f46aae7a50e9fcc554184e69a191d553b6287aa604f5cd5b2713d19363e318e7

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$STARTMENU/Ա.lnk
Size

1KB
MD5

62d588bdb74e4e2e5d1689fa9272ce39
SHA1

9d0db515d8f65e57353381d707060f7343a74da7
SHA256

248402dd02a096f9721d61fe867fac5cacf4dc9001fa2aa6a50a59f7405606ef
SHA512

cbb47f7e4227177ad39a1c914e00e0ca13209fe0839d13819299ad203572b69026c541d71c5101e4cdddbcf7786c6adf339af3e4b0aab65cb188614f646a893e

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411827313"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000002b83b5fbedb95f28386ab684ec72c5b0c7f7e4bf3829953e029b0155207a2855000000000e80000000020000200000005161f9f13442482fa9720d6aafc72d2be2a3eefe7ddc1a219eb672a886712fc7200000005010d9db56c55f980733c3bf827986c9154f6baeb4b5cc8566460183644e382140000000e594a4227672052acf3e68899787594fdd77fd7c8e95093b26bd22dc16f7be358f4bfb42ef5bd956a0549f7655fec9e33b727dc6278f763c0b1742e2c87a4f0a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e231d7ce4ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E963E731-B6C1-11EE-B751-62DD1C0ECF51} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000009511099a439e241fe74b250e6a6de3d921a1fc53619c598b5f2b8f7598d6bb47000000000e8000000002000020000000f18fa658593b16e33fdb0ae91b054d5bbfbde90429739dada32e3d280b908b0f9000000097973e49f2b95445754ece509e8c673f5fadc975fa84a850a394d88d5df6464907eb531c9d06db88957b8726cf5430a9517ce3132489bf9e5b9b0549696f1f8c8d8e5487a89590b6098db947315e12aed406a8dfdc5770741d42ecd1c03dbf88fae20bd4e66c235a241c4530536e3efdf2926ab8aa02a91ac37c802ab3b896e8203c97ec23ffaba139df0e4e882a70f6400000006553782087acaa8fe97d0133c76adbf9df13a3efb88d8c5efb58f8e59b61f9b6bb21492772ac3b333ae0b653a264bd33e56d2b53df73a3d6bbe70511dff25cbe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2840	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2840	iexplore.exe
2840	iexplore.exe
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2840	2976	cmd.exe	29
PID 2976 wrote to memory of 2840	2976	cmd.exe	29
PID 2976 wrote to memory of 2840	2976	cmd.exe	29
PID 2840 wrote to memory of 2856	2840	iexplore.exe	30
PID 2840 wrote to memory of 2856	2840	iexplore.exe	30
PID 2840 wrote to memory of 2856	2840	iexplore.exe	30
PID 2840 wrote to memory of 2856	2840	iexplore.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$STARTMENU\Ա.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.mai520.com/?taobao
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c77f4113d940819ecd8e077b475cbae1

SHA1
604697a93edfa3d06aace0fc5cba81dc06230f52

SHA256
21b36d1d2b3137e2ec38d14920ef86d248221b0f51a773fd418bbbcafed3e5f3

SHA512
ff22013f81eac0f00a97672e93027279481873faeff3085ffb0c306b037b052bab9be8abaccacc5057db6e25f371df767358699991882e65a36579d1035f0bfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6827d281c55357f0a65814ef25b8d763

SHA1
a1110c457bc9de353afccb06d90469b036ed387d

SHA256
6bf612bd1b3506fbbed45fd7a8f08ceaea40a4f772228b6cc59d26384dd8d2e7

SHA512
e38eeaac7607db4db7f190e5966174125ebd3a240eacb405d567b31803ad523b0e07ddb4f7825ad14f7fe729342357881a4cb5664458e2bb26b2ef8bfbe798de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3327a7d68a70975be89198a1e26dd28f

SHA1
feaa76af74ee8505c3d049d2570321063d79ced9

SHA256
b23457591b3bb0b315ebf4f613a502a73edb229afe00ae52b4b638cc46fc0704

SHA512
f2e4caf9f3b950cf48f7d8ee74d7f9cd89370a44f5bd1a86b92f25902834a8fda67e6a65510ac050c30adb52077784abcd8572532639b6256e5b85fdff3d5579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
451736676c64fe7a58f0e8f3d0bb4369

SHA1
42054581fe24b96d29304163bd8e6b22743829e5

SHA256
e8212f7c90f06a89999d0178454bf35415d505e15826cfbc27b48406b20fee8c

SHA512
83f3192eaba9b47d08ef92baa813e17f25ce76579c496fd8d758673256a93bed731cc6c1bce18a6ce51816414590ec453ded7f61666cb9d32e46d666e7b1e8f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
845ab35cff9a2e2d08ffa6c302634520

SHA1
c411bbd0f87e80077b6de63a04b83ee2fe2679aa

SHA256
e8d135ea59437943cce910e081b65b0bab5fb237fc2926a7a87db375c1807b76

SHA512
a855a6f3fe30faa0cfbafb375ed1ff1fe4fa16702fc52bcabc1ce529e91a950a027fc8431274c9bad1a264545e76003fde0b050fe0cfd028ccde79c38d6b30a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea1b74ddaa3051380f4e6c9ff02bdde1

SHA1
708381148c0ccff4d7f7fb5f42febbfb11af5dcd

SHA256
c201b64e817bb5b205a0456d4e941d689ae0757b6570e85491817fbd1b4745f7

SHA512
558c6c485c87405cbb3d9d5706c4d00d8c98c9ddf2a3bcce65a7db606935fe1609c7ac576805badf36c4deeb3eb07bfd14e43134d1c6e40e23cdb6f2ec7832a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
228fb52828f7190b5e257e493ade1472

SHA1
55d9328bc135cdd7f58c7926bb2df8f86b8f5e24

SHA256
0e6c2646de73e65e05814b7517af5af4bfa3138fcbe60ab855db563d20cfda7b

SHA512
07e86ae7dd503c8d09d871fb8d49979a4be2e7ecc6c692dde8ec838aa886ba40840fbc3383d27e0bd7275425dec0e1ba1171859d58bd7bdc9bd19b0bdfdb6636

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed2f5d40787a36d233b29694ccfe5dcf

SHA1
fe96a93a979225e6d84b04c1e704a4b4462fd0a6

SHA256
4f6a6a88650ae57558547d9aa62c344f9037cdf9362e43bc927667eca2a372ec

SHA512
a9a946eca705740ab4f491e21e5204535cebb834e19d5b24e1d0c4961538eecc2f794601c3bbb40e7fe6f81380d601ec5ef62b33169cc0cdb2f80674f00bf18b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea0873484b8cccafb16f06790dd258bb

SHA1
f85ee12401a8910b7d0de6d7951949059ffe1f33

SHA256
6a992cb61de2e79406479cdb41cb26f17d8d8a888ff5e274995fb268e752e1d9

SHA512
e53c504ff7e068503fdd0ed3c53c8ea682201669c5f23d65d0bc3c26f99e8a8af3b215f91b0717beab404de175094d6498b4692a301284bc10ff1c0d6813924e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
046464d829979e23166a210304d634ca

SHA1
fefa9deff11d8750bf6dda20728e8ba7a8275bb4

SHA256
b0d3c525afe95026b17a481ec18c6be10698242306c24786ef834d61998bbb21

SHA512
ee5bd1cd92df7438c86b27bb3014604f3f745ee92fbb4d6a4bcad382d2ce832ac09c907a15328be6717928065130d81cceea057d45b8b91f840d1b5f3a026163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30d79a838402deeb04b21e7c35416e53

SHA1
67f0630a850c3d565ca837933e0a3a7069f49561

SHA256
ca26255d39611c3e0a608191a920bd669f7e3cc367ad1396e9401938012d2bd3

SHA512
6347a42b8eef04465d961ba1cc75c052ae24e29b85404e3d1a9cb882d7de7b8bf41bab538d1479179adc4b242a2e4cf5f7e0e1c083ff4fa9045107115992edfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cee765f32325be9b049e4c9d64efbafc

SHA1
b5082cf4bda5242de9d28ad12f2b9242ec69d644

SHA256
9cc7683f67bb112fc93de466ddd94afaa7b2a929ebc0c15c1550da364e0edc1b

SHA512
ddcf445a8637d79d1b8deb2ec2da6801d2c296760dfc4d17ab105e5944224497a1606ebbf3824de02350d5a5cc46fbe492d5a3973219cd52124dcd6d32c79102

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f912fef0bf44d3f0ee3a418d4b29bcd

SHA1
ad973d2fd486459f92ce68247a6791a398fd3305

SHA256
43d67584b22abf038a0923b2a6e07124d397239fee684c7fe37cecf3d0555740

SHA512
9b3cdb71df5ba48e20d277d12c15ee19224ab76a5b8fe3ba82fa21762aee6b88b611354b57356b9810866063f29f27ebbcea9fa863f2bdb870187c0c2440bfde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
707b119d32384899aa55ea7c07984216

SHA1
f4fc09452ceec15620e31ac52a110efd6ed746ba

SHA256
466aacac61e50fa170c6230354b7881e5f7bd8e6a9aedc27e71e9910354999a2

SHA512
7ef5de2af25c87c4f4d1874adca5fefcb6a0e63a635cffe711d351c3d542727a0d9dd45b60950c5017fc419a73675dd0581851cc0b641ea1d58d028446236612

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9931bb26fcfb964cd44a1c314a125adb

SHA1
aa4f46b5592db134b229beaf250b4a80d5b8d88b

SHA256
d741feee2ae4695956df38a53757d8450d98e7dc28970be9eb79723c5c763b4b

SHA512
1c51648b7bc5eacbc8cdb717449553c2ee5747ac9fbb02521b8d92952fcf3cfd974a892aa5490f6aa509c69c396522d1836485509b1fb8176455e72e83954377

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
404de58d7736e45ed5720cbc8651aeca

SHA1
c237c16d8cbcfef971b199daa567d32594644ad0

SHA256
6bbb0d5d02253ee7c9b483dcb812e3c9ce0be03a89132ad18a06a06366279b9d

SHA512
83b94e239d27a9086f5a746c3bdf84c91e73653f7d3afa5b617196adceb0231d7a412af0ff85728b5d3f00975f497c6a254b2136aa125910ece6a47bd616b230

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1542913ddb50f96f7d4d0c4e549ffe6

SHA1
94b3a96273724185f86669401b3a2159f5b6c1f7

SHA256
1cb5453dadcce59e74d397eb08a5b5d4f18ee1a871e50492f55f74e5dc218850

SHA512
04844d67c755522f84acb34a61eeb2d0968095e03e16e031dbd790a27953026ffec885bf079b904c4e6bae4783dce78c9d06e2ec921c7d7e6f4352eed5f9cc7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b28b6c010ee111caab10cf2917b8053

SHA1
5ad0972febafbaa3fcfbecb3254b262670cbcbe2

SHA256
0770eb290f2e7779f7823817e0ac3cd32fa0c90e5b929db34ffdd868fd6ba96f

SHA512
6795fbaff8e0bf752c14486eb3e7fc981aa02d767a6b73a4fcf6a6a0c1a1b950524039d21b0778e3ba46c9fce9fcb289ce228760ef25ad3d627322277454f17b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDCDA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDD89.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit