57da710c31f20c84e84d496b5de6e7abf4982faff4a0f64701a442c9a94a932d

Analysis

max time kernel
172s
max time network
194s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

39KB
MD5

f460f76507d2a43a18eea4f5394fe800
SHA1

a023fbf2ca99d94993cf320a63a996f48d28e32c
SHA256

1c20962f99fa94d930996d95b2f2826fcaf695a6230be191c62184ce2b61d863
SHA512

2c1de84ad7fa25d8ebbb053e2884e69931b64ca42bfbab092eaa25f6094f371aa2b0a852a00909997820690ef9a1bdd69ee926e7f389a887a54a84ac9009b745
SSDEEP

768:S4W9UxVrDAdEfcUsi/A+3+2k6HqmCe7v1:SCfrDLfcUsi/N3+2pHqmCe7v1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1035fefc1537da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409658848"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0DC5E411-A309-11EE-8F35-76D8C56D161B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000003b618f57ba754f45fe389f25a4e99a1786a847609ba79b72a41dd06159bd1b26000000000e8000000002000020000000b8acae6bb1145a7a613349b917bce32622de7496119657bc16c6401f9bb1536020000000dd32875dc8f83d89203efdf281499484f68f6a0bb924979477df40a6cc47f847400000006ebf664de621fe4661b25060d7cab3f7b3eaa20716d157ca4e7f10602d9b9668f937b1e98849f15ba36536caa55d9bdb98edf75270cd73d9a936c70d840d1c71	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000001389f19c20ef46b6a1aa35dc866d4d4a53590799cfc9fbd5970df56a4d5971b7000000000e8000000002000020000000c9356f7042ca5e15b0d76550321286778b59f889e27bdc1e7805098979bf343690000000c9edc4aab596897dcb83aa7a64c67f65cf03d12b6e7f725e6be48daee23bf3748a8a89d27b2018f0e936efa99a3df94634cc5dfa3db4c404d06dc60226a83518c4a66166dbf9107341bc54f34169d81e4e8388a6ef4d080fbb37eaaa39e69af09046d55fee1a0341577e7f8338e5cc1c8c743789f42ba24cbe81df4c69305759fcd24690b06f2acb183b8c0a6e9c637e400000008f050a03b086aac20edf34652ba73a5eb85eaa5f9c541064a1a92f363d0ef2474ecb78ab942f260d267564aa8b86a554ba072ef7e6af85228dfb888bd596d8d8	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2780	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2780	iexplore.exe
2780	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2684	2780	iexplore.exe	30
PID 2780 wrote to memory of 2684	2780	iexplore.exe	30
PID 2780 wrote to memory of 2684	2780	iexplore.exe	30
PID 2780 wrote to memory of 2684	2780	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2780 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eae8b67f62e6ea8b4832b90a80bd131c

SHA1
196c15885bec0d94658fff99a5322e548988aafc

SHA256
b0b23cbb20bb90dbec0883438fcc1ffa4084b0cb5ae25cbc2d91c10a545c531c

SHA512
8f99a946efb47bd531107e020413f9a7063749c1e683f576c1784e575409005394c065259e384d9142bffb7eafdb75e3f7ed7d99a9501ff0e025337c9aa28770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c405fc2d7af62a9b0b26906e629bdd0

SHA1
e6f76f1699ed80417e63a94eda1da353af784296

SHA256
d453dee9c93aa2435173a787990b952a6d35a138ebc88e21deba21cab7916d5b

SHA512
5d07a9499a77c25e747891bb8419a2862a5a2696e221faae0fd5e95b90deb30dfc583140b64ff60edf13d5e8353eca15bab47ed09119f33637df3d533b2f4dbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a9024edc98f09e5061dbc9aa13ab569

SHA1
83c43193f193931f94b00f236ca591cc953fb788

SHA256
65b5bb0e690c8e9018677836f14838c8976986c542a0afe88a95f20540d2be9c

SHA512
0ea53cb405aba416df199018b5fe07d1b60c4d7ad67a6849af1fa376af3ab42905e1227dd888391c6f0363297863ece8331d5e918421c7f00f185cba909b9d97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef68829806d9d1a6c67fbf74b07247cb

SHA1
c172b07f3c4dc65387dc6c91ede9730b5e598f3d

SHA256
a0e5c653c3311f945c7d11476ac1ced90266ace40adcf8d11d6fea50174297d1

SHA512
a101888becd1317979703669d68f6bafe4505290235136ade4f2edcccc6020869fab0972e6064fc384ba6db618bb40dceb94b58060020d0e7bb070c52ab8d951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3b1f9e39309c47345326c3940e7c184

SHA1
f466a90b115b16340fc0d591db3baa097ff95a01

SHA256
49525f020726612927ae619c01d9136c31516276eef0f76f8a1dbadf35b4c6cc

SHA512
2fb704121c2c4edacbf68e58df54c1e229a6b17374eb53c9b2aee0b05131d71fe691fd958760a1468f4e12a2450bfa82198fed0d2e88fa1fe52d20aff08fcde4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a95d75899020f225dfdd324712ae9a01

SHA1
8052221012ffdf4de7f8b8664bdb15cd92d5f409

SHA256
248391fc0e22a28f8711c0f3d2c6ba20f843b395c8e5f56de3b361c74ce375a6

SHA512
20dbd554183be7879be374b8048ac2ac691f913d2d4bbb82594779b4bf029bc1025ef42cb268e4802d05e64d47eff65c787602345b13ebb45b0d4ad0ca4264c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9d9e71ee0ffd3d4e38011456ce01abb

SHA1
85133b444d9141c473c30be4b9f67b07a5a8527d

SHA256
8e1c8d7665db0c122512d056bafe4186b08fba926cef89f49ccb216ff053146d

SHA512
24e8b138e6279985f73269d3c9140be2be4b4ad8710a0139727cb12acf1b5c88a3d1964f229caf3b3088df57a6a5d8da734614dbe6856b6b16b92569fb8019c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c420db5dd6702799ee2d23cb4e760eaa

SHA1
18d24dec7b3997eb711ec8ade8dd3b381d415112

SHA256
ee8eade5539314a88e8b5ed5257ec024ba3a2defc3ebde6aa96dbcb31c823b9d

SHA512
306f0dcbff4ace54f6505f037e0057d141361965516e6d2aef4885e879f4e86cb210015b3b29b79e8cd5fdebef76a8949df99bb8d73c85c57e58e61a8e74a1f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
005055413ed4deda3fe16eddbf41200e

SHA1
08d3641162f82c98792838b7dbc9cfa0f09b7866

SHA256
bbceb793f20c4485c6f91a4887750319391df5bab631bc1f61063527852d409f

SHA512
364a0675a324d4f398df9d62f07d83f91f4d381b58f48bac966d5dd1c3b74fcd9b20ca346ee06964b9465e416be9f6c760fddddd93773812d32863498a4275f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e72387552b923c7707973963e14c3c66

SHA1
3b2619ffc11b9450cd0d9a86e5a207bbfc256a6b

SHA256
7780b8d4eccafab76e3591c8003f6b0b913c0056f24a1ffc8b275015187cb68f

SHA512
e6ce9250da77a34b20e21cfed17e378e90c4e8e01c5125c6582f93e9cc384e8de8e0ba9d39ff4334744983b28074118d2da22c5194f99d0fae9055444c9acaa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d555654b365a02aa29ed9b0b0cd1f35

SHA1
4d12b034c5b7845cb25ff295b2f24d9c43b41685

SHA256
29f2d5992573997bc4bf8af4b610211994886480da05332bee3dbc29514a5c26

SHA512
a1f1f1f6c4e9635e550501fcee6e4701f232e8d8a2f150d83dce149cbd2aea07359a240880a4768d6fa1edc8f2e57b03f3a4b8a11b9e470e680e5d40a4dd2313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7681a0c7577f5fdc83ee154be67969f6

SHA1
05b5d44c6a1148e2fbce23f81c19fffa54de4b2a

SHA256
d8564f921e685debc05aaadb3ae79bdfb7dfb8e12910414bda3a485153334659

SHA512
6a8ba696384e48d5cfe40b5105be4f04ef60c0544119e14b7af0e189b42ffd3e742d3b6b9b88d6687192e8755daaa05a5253cd52013199211ed3d05d5f90cc1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb121fff4918891d2a3ff93013f8f728

SHA1
13e64fe89332e667b88c1eb97a60bb83229eff45

SHA256
17b0cb91ee2202b065cf28bea6d1e5e9706c859d8af254eeec2faeeb81acbfa3

SHA512
e3e841a57a50ebe0a54e80819ad718fbf18478db47b7d623c7db075bff145108e34b87aca2726c39fdb3160216940cb660df03fefeb44fe4aa8a2d8c72c883ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
108b563b8957565121fcb25e728eab84

SHA1
e670948bd8994a793dc19f2ec55c2dee5d40142e

SHA256
7be4fc7a9f8917c4b570440ed97bc01372fffeb51f67ee3ec43ba7e755b9e8bc

SHA512
a656966df7108234e4c5421925121d5d6bf3a7d52d30b60dbfbcf816f0a613c4c3838b06192d1386b8f9811a2bdcb419717f6cacdd60be016740080662a28986

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
473e96b6a7eb78d6868099c820248246

SHA1
e016fc862d8c91a643c69a241406fe960344b967

SHA256
f0dd9c9ec3188e77d6196970cfd33ecc711e0aaa6fb2a81a67c2509b150e8bc8

SHA512
51c967d8a323482ff4199e04929a16956f7b71fba4821c920698284b20157fa3de25ee84ba2f022d3bc7ce216309a3db7874050e63ecedb522207544b3404ee4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\H85YYICQ\www.google[1].xml

Filesize
92B

MD5
684ff5ae9473796be11c7d547b61eb7a

SHA1
42490611ee94500d575665a6163018694fdbc9b2

SHA256
b5b64ee7f1d5f6b1d1495bc100314109a548ec3e0ac85153494130d77c9d255d

SHA512
e3be28dc45c5cb8665299d0a47ee36c9619a95c1d4253984aa88290f5d9d54a6b1e428b1bc54da4704952cac2db9e0359a5a753076ad6651bba69d6bc922b7ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C66.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4945.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit