e7dc806d8a1fec52abb0715c8b83007f01c08904894bfb9512d85f7e0b59105f

Analysis

max time kernel
138s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c85bbbb64e1bd5025a6f5abbbe8a166.html
Size

53KB
MD5

6c85bbbb64e1bd5025a6f5abbbe8a166
SHA1

922087aadb112dc0ab27c565d4af3e9ec0d20e44
SHA256

e7dc806d8a1fec52abb0715c8b83007f01c08904894bfb9512d85f7e0b59105f
SHA512

979c881cd3a6235fc62c808ec2028f0af888819156384c9cfcd695b76b296d8214b5538b15dd916d5a468d882d03f3b3de764b99e150a1b6bbabebcf2671c8e6
SSDEEP

1536:CkgUiIakTqGivi+PyUHrunlYJ63Nj+q5VyvR0w2AzTICbbvoy/t9M/dNwIUTDmDF:CkgUiIakTqGivi+PyUHrunlYJ63Nj+qV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DDE47BF1-A4FA-11EE-BCDB-CE253106968E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409872657"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000f47aecb7f6efe586760dfc8716ce97a1c820202fc92b52523d70887958b2d95c000000000e8000000002000020000000f5a2d421b32cb466e96a6166fd5998eeed5cf6bd281cc9824ae741789250104f9000000024d8041645258310777d547f2ea4577441673f883634d7d18e4658fd0065b89cf2c77880d20dd72f4da86dd3b5c53ba8abe2c953b9f249bb32d8f3514914e9964302e0fe0e23965ff916f3f53b1eef794df0993d824338f0f8ca5d367939ed1c97e6a59d2f93d6b74571550481de2f363e34be64779774f2d266c9d6e68426ccb0b0f06f8a3512ca74db3b346f3c1c79400000009d39f0f55f957bcbecf198c3b00baf2db830319c7a929f7c38e78a5602682844aaff4f5035534e1ec1d8c97bf73286221bdff3831b66ecfa78668f00506f9450	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000000867593988f37550bd48c8e0d88d4ff5d3422a61d3db565c594ca7186355519000000000e80000000020000200000006e6c6b01af22c9ed8d4eb164f3a716ed11149062de88eb811de7572fc1f19a7a2000000040794720e1b0055d7af5374219e7b5bfd6c29b8f980c750b138aab4495690a4a40000000818a1b7369a1421f350ce7a555461e8ff0b4d3ee77fa2ea5c4b8bbdbb961f5e4ab75d606cba71aee4c05ad6d51194ebce54b5527f351e7b1d51eefd20e810d10	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a64ad30739da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1972	iexplore.exe
1972	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2388	1972	iexplore.exe	19
PID 1972 wrote to memory of 2388	1972	iexplore.exe	19
PID 1972 wrote to memory of 2388	1972	iexplore.exe	19
PID 1972 wrote to memory of 2388	1972	iexplore.exe	19

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c85bbbb64e1bd5025a6f5abbbe8a166.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7367aeefac7bd1f59660a33214d85f1

SHA1
1cb0d5e11a0c4b463d81a89e75ec2e6f7e89e3c9

SHA256
e1e7409b1e3bbf8e681bb084a2fa313be9624cb8cf5fd2d05700fd6e4bab5629

SHA512
92970baf4081a544ed46f7a08f5b16c41968203533a7c4604a65a10c2f5d6e5bedf2a5323d6439cc504b206e2b8d54a78807e05d79308fd2ec60bea5f63ef4d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
250bae10dcf8410174447b2db759726d

SHA1
d536864129fb6789517f837836e7e909ae600032

SHA256
c5f50b46cdab3cb95c99ba8ac282cd14d84acc419cfdb4030009f4d6fbc9e55c

SHA512
f87e2f61dd1f2f2f190e8f4fdbaebe68f1f86826ffd75ba939fc68dc56b0aee2e02f3e72e53034e98a8c4abcecf37efc2f6df5e86ec6ebe7fff7ee92be3a7795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cdb46a653df24564b84745e916994ec9

SHA1
a1c1295cbdf4ec65c9ff88f1fa555001364c5fa5

SHA256
c85cc06ffb8b5cb0407db377465f180dcfdc778ef0d1e52c11dc6092e14ad22f

SHA512
adb9151110c2144e6c65019aaa025c212d8de66e625908d300976c6ccbffe8527be9de42606651410daf2e10507f9478011c379b769ac26ba58f757920fb0c80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47f7a139b128ab48186e2f87850f1763

SHA1
08e3cd3f26bddd762bb859d6dd3adbddca34b4ed

SHA256
f8d07ce59c90c890285df305b2043f9fbdec4ea41c8ce8ddcc250cdedfec97a5

SHA512
831ec86601f03912b2680a8a2db239750a0e44e2d743c18ed909265bcee4ddbd65cbdb33b1f9e5a2cf04e9d7787cca3d90b9a39018453b57fa9e7cf7f74813de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
709591f7baa8a963e50fd890fc21acc9

SHA1
afa5c01587730c86fffef9ac9ac7d8c29f0ecd01

SHA256
6946e5d3bc36bc035221a8448a2d11979c6c568df1ce84d703ccd25c9530ff09

SHA512
09b2d6ac705fae3e1e180f82e51dcf614f20e4650cc58d5937e5bed4ba640e355ab1a36728795e657e8ea0ed53d1ae3aaf1dc7455da7a0341d012cbb2d2bf355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6714a2746e293a7cbac927c2631af12

SHA1
c9c151f7ed6f38c23066ea7681cd3e28e5f49c14

SHA256
6d045e0a7eb42b20100fa808115573ce85859ed9d744634fd4ec95a7dc45d6f5

SHA512
33d16ca2b4a7a090c941de015fa8a25e6cca9fc4c29c2cb465f2454b45a1c089720d44bdfc251578b3d16eb9c580a03b357a9caa4c61eb5c0da14a79da212b1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18a28558c4f800968d3e4d39e30ba34e

SHA1
ca362c91e1999c51e63d8747105eeb1fb71f6049

SHA256
29edf9542a264960576a189d52a95b3e593e1ff5b33b0ba35e0bc34fe57dd5e7

SHA512
235c5d89f68784496488c8a043acd5979deb6f0e8686b8e07e0e3cfa9dfbbe467ffeed667b11d1b9e19cbdb0f66d63cfe33bf41f4d068958f2caea5f7d6cfdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eae48d73cc8e415cfa1aba96c3153a30

SHA1
74fa29b2f2154e29eed3af23ab98ed2f15cdc469

SHA256
4979d1f16faa9eea359751317870eeaf7ca86c3eafe010e73ef053eadd5d76e7

SHA512
b96d4e1509b28c1888b7ce631ce7e08b4b52fadad16c059c57893af31d4e0104f9338dde0a2e1d73b050e78803da66473ed439cfc69ed3f2625a2bb6bc024cb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a4b35b5980feaf8cb0782755f89e4a4

SHA1
7efb59a2d30cb7a1b5d28233f468083c6654af79

SHA256
c6da7b1f7bb5a0321679f9b3e25ea484d4135f9fe6f814fe3ffc12a3e9f73af9

SHA512
43ed4a9b1545831f218a38b07ee438a515c375d066d8721dfdd97f5f9c3a7122d4582a852d6dde643e11f3260a991a7f69eaa4ed568657ba23977a157f960b6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7369d8291aa1774c5d4e8e7e47666c1e

SHA1
7ec0603596b3b7ce9bee7d26523f9db16809520a

SHA256
6df4645b8695bd3af744e5d5fd1e23e0e9d90bd0f2144faa34f74159be468941

SHA512
107b6262563f5d32683f322a0ed2664614c3e08f3aaa9bf693a988bc25df3d1d5b91f368fe0b74a73353b89f10210c38163dc30046360e475f70896c5da0af27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3056eff06153fe0c227cce84afb487cc

SHA1
16ea9455e539e8d2ca4d05157307d2c35f32fafb

SHA256
a8bac0dd76ecf8841478c8bd83d95232c4d6c406410429f4a6dfde3e807b9b86

SHA512
e6676f0ebd2d2dde8d716a38e32a42c47318e42f41978ba27110c18108e2b620cff4beadb9592c1419abcae5060da6360d607f95dd49c6a99e8fc07fa779fa74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
785ed53ad539a0a83f7e2bf4ac78f48b

SHA1
a3c8c625993a7b9c2ad149b2f951c421e08fd07a

SHA256
80373a9d3281169ee17cbdc7b0eb69b867bba58f4f9a84d53f168d8f63ef3594

SHA512
d7336306e4e855226c3f9fa0b4ecc42aff4e16925a82dec4d4abe8e873046afafa5da594f0c6ea90b529809a54ef50f19a57d428f507705c0070d79fb9032620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8151dabeb6bbcd8895074bb463eab4fa

SHA1
cb98b8aa8f4ff898dfa9caf37d0869e28cf86c4f

SHA256
c418362a0d5776241cfbb3f95bcb4126e7b43475b6cb53c78d1b42a951cce82f

SHA512
152b186ae199378b3e06ea66ef9fb13d37d8668e397f0441c31e811e129fa0343d0e898441e18ef8ae7ad5ebda94adf08a9b4e595b7a3e74d626d37b2b6522a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2910c679d75c6b4cd4ac3a157d7e9b19

SHA1
10c849c21348a231e7fcf5dcdcb8f67447bcd60b

SHA256
1192febfbdce2b8c04fd260380dbe69ce7c85c00a1c6af107bb8dacbd1632d21

SHA512
722190951f75cdd7aab52c1938e4008a59771286de79f29c53ba38c94df7254cdf9e0df4ccd8dca23bfb8e4795cf737242aef939faed8423a3e7d47e3ec2e3ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
480de177f1c3910e85986f7352d4d968

SHA1
564f0212c5b71300fd3a0d0a089b940f1f4612a7

SHA256
bc9a0efb9c597a1bd5e3e419f03f58d0c51e73f99bb56836489b3ede977167a0

SHA512
dca4ed03c178ecd2d7f3f3babfbd07ee04ac094b1fc874e6090546de296e8bb1bf414171a0621e1a0ed28c5c88e6608dbe805f4a0a07444572821a2684b154bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
709fd5df1f534887979245b5dce805a0

SHA1
ca1f94cc9d567d9661e283b3351b8fae5e485040

SHA256
ac734905cfb283f8062e9f01c0d495368d370cce6e6cabbfdf76206ad39db884

SHA512
28480fdaa40095d6ddaff6b33aefad3ee83b4cf86a38afd10222aac8e0a309ec4979e77d5159a046e8a68d9b96def234078291af516141546db0cfd6738a1aec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\print[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab367E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar38F1.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit