f058a8196e068c1ee1f4ed9c09d78c32525305f2c58ac578e53d7bafde163d15

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

More/Desktop.htm
Size

3KB
MD5

e7af3ed160537cf9b2490c6205975a7e
SHA1

8104010b070b42d265b270bd47e1cec67d6aa38a
SHA256

9d80857ca2e7a66d93fca96a33d1e30c8eb947aa76d5665bad75ee4755f27c55
SHA512

9f227c30deb1f4cf08f21e1806057ffc8e0600b6a188ae0eb52e8a5988d944046b0e942a56ed6ae8d452354f466d8fbd5e1547a4db09b60d904b09bbea0b5d79

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02813b2293fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a0532c567c4f5e5ed3864431dccaa299a03442c5de69bcdd37ed596c2abac143000000000e8000000002000020000000a948e935ff7e72974f31710b6da711cc9b439d76238dff115f5ad2878a59088f900000000f2c43c9d75065fcea4147fab068d3c648edf2075b08630ae88694b0d92f3044aa3bd6b04ea51f36c5c97bc63e9b61e56784a2bbcba0225c89e28c8439b6e92a3a69da45605884d2830a1e98a479d264ee860e4a79ac30a845774f037fb43e06648986d6abae1fe6652dd390726127bd58dc6e73ad3826abbeed2e649194cbd36c03eb9b42941c03221cae8b161be9ab40000000f75df015e2d8f41ee214abb192e6e38e4f1e3aa27e441ca03cf254b48162ebf53758051a1a9bf2c1c7a40aadcc8469f3d48b6f95ed2ab356f6b7d3e6d15e063f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000039a66e06d84c9ab1199ded8dbaa2d0bd03effeb9978a4509eea1e3ff58952f8c000000000e8000000002000020000000d7ba0de3a818e2566fe458e8d7b6a59b70b3c050e047955ac3d3f41cb98824f820000000e52a3b610b4c3911e3ec078a7432144000da452bee5d86552c67960f621c92c9400000007a78f9e145241be3eef8c5786ad6e8c28a312c33577ac2237d9ec6dea5f11986effee1f3c2cabc6632f861a241dc4f46e4ca8c49eca7e6dd436822dff678adab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD2FD6F1-AB1C-11EE-9D5A-6A53A263E8F2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410546966"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2436	iexplore.exe
2436	iexplore.exe
1464	IEXPLORE.EXE
1464	IEXPLORE.EXE
1464	IEXPLORE.EXE
1464	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1464	2436	iexplore.exe	28
PID 2436 wrote to memory of 1464	2436	iexplore.exe	28
PID 2436 wrote to memory of 1464	2436	iexplore.exe	28
PID 2436 wrote to memory of 1464	2436	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\More\Desktop.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65d88d732d81c579846f34ccea54b11b

SHA1
c28546736ccc878d10e7c7ef51d560eeaa8d6e33

SHA256
c08e1f3dd9bebf4826a0dc5f0d4f7b83e4b7d2ba7c9614bddb9dbda8326da010

SHA512
85babee6e40e2294d3cf4e787d3ab0d01ffdaf164fde6ab2d9d40f0a826b293bdf3f42b5e5ea3aff507af787b2b53ef681d3004aa2054ab65ced78dfc9eb9eda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
765791540c1627c5ec7971e5a6e665dc

SHA1
c9ef136e23e0b802a900ede244e145b376bcdcfb

SHA256
8a262fb04db095e3abb92ae00168b4de0c63b25200a62354f8a2b15ef7197c9f

SHA512
33ddfb1842ca2fc52cf06340f758056f83e0c3ca538c97a4423f453add11449dbd21b1163dd90547e30067bab6edfe897407134a0cd7072cb39a6aa1974c2f0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bff40595e9a750a904a0e5c66ce27e8

SHA1
4d0828baa88a2289b949cb999718f1c92741b977

SHA256
042785b911e0dd466be4d1cedefa0ab3b189bf741ba41312e433fa9b8345773f

SHA512
0e0cd0c20b532197013af99f90fbd85c307433c262001a5b1539682f5b52a2e9b69499210e0b986b820504abcd0d66d42702a5ed6455b1f16400826f562e2428

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3394e773ab8b918dacf294c82a281f61

SHA1
56bb9983cdabc4161478e1cdbe7313f8aea3fb3f

SHA256
08cfc7ac3fa080e730fd922ab657b8866a213934d455fe8444b77d8d1629c1c9

SHA512
2c984231a722e3aac0aec4ff52fcb96b05eaca68a34d4dba82ab216e55789ea1a708b2f4789df6113384d18c5ab444fd05f289c0ecdfa524c7002b84c85f6e8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a4266e426839ed24f36a1eccb6ab39d

SHA1
8b971fd5be1eae68223fc73dc7a235d068711db9

SHA256
09420d9a469dd4813d53c1b464b2324d5f8de038864bee35bf6bcef948f9c961

SHA512
6a4362f5237d9af28d4ee988b379ed38d2152604023388da70c787ae247cec7f59ab041ad149ab5a9b31d026fe1b2c024ded1f44f98430788c5cc949e90700d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4aa2e79dd1aa85c45a593147b390ecd6

SHA1
e5fad3f45996e907f7a931e2058e436cf84afb52

SHA256
083ad362396cb022a2fccb51c6a87727b6284f6edabc107222960c8d08f9557b

SHA512
8daf46a9469f9d9bcc4c43029a478acd4ede64d96d685624a076443d0bc530ae7a88283a768c8e993cda86d8ae195b903259edb184fae3ea50ba60045b41e895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e53fbabb5989cf61bc6f516310c3e6ce

SHA1
536e1e1123fa254ddcf2652442227d2951787bdf

SHA256
561433db94bab4e7e4a605fd41a8248d6594a52b1a0d9ebbacb1132340e85151

SHA512
e971e0900be49327c7fe0c8be12cd42d329ec242dd7b2572a58475ed7edf53db79d76600160d5dcaa562245bcc257e1331424399b02c69e47b3856e699b21a42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
124c2a1e174edec49e4fac8eadfb07a3

SHA1
8436f514dd30ac30707b5164fcbd1def9e98280d

SHA256
355335885fe7d270afaf1016e4cb98ee038ea328eca55eb8edcb94a698d554be

SHA512
8ca9502ac9610f1ffde5c50a328e00e86e829fa41321f94ab52d14f8b46eaffbbc9fc067fd3ca69092875873c9e8a4c615d74490e642da699e1ee3e1195c72d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ad1fd018f09ca98597e77c8e0e06aa6

SHA1
4a8a2555a6c2ff778247850f52821185c6778a03

SHA256
9996dd683d5552fa99277987e2db6939626e835309b851e2c6b440194db2c536

SHA512
1388d519e92eb50bcf7b31a59a5e79bb6e695e99a0553c29a9eeaf6442f739ad7b2b0d13d3b7e3b5239fdf6cba493c914c79805fb52eec8e1a1089946eeae5c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64086db5613c6dbcddfeca21cfdd868e

SHA1
936ac8106f376aa72a042a81a68be1591194fc7b

SHA256
05a2c213388e88e89a4f582a48c37c3f82def428077b08daaa0116bb9c1c478f

SHA512
c73796472bf2e4d723edf40ba290facf2f39bbd69d3efafa4599d6a3813e12823142bbf497e08a407e97950104a4b0343005ad958bd43f5a89e123b623dc0bf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
104f79b1925a71e224aee78a540e688a

SHA1
e466adf5bf28bd41a4ee8f4ca7c345394cec9d68

SHA256
8f6016577980f5673f22f2e002072beb4800586d3d7cc2aab57ec8ba366a474e

SHA512
f775cb95b6284e216ba9eadbaff3f7e539a57b6849f0d6a30ab002fdd0550ac04fd7c6872cb7c7e7b8b4bf377ca67c67b4592ff5c1cc9cd3b852ea5de6785871

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9e4c3acf136bec6c6b658c4b06ba04b

SHA1
e7c363936ca1815bb8720eb85cade28bcb60afca

SHA256
cad0935147e5f3e89987ce28bdf65cc4f111a5599d1bacf62b10ab9c6d1a1b92

SHA512
ba1af7e776d184a04c095897c217b4f22f8b1357d5dfd713a4dc3739b4b64ce73fc248f308b54759fa249aef378ac0eeffbaf8997497601cdc879f3a276af66b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1835a70d1eaf219aa65dc96362572fd7

SHA1
37294115e6d25b8aa6b419c365ce0014f9cff6a0

SHA256
98eb96e48d969b153af3082110b5496b3423131fee56aca82aa41afab6d782cb

SHA512
ce75ddef38802c3fd0aa3c74bec3a4f66e354eb1ded8a54957e0cad49f1bd90c62fb3115d3f97a69b5d1809f99dda47c02ac58c792697a20a1c50e1538f3e225

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aeacf9b6abb80953416f59753871e8de

SHA1
fd59f896f8ca156030f9a0798e41c4526b5f75e8

SHA256
b172033eac77600551500802ebbdc3426f90f7d30a0ea7ff484cc443fa19e73e

SHA512
e001f372f957248fd79cb66594010809b05fef37b4244144aa67015625e35ba8b5dc31e0c00b6263c696b7222c2c8ea518d0a0adf12aa002bd93459f09ed7648

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d48ea27f659e5732a7f1683bdbca39fa

SHA1
bf445ea4f92e54497ad9d5acfcaf95c827295cb7

SHA256
00602c6bcd1c1a44dc06b7dc3a578f35ea9e5d0e8ad7fa74fb94bdf38233a7a2

SHA512
5eb0008b441e514ebf6c1ce3642c67523e12dda2279f855691e6f598b826f2eaeed6843ba887ca8fdeb29909effff8f398bbf322eded061bf81631ef5f29eac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6452467e391c261b2b16645e94945c5

SHA1
8cc09710f91bc04ff572396bca06394c7369675a

SHA256
6648571175e561767eec537aefceabd050694d56cb08ff0570b267fab85edcbf

SHA512
80d8dc4034f3b8deda6afbfc4594d9ef875b32f511feb76277935d9b0e989bf3b6e4046cf8c7d3c8f640ae54c1c5aba80f31ce580f0acbe0583b2a4a78118a41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5457a644d0da07894fd4c5c956f9ce51

SHA1
ff50873f4648e2c299d5c09716ec1286b96916b3

SHA256
46d8b6de6cd5b52c3f86ddc9b63481b85c3c877dcf8ba8fac41bc5daa65b6fdb

SHA512
2dcc2a0ef8c98c1e0ecfded1f02b1c48add189bee1e6ca6eeb5b29c376986eeba0a66bb270b6922386729af087fc7659914248ee74d7383cb7d49e1da96a4b87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9a0281244fe6d22b23365bd3550876c

SHA1
05f4315a56ddd9f0838f47de10ba852eb9781c70

SHA256
0cb89f9fbd55f642cce052b3e4a51d08afdede9cecacfc9f33471a3d94437913

SHA512
8a811f08a67a7f66fba4825078a45e157d8013698ff674c1d026aec57f932d3c6958b6b806fecf673139696ed04686c060efe59395185ffd51779a3bd31bdfd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA566.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA644.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit