e10b609758d21b4ea734407fd5b1de076c936f146ecae753ef373fa18c0fbc65

Analysis

max time kernel
138s
max time network
141s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78f7b775cd8186997d9549b8fc927826.html
Size

113KB
MD5

78f7b775cd8186997d9549b8fc927826
SHA1

fe8c93c799efa52245c00ea8994beccef249e883
SHA256

e10b609758d21b4ea734407fd5b1de076c936f146ecae753ef373fa18c0fbc65
SHA512

72c57c57c59000177cafe00377499e4cbc393420d565199868de4d43599cd83e88c668dd9db374c715200c6a792373d500a218a58af43015b2c2fffe27bd380a
SSDEEP

1536:faOrm46B5ZWsagD6OXSYdLPciaOLXwz3K+IMz+5m5EwpoNJxtWdY0ywefYRkHXlL:V9eXS2h/VSwesVDcTLHF+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409895262"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f01faf5d3c39da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000fba5340396e270d1c54f77c2a2d2a1d8de4cbf62fbf22a1ac7429120bbc2994c000000000e8000000002000020000000883db3dc5a6358961797ec98bbc49e1b83fefc1b68f3e2bc2edcfa193987e08a90000000a337c3057e73cb55f94142f122da6f17d050a4331980b3867f5624406e508b9cac572c1b47362fbabd53f96c63fafd4c1629692396caae844d3d116d72a83465a71dc820051b478bc208438d6baf09a09bb92d0bac63dfcc2d42119523c11293316573d527deadb39b3d2211dc6a18971109afca287d1a15ed762d2425784a2b8f8606e3bdf4c3fed52d65df239daf58400000002cecaaefdc09d0f1218823ba361ba4370acc8dfe0de2f075346780748ecf1cf76b42ef05bc9e1af10e507d593d9848861e2fa2fe3f87f13570c072666fc27baa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{807BFF81-A52F-11EE-B309-FE29290FA5F9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000c35005f54791b299f1654c81c077ed410188dc04106f17949b8fd4044c223b40000000000e800000000200002000000050adb469ffd2a8957febfcdbadf09c981b48bcb18fc35801fba30f7265f2858a2000000081674558ba0780dcda92f6e2ad07c4342cdda3201bbc480c1996a2467848832640000000de95bda658ffc798153e0600c2bae30b1d2aa2d3d75ce0d9c1b9d38cd3329ed7395bd820ca61f3e14685b3ec016b6db60e0d4136134ed05a3933e6ad19dee579	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE
3056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 3056	2932	iexplore.exe	16
PID 2932 wrote to memory of 3056	2932	iexplore.exe	16
PID 2932 wrote to memory of 3056	2932	iexplore.exe	16
PID 2932 wrote to memory of 3056	2932	iexplore.exe	16

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78f7b775cd8186997d9549b8fc927826.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ea211a1a6fb15f3acfe864ffd09a635f

SHA1
fe9c8406988d10b6269a8d77a09f2c45a24fbb8d

SHA256
20bad2b1931bcdad5ebbf55a240e7a031dcedc199f517cf43e6c78fb1b1375ed

SHA512
68dfcc30e4b4fa3afba2a8f397fd23101b5babf343c743a0fd26be1c8406775d3b99faa64b07c7b690593dfaf7b35d7624aa3761a9bfade987a5cf5b54b6feda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23f9dcf6daa5e1b50e683eef897ba228

SHA1
e4dac05cb2845a0f289b4ce18f004c9f7b9da732

SHA256
6bb6d152502e2cdd3c6cdf6eacb7fdc181ec6b7f5441011456fa828ddf5f823b

SHA512
e4787ccb748984f4ea4ca66321477290e8822cc284c3e0602c9398b417f9a9671d0bd3db851026555c25f5d44257bcb2d5c9fd1f1b55426b9fd99f60f8b79ad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56dc8227101221c716175d6347111b2d

SHA1
fe41f45b05fe8b9225a7c49cd0d64e94e006f6dd

SHA256
a7e60faa6a4e158c79c73b9c013938e569143db1dce318718040d5f2905d4aae

SHA512
bc737c3c3b6412a48ccc9f30a45a7166acd255d95f1424c209e4f94fd2daf5022ad37dee66d702db5ae12f91a69cb2533d30858caeb84ea1428ec910676bc18a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e0fa753b30e3ebb24cff48296d2d911

SHA1
8fe23fb5ddc84f3dec8dd422ad8e9bd5d1ec9a9d

SHA256
c3bac16effb53a3baba511d5abb25f0e0931419a0ed1122f908f21a45fb770a1

SHA512
d04974b13925155e39ec5e54134f9532585a9ce2d4a16bffd23f26d78cf0f2c31b25c97c7c3924259be17bdce521c1d214b332a0d752482fce1525924e242139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13958cb01bddc137735dd73bedb029ef

SHA1
0dc60d9af2538d44ba2899b9bfbe3d534ea0d3ef

SHA256
f781973a00bb5a0591f4915559d4b860a289928b2b98f90570cdeb001c3ce9a6

SHA512
b788b460c08542cecdde0a7704c41c347ec34c79a1e6d1d43c7f13e051385c43e3d12ac825f09199f51a1069ace016f474fc51049f97c073880a787552f447c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcb0f6693bbc86e670b0af0ca20d9e7c

SHA1
4ed9996c2c6324a2518c46f87c387184a8b69a78

SHA256
3ff5db7bdc886d567fef4a21c22ea15576b720709f83fd38bcbadc491d76b0c6

SHA512
00f3e32bc017addc48a95007a8f040ec26a3c43bc582e4b933bdc05a1ffe3415c89854e09dce2b7843931f86283533bcf7663f2cb4aa60a5df9b2910e283a7dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4941b1ab389ebaedcf39528f2534e606

SHA1
5275c0680207e9d9155052c4584684048d860d5b

SHA256
ff334e9b08fa7b302fc971226cd296e7beb9ec6d8a772f01d82bc6705267f5a6

SHA512
b07d11cef8e8f2c90659f177d1c3bece9513c6705fda1bbdc348566f4112a6b7149183543574ad93d3d17f95b86b193f81f3a308447071f63f58423fb0c3663b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd98c30bd8fa1e26aa1da3754d321edb

SHA1
70afccaa4cdd950cde81bfac4866b553f2f6fc41

SHA256
4c02114a90ea65ee45bda195c53700799e848744e163b51f1fdce3768367c483

SHA512
0a628ff33b1adfcd41bfba930f095f0c1a27a21fee2b6a9eb7d95076443009d55c59da924962c5b9c5b96f6f39ef8a60aeb3b595855a521f26e8e2e49c1afe95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
454e3f855d5766d1e5ea6ea7b89b00e6

SHA1
31b9275167b2db2797800524591233d3b4aae2b1

SHA256
985808ffe90eac4a7474bc8e1ff69d09a6d571133aa41c7dcdfc2aeccd2f81dc

SHA512
5b79f1489330736c62020adc2d35f671c91b8757bb92c2bddbbea63da671f284e7e6efa7dda25ff22cdb56819f55cecff617b134a0fa46fcc03ad7d92aabe8a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ec7db3d9f5d256251b871a11efa09c1

SHA1
ba99d966249f06d8eeea745a862920ce5592c176

SHA256
17658f001bf6bf3d54d195438089bcdb4c1912952994d3e5def88318b5717276

SHA512
15b212bb026d4fba8064f03eabceeca0e98f0f50eda6758337c98a8461394a4ca4e457354092272d38064ce2522254350eab2273578c97b5f38d2ea26cc9dead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e474966faace22b1fa9bed66e8549c18

SHA1
60152d50c2a68bbb3ac815530a946be4ce4d30dc

SHA256
55290b49e9b2bc1773c0c43af4aa787836bf936b6b24efbf522ebd81b9271b22

SHA512
60d61f4acbd9be5c4c50efa9cc03eb7975a984402f41a075ce8922df00ec9b6cd6fdba6b8fb802d88be2e838555c65385b01a8eb37aec5bf095519e12a687192

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cda9f2b7cc8ff26e70196e67b7105ab5

SHA1
933fe62a1bf1c3d79ede17ee5f3626289361addf

SHA256
ef4190beb3cf4464a13e34b69655bef743a38449766bffda3b2d75976d204d9a

SHA512
8fbe9da1ad47a755b978bee41207df5c50ff333643c1c41d62a30872dec8c7cc87db5fec439b5b688ed1710748f71e1a3324facbc0e306a0b05c6e9e0ed83c62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2c00ec9aa03a0bd9d7222a8dbeae597

SHA1
3f38ceb4d5261eeed7866610830919de549bfd9b

SHA256
1b54ca90c07d7c7706ace17b886944b75402027beb2d122313d3eaa60a1e27db

SHA512
b5660bf394d8cf0b210c2abc336c735fbf3c88883eacac55412f4f4737de91e8517ea20314d5b8f9b61f13627b05efc29fa963e895ab99291e9a94d603371a78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f5d8886f6708d24076584173ba92ef62

SHA1
4e096cb8b6dafdbd6c59a56fb974c0f1fbef8040

SHA256
c01739a5ce719cb364b68539629fad51f6811f909ed4104853e1ff181c1c3feb

SHA512
c866b0ab6839c15f7987333817f08133d4e7690bac92085da7d5078eaa12e79e98516ffe3c1b02ff32e3cf976c5c61497b36b4439272f26a23dbcbb2188cb773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2773.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit