bbe25552b91655e85c60d3e3e23d40949d23529d196e8a9a1ab6e1e7ea7e7a48

Analysis

max time kernel
135s
max time network
129s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83b0d91a4d2c8bb8ddc76e4b2812dbd4.html
Size

68KB
MD5

83b0d91a4d2c8bb8ddc76e4b2812dbd4
SHA1

786a0daee79a483f104363ac2ada78aa4cc5ada3
SHA256

bbe25552b91655e85c60d3e3e23d40949d23529d196e8a9a1ab6e1e7ea7e7a48
SHA512

808bb4c3e9029ca1d7fb552b0277f3a8f5a9b4734a84d8bf39349754e191a06b718bca4ca9028e9f19e4f4dd1d843a71be6e27c3750f54c879376d2b6029c069
SSDEEP

1536:GIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZj5a:1j56QL/UlzBSSg0My2vJL4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000001e9bb30066b8f02deb6353d603dd3d7ebf7b75798b89797ac05c5a0ae50b6ac8000000000e8000000002000020000000776ddbb94bf111d5e12e2f08cc23d222d4d08cda67e90f49d80bfa581a4c3cbd20000000b1383b45202336c26695b591fe9537b23a6192b92eb8d455f3ba009c53cf1370400000007e24b1a5d2e507c2dbd6ed420d502a9df00ed2d19dc700da86be87513f3dcb23b6e5cfcfc4b7d49d00c1a714f36d2ef1fd1e4d32cf21137b8e83095070f0536d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e44efea535da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000003f99247fde8d069fe804d42caabbdf23d47de1050b485b41d73790324119a1cf000000000e800000000200002000000078ff3a1fc9bcedc51440976acf462e3d1c14bbd64fae3428f10a45f6cdd731c9900000002c9cddb641eb23827ac1fcbe9cd1d16c42539308837d9f0cc903d8ce702642721a4b27950ddcd014adacf609e4a2b6b4080071b83f2006df489e0d805b013305ba256a15cf312410bb3c7faa5d26127b52f11b9d4b4da128a64f05bd2a6ee15e71ffd37152cd3a6ee980562c8ea93b33e5bef64ffe3e553b0f14e415e2daf6ea41dd666c6b540cde0125ad9249ba83cc400000009cd3bb71ca272c1024dcca432f4c5157a513176bbc2760e273351b0b66aca05c56302722ff83a5401fc8dcc7e179112df2fd90d48bdc14e8cbc217ee98fdeb7e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28412BE1-A199-11EE-A497-46361BFF2467} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409500836"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2548	iexplore.exe
2548	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3044	2548	iexplore.exe	28
PID 2548 wrote to memory of 3044	2548	iexplore.exe	28
PID 2548 wrote to memory of 3044	2548	iexplore.exe	28
PID 2548 wrote to memory of 3044	2548	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\83b0d91a4d2c8bb8ddc76e4b2812dbd4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
1dc6235dc84d5c45fb5a7bf4cdf31a30

SHA1
690209b30dd0fc8cf031f0168df700c7c3b8a7c3

SHA256
bc39e00dfcf56dead602f981f6d79d9080e3d45fa8d6cbd0db2ce20f85c5cdbe

SHA512
afe398d96ec7ad966f9f7b888cc1fdfcb136ef109442d93da3f15c652567455b984243cf6da8e6659dc6b9fe8540cc234034a38d5c2290f8958d219632cca762

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5c505724ef6e5f09191fd61cb603950

SHA1
3ed2de3823e34ea7a27e78bfb04bf8793c1b2911

SHA256
ceaf93d4ce09b908838cbaecab915c1062f01879e3690125534f123d8b176b8a

SHA512
7899b1d666b27592ecb80f573df7d7d322d6c8d2171c90568ac7d4b4343e863c529534984df198cd7dd30aed9269ecd50df762ae2901cdc9332fce41bb1c0bbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e7ad924b832f71905c36fa4ec1de41e

SHA1
bf2d3fff93241460639d7ce9f896561f11316294

SHA256
7f5af64f253fc3457d0fd43ea0ae72a838744c21abf7ecbf825ce83f59ed9986

SHA512
4ab89eb0d4a9d4de39bcef0aea0048e413230d730985b9ad40699a0ac35e96c89fd96c833939cbf5886ad34292eb46d8c74ad1277d7f17f349145ceeaaf563d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7632a1f69a0a02e47ca566ebf4f72570

SHA1
56367afcf4f97f6606ef9454f16e914812fb4dae

SHA256
3ee89546c5cdff4ff8eba3c54aef1efa70ca0bf283966a07aa1c04a781fd6370

SHA512
f1e074cb763d633a5266ff062b59ff08126d00ee6b3a42915e0ec3a55ea8ccbd3ff6caef423d115abaa245d1356c3667c02713828bf2d32c2dfb43e4adacaed8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bfbae08ee33a591b64b154abc44ff5f

SHA1
a813f9ecaab8393a6fa910648ba47827027407ea

SHA256
cdf2f0321583ea72c01df3b939e24e3fb716d746e431adefd326037af0863910

SHA512
70740560560da706cef24871afbc98f97424bf0a60395c523ac4fef1afd28f9ec851cddc4f9c75294ac26ddc9b2b913cb1bcff5417123d9a778815421dd6ae0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d12674b1b64e47fe796726e29744076e

SHA1
f61cd6d6562456c82899b911dbdb74edd3c01385

SHA256
5b4ce4dbaf247677aaa98f11e4bf795496c4c67c2c5739e40a7311f8b575aa4f

SHA512
c01b61710250a5a9d945c837166da38d2a8611cc3703a0b3b3c756444130e585d0a93b70255389101a0430380cd8113b6e9cf15c6e2e0f87fc6a03eedeca091f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b846cd4ca89d504bad54acfa9590915f

SHA1
941ea9966340afe3283f3b867a0f0789378fdef8

SHA256
05b088e13ba317cbeee47877a8138cba1f9c545fd28a846df99442e94662da0e

SHA512
c9be1b8ea4a41c03a650e48d625bd026e2d5579ecf656a7cb77904cbf6359cf4fafe921df32952001e547ff6abc91dc5215d4770069e6232f12682c4b09ea005

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6148b1ea78aacef0f89a3fb5872e16b

SHA1
e3a930c073eded35b9f765ef5de17db05e683233

SHA256
7af64022d384658e9b8f51e0c462f03fc3fa8e6c0c79f0a326a7c858ea8cc4df

SHA512
80a5cfac4e91124f262d337ed5684606b11dbe12bbea8710223400b08b35312b561aa9eec5632e0e15b66a4a6e6a22147d4358cafd9fda39a7ceeeb2b11d1f7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14d146b2ab41e77d56993d4d05ab120d

SHA1
f27e4c3bde295851a2b8e453afdf39c62dca7266

SHA256
b406bf7aca399174835c7928d9a31f15cc9812aac977919f1545de89394de57a

SHA512
61f82afd85a2da9aae301c35236618a8fa0cbd4efa2a287a5d9a9a352c07576a287e6a7a235903e696e713ee2650948c951edebe3489518ab2c825662fed2d30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7d4be234475312f06ff4868fee56dda

SHA1
3bcf137f54172bb8ae975c4ede3df6db16ebec61

SHA256
920b9015f8ddcb0bf6cccbe03de44b8ee9ec2be570bac984e9c2b66b1283a635

SHA512
eeb28fa9cfb0ad01a48dbcb08f4779e23307126bf8630762d371929c1da939ed6a3e0eb2ee3d15d62245de94e794e61ee38080dde6aea747e9953b02ad167022

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79ecc7a06b0bc30b6d71fae8d459284b

SHA1
cd73269309efce116b11f8780d9ba586e0993771

SHA256
2c9f8ae7e5eb570f6d0d42f6be2bfeef0052e95fc54b19ce5bcfc40f523cc8d7

SHA512
ecd1b73b4343a40fc07bf5e46274e7f198842229420051c710c2c4f5ae2cf23c25628d4b115c0b960cf13bf2503cc6022891cde197e9456f85313834fa386208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e581a42c42570003ee5f9bbaad0bc9d9

SHA1
9c994398cea206a688bc8bd9400aea6ecf30db04

SHA256
8f14e7fdaef2eead4452747166f9a9525449c7650cb34ee0a5a920275b80f2aa

SHA512
a9e2662a648bdbdf5f26810a2b34b6ddf763a009dcacf037438a0b9f582e91fa80377d40fbbcc6830d38130b216a747e0a1ec94a3ed141842385b53a420ab3b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
3b5aecd0816d49f7a35b763e54a04438

SHA1
28fdfb9ced8eea2a9bf365483e22e51b8bccceba

SHA256
aaeea09845f8e4517cfa30eac66b92497920db8a671a70f7e4f64c0827a6a749

SHA512
9b8f1fa2a3ce39cfb95685543331018f44483fff44ba4ad78d63c08dc9089db65f576a25d719ebb45ab86a837187a308a60a3f11081f8c821f310ffe755d093e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar284A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit