f50277a13ddd41111f3eb8e9b964b4
SHA512

e157ca8cb72decb01479c8e6aa65c0ac4f542e6005eea4b3fa386cf7f2ba56baca50ce4f50135562db781c0dd9a54944a30af74283a277d8bad0a5c3b459ded5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd50000000002000000000010660000000100002000000022cba02e27367f6e0a658406634576c3f5c83232f3f902bd9a4d7870bd760ae0000000000e80000000020000200000005fdbaf5e76394d679e488cea7bc861327b5526575976a9a0470b0a39b89d068420000000a7a959c73dd72e6044817f507e8232493d4905fe552ec1ed14e3108904b8f625400000001ecabdbba60c14664e884d7c8b9088ef7b438c7b4d0f7a2d54f3fe00aab8ec67a2834dda146cdba0b157dcb76fc407381fd4a9daa5edc8bde45017e7421a340c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "404324727"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 808d576c9206da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000efee191c820df7499e31472656722fd500000000020000000000106600000001000020000000dc57c30e0eb252409ce47503aa0c307aaf652d2cc843f9f178ca3606dbd44d2d000000000e8000000002000020000000ea44f763463b215980baed5b74f7329395968234063933d59323a42f68c5dcc69000000092bef7f919f4566c3468b3366c3a170c8cef399a8f217fb1397c67dc905c5ee84960c6d84b496723a288c8597e9b4842222538026cf70e8888970e335b99ad028a7f7c12bb5a28062ce456934b90ffff7cf75d447d0a4c77ba52d8d56c8710be24e89e50f7b49d34256584bf5619b320bf7a3f7821fd027e67e14d2962bb3121c80d8ad21d235ca8c0bba09c049198a340000000fab111565e1b09b54863b4a76c574658e93779fc8d2693078911272ffb0f7b9cc85f18cf8e0334eafecb9e316e3f1a036311867ded0f76574b5a4d6311d40aa9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94840951-7285-11EE-91A4-F6B55313AF05} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1084	iexplore.exe
1084	iexplore.exe
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2644	1084	iexplore.exe	29
PID 1084 wrote to memory of 2644	1084	iexplore.exe	29
PID 1084 wrote to memory of 2644	1084	iexplore.exe	29
PID 1084 wrote to memory of 2644	1084	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\activity-dialog.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1084 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06b28b0df4731d76f2a4c4d244c47916

SHA1
fdd53c2d7da766c3d13e4c9c1305c89b92a83820

SHA256
8b4a803a42250c4f96d71968eaad8a70625c7d8ac2f1f0dbe90c6452e5ed101a

SHA512
13ffe16408910b75639b845a450f9f7d43d4f101ff4d367bf36cc925a0f68cd7756ff96fe543d089bb8f2a3fa7fbbcbf217666fdeb73bc1b546eb0db46fd247d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67d2dc7d137c806a848570adca2d861b

SHA1
761d1e3460fb1bb27cb2e60625ba160c10af147c

SHA256
5c388a69fe74542b5adb610d455df0765fc36bb91e881c2d027683af00073253

SHA512
a354690cb4fabd076e990d5f98ef6529cc3c71fb3d0016d1f7d9a17b093cb46ecbf35a8c7d8895f4af6178aa42b272cdf24512fcb0c6f4c2aa05845d9a50bfb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf9c1342361cfe180bbd323873af0bd9

SHA1
f65ae0e8f46e06a71b0d974c46bbc9d402c2e618

SHA256
8514ed32344d8a60a53da419c5b1199668e9d514f85f71ab7fad46ac03221bcb

SHA512
2fda54e6d4956738b836f665870884dbe901fca3c0ec6b9cac634208e344b1c7c134915c7c5c4e6e6f46117b36d937266935484705cea48b7fde9ad5de684478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8acf34533358da30abd8353f5fc0f587

SHA1
1673667c48a1c3f3fd30b1d6ec9d4bd65e150d26

SHA256
a62bee8a16e3acf59edc5ed031e4e291157d7b7a2ec8618d7f4c28bbca96e9c4

SHA512
1c5bdfd78e9036eb7222bd8d2f7e98bf9e7fbb836fcdd34add7da1958e816b7a136d433b578649282c436e6578a302d04a140545b64c883f2b16c5abf880b5e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce5c27b184f18be4945510b9044145c6

SHA1
9b0db0cfd032e5596b2a7af0c54ee9f3a3b38c66

SHA256
4da6462b695395ee92a32750613eb8f9d3edb29d88f5f24363a278e9d5cd070e

SHA512
80fbc4bffdbf64266f75c7cd23bb6659f55f83d557be2847bbf138c14107e89577aedf3f3456ce7ed93a84e799cf20754e637a02dcbd9b6a68441c78e488f801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
400cd7438b3741572f9168c0f441b919

SHA1
e9d44042643724a00793b241530505e177d841db

SHA256
1ba0a03360a564e89057bd8093050985fc51ad9f0a7da634cbe5a08968c4aeb6

SHA512
0b4a4e198d45c5314a4e16d924387c42b18617c2ff1a7cabbac526602b1bf9bf9b3ce36ca4595493dbfeb40ffb57393f33905c9252b72832ea38a12b1bd98e7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62a9f697899b83ed58454be7f7a8eacd

SHA1
ddb3804320a3c1768a2509c7042ea0771d34e79f

SHA256
ea44a8f9abb5ff11d08050fe754167a516955b12795d64bb1ecd739f8b90320c

SHA512
5b4b736eb1007b3b78a47efa9cb5ec0cfc28ce8276d23b0a157fb91ec3432cabe06d59fc8003a740804ec8132ebd4080a7271929d44e5dc70d2960b9e0d1f1fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e53f1408a65d0ff0833dba5868e32137

SHA1
c03f03c50166564e406ac562b811feb7c0c96d78

SHA256
878d5b060e0e6496a4c87ebcdc651f4b2e468f046eca04356d831bd425cb6dc6

SHA512
5036bb5857cd0793a72ac0ffb16ab96047be7eb567413a2b4c5ceaa3a1981d45f8e5e4effa1e4cd971413d79bf4c304c31595c88c4f19f3161c52ca9035b2d4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a218c8f9b3d4218bee8a1c77902f00f

SHA1
3082a3364044e8497c615ca46b399f833bbbd93a

SHA256
c236c5699a6529aaa437fa8e5cc5bf4effabe9e897bfb32ab2b3ef10a2d29ec1

SHA512
a4638135990e4ab29a9768ab2a03be534a5a3a0d07dd44773d0b2191a3e0064b63f72eaad705c165cef1cb6138647cc3a55a52463a431b51274d266e361ac9fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a36419d739793fc67edb0736f878481

SHA1
bad9c847185326bd6912b22cef78088473218ef5

SHA256
f3bb779de1ad5f9251fa333bcd832622d1ace94dfc89f93eec42bee6cc97c734

SHA512
250c72f1623f8f33678818192730baa70e75819425ec78ebdc4763d0f7682c3a786044b661124935624c92d82675d8e03451df048ab4a3d146d6efec7c611b1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
894288af80aaac0016c4d0e9f8ddcb29

SHA1
5c8ca0c4d2616fe616393c840e261103c13f7725

SHA256
35ffd02531eb6427503dcba873f51524fcf1ce3c5974a4a01bdf5dbfc7dfbf2e

SHA512
5a1fc84940dc2a31f0e4601ec0aa0c8b6380431c44370542e05e98fd609a214dba96133c724521c0f77715a1cbb9f35f85f8aab8da31694eacb8a0e8fe30d60d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bff7e25a9187f3ecfd3167de8a962e68

SHA1
595a313a833a05332ebb5e6a10f2eb72184973f8

SHA256
d36336de2fc449c3e025c4aaa7bb3d864ddb0b5ab08edb7e351579291a33a6d1

SHA512
39ba0c6942ef45ef4f05e785193a63337221380cc7fdcb132bead836ba9a7f034cf1e69163799689f016ea7aaa2b3652bd16ec6f39786fc7d4772050fb9450cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad292d3b44ce23d10e31263d33610a49

SHA1
d258255f566c74f7fe7bf2047d6663b315e99cfd

SHA256
ab1d39d27d5ec5b0b48d745e56c75ac6469f0011907ce7bffe1456a476f80076

SHA512
14615b7a282bf1d0d3aee6abd357d71b83fea42165ac22ffd2d84b8bf4a4b4110a0024fe91b4579734c4e47cacf562bea76bfff8d735e4a1db72c5032cedaedc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fb0f1f47609e3f270b0d6e47e9082ff

SHA1
1be794667744845164b85c05f87d993f6b9277ed

SHA256
e6b8dcd234f0aedb5f59e74c15be73eabadf10eba110f8557960855ac9dba527

SHA512
9790e452847ce1af5cc31a7b2494fcb7521b03def9573ae1cf595458a38160308e62ab5d1b9e9fcf89f94f1e2a47c6b613222768ba28f27bc6833bad97f5cbc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16511e7d8a03aee627a52ef1e7f1cbc2

SHA1
bc2b1ade848bab44d178c92328892abc29added3

SHA256
43e83257b9e2e17d4a36d699f0714fd83c4ed3bd01f3806cfd330ceca6550bae

SHA512
ac4a574d35676a174440d360c080ace9a94ba08a7e05c878d16ca223ed62932c446e56bf4dafbec1530bdc18179e864f31308264288ccffb9a458895d51e2c75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83421a183f0891123620e8090a7aa210

SHA1
cf3f8bf855483f6e9c6a70eb672d8c269447637a

SHA256
30286ad1d14aec67478a0d3c20b3f113a027b7fc558a753b87a73c0f97d74a03

SHA512
385199607822e046741c19d0a476a2a054cc59dcd49b268fefa9c79e027ddb13f467447f96bdcd830b1821a57f26e978c5b44a53cd8a41793047085675d9a124

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91ed012bed30a090661b8267f1c699b7

SHA1
cef36b72d3543ff40fe3214301bada2a24c3df47

SHA256
92062fc3f293fe61f8a73631ec4e2096c8e04cc48662200401b19a2e4e49ac68

SHA512
c5933137bcd56f81b6b650e537c3c319e1582a9d280f734642df763a84e830e0cedd044b4ba9dd078177d75bb45838c8e7f2f94a056905a28df6f22c02679723

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ffcae9e44d802c604e8ab28ec62424f

SHA1
d93ea522fd50f70b8765ab667b19ca1b5ffdbaf8

SHA256
97b9c317804e9cb7c5d459ed8fed36e03745f697e8c3f7efbcd10cb52ef3c046

SHA512
a8ec8ee0e1d775cf4e38bf08e63c38ed13e3d26deee1814d742a28f97bc38fc9b93a9e7ee0c2f1715d48e786b2d109193c562bed14da983f3f0183028d6ed243

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFEBA.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFF4C.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit