7dded8f77fa2abd2d0654137c16b743bd0fef6be292cd0d95230dc49c167ac2b

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mtv2.4/视听在线Ver 2.4 清爽版/ad/Copyright.htm
Size

2KB
MD5

fffeb351d3a11be81c017e92ea0e09d6
SHA1

e7895111e8c6f97b92f806eac9fec5fa71b02051
SHA256

5b8b9c5974a638a9406842f65352fc2e8d177bace2cc2e0441b07d65e79bd0fb
SHA512

0acc9f1742464d23887e5b83995cf37435c392889c92dc326a79b13575e63601d43f68b18a0580bd6a691fee53e249365502beb6acf307dfd35a6025474d1db7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000a99da7d8811a852127d938087d319df146f7cc5d1ebc83fee4f7b5a4cad9ab99000000000e8000000002000020000000e0087a261b5a68eb9eecb8da7ed5aaf63ab3448a01a119649720e37a81d71715200000007e29ebd724090583c33aeb0083ac6c538a5a349d9c52422e67f230884786e42d40000000823d01f1bb6513dbea89a07d60da2f1eec63b7e129017a884f79b5d47a598b9615b71cf28ff166daf83d721ebc9d4fa0d1baa50e5a4af84536d8b590cde8c2f1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419873163"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000028b1d741a79d734603054379f6b74bb75494c7294524cf3f5e3a8e95ca0c566c000000000e80000000020000200000005ee47a470ebff845b4a1352ae3245473844bfe8ffc2e789e1027fa041353c3db90000000df5a937a1d7ccc1430f5b627082285d13f8f7ac58299ac953586eaa4ca3d07c9403202fb16cf21ebac7926cafd248636e95e646eddb3571e7436ab8eac4ae2b754f70a91e0417419db81ed02a3e2bcc28aa5da9f683236917535bfa7b24564c2520ca12b42465c41ebcea73422d7d3382a5100224e83b50be4d5f9567c0cd5c508bf9ab12a42bb6000c0910db34ce055400000009dcc21bf5b86de2e2be56077f48f9e3408da317fc16f41bf73fe73373bb52797e558fa7fa658a43ab5ca49d3c0ca6b8297b824bbf8ab11c0737b2fd0b4caf65a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70021cf1fb93da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1C750DE1-FFEF-11EE-BC03-E626464F593A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1876	iexplore.exe
1876	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2560	1876	iexplore.exe	28
PID 1876 wrote to memory of 2560	1876	iexplore.exe	28
PID 1876 wrote to memory of 2560	1876	iexplore.exe	28
PID 1876 wrote to memory of 2560	1876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\mtv2.4\视听在线Ver 2.4 清爽版\ad\Copyright.htm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0cb27415e6fdc4a07cc50eabff00573

SHA1
8dc7b10abce16201268672e587980cfd2f71c76e

SHA256
211f45d8ba950a91a51205c84743d54cd15bfdfb4c214946d1067d9a691e4625

SHA512
f20c475728428f32b679aaca5a342ff35330d47c62e440eeb81c981e1d8d66619298d36cf248cf73886d456de288d62110c654599ebc0e4a1fbd7184db2212f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11fb50f132e11ad0f5c7337ec8e7bfca

SHA1
a339c4cd637dd5db15a83ec6c06d2b916b6d63b9

SHA256
765eaafbc2574497b8d0d86e91ff194fee3214b1f459ffb4896eb079b9364462

SHA512
daf00eb663a4a872dc8349e757ed09d6b68ce9cef5660337d491c4969dc6d28fd4e02391713d24fd97b89a436eac744d57438d7308fc87d505ca107b15ba80e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57c32f7461a84763a5b30ae1ffeefff0

SHA1
68bdacce23b67d0adc8e8574870dd67be8124bd3

SHA256
dcfe275c16fb3975145baacd3acf9bf39b534f26848c2a50060678e398b411ad

SHA512
2439a9803f3aac42eb9d79c8a0555b604c565031606f271f50b4916356c91513f8831d6f3b5d6508e164cd5bcc14c40347206f961e5000e7fec7cd469ce02e6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1f64f57a7cad422fca7bbbbe33594e2

SHA1
d6eba9eaffebcc60c5179ac5bcc8fcd7dd569b0f

SHA256
7b53a7724813f643ee1b7932cd45444244f24860f6db262f5aba4a12906c73d0

SHA512
99d80120a5a264a1c3021372e8de9d47fd947fae253609d8cd9bba10f45817c84e3ee327916da216502eee5f96d4aa12ca877f419f1b0367618d3b9954d67629

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc879a97034dbdbbf79574960634894f

SHA1
ae807691b877e7f2303cb7816c7ed30dcfb090f7

SHA256
8f30ad388db6e3ca76f618732b738b5b7576a0c5183958e8b7f737a0df1ce8ef

SHA512
f048461f0c015f3ac0a2c668ef739b2d9a3cf94747914ccbd56eab6010ad3e94abb74211c4a9bfbaba217fd4ccafe3b8ab8169dce2b3d6d78256bbdd31bc9fa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
beb6cab39233cf2fbe5b6da8aa29f8d7

SHA1
24224e500f5a5c88ec0413f2670e7b407a20f1e5

SHA256
9c620a9a1f98c878c8cabeb5e8c887dd56a826a0e9a05f8cdbfcacf9ea4e8284

SHA512
fe6f906bfaf6122cdee2a017d8cdd6877a046c0fed56e6a99be5f9a31462fbe028591934cab0e8d8f599986858acb10ddcfe0b2f22f261d136a844be421cc264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ed5ca60073e7a479653c20c62c859a0

SHA1
9e3ae0796dd969bde04e9bef6b546d0da82e001e

SHA256
678c3cfba2e5f18af20f4717dd9c0e8c56351a1cdfd6f4582378f4cb2219768c

SHA512
7886058cd3ae7324265f9d936df5c3ae0f2cda95f46c9848daaf03e3f3e40158848f3b1851fb10a75173ff41f330db473cf89a318b3e0df5821cd759765530db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d993b0e951518cd39d878d180f23cd0f

SHA1
49e74f4d87dfb7837c1b4feb6b7e7fce93a6e8be

SHA256
9d9769c0a1f94ee9d519667b0a73be3b0515a2917b3eb6a565942d42ea4fc196

SHA512
16c0ec05130608e661a3760a42b088a63868f49a4e83661a04d270adb486842555130b9d62c2a08b61409467c09eb656510efd872e6a64c4713516388239b3e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d8fc67b7fc5a667ff7ecdead5137ab8

SHA1
310d38b342327918ad615b05d740a9965425e326

SHA256
9d4d374f347cbddc09b22d446e806d2fe81178f7a77ba15378d0f36805551e14

SHA512
58ba72d526bda79551e20e39c82d73934f749d07393a0eb95315d3dd2a686b9cbd8382a1ffa9cbe1d53a56469f4c01baf9b2fb63fc61b117301d501d689485a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b36ca4c19b7b5d6eec63599b5f88f819

SHA1
d75629a19dbe9e27003acaad6c9d0bb01faf4abf

SHA256
823119a731efd985ce5b1bda7df59fad0063858dcb9545ff7aeda52e8656593b

SHA512
042051a846577b01fd0a3bdbbba8d16edd45904f51a444684af5d0924bf5da41a0ae62494539eec67748206b91f3d3bd046776bcd1e71b35622d2da097006ea7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e9c3f10407500e882502a45b02d23db

SHA1
a6478c94644ba034054525a38c0aee24b115a59c

SHA256
92b11a24a7f840a69a21b52c519ace246d9834731703f1f895a5bfb5db73e242

SHA512
f761221a94553183c8ba04d69a6eeee2d292ac066f8a62425b76658f6b64d91e318f1097bda33cc3a46f2e9a237ca92ebf2c576222125bb742ac9a29b8989cdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b21dd106b3cf5e49eb4cd6207274bd5

SHA1
d225c0ef02a0700edfcaacad39e0ccd0df59ea06

SHA256
3cdc2c981d291c328b1529adf3b4a92e2435e44c0a2b99ef4e3030b58ff21b67

SHA512
8a5501cb2a09df52b7c6885a47aaa091b398070254112dae9ec5e4c9b7725bd0d68725d915ddbe11cee11f544109c9b7bc33cfd68201ff06adf1882f06c88482

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3aed33bad577a1d77d0d60f25f1f6cd2

SHA1
8fbbefadee67b875708ba75c3269b64328c83b00

SHA256
3dee95343347408db80d43492cf212d02f65b9290a7758b203a7e33965af3250

SHA512
6dfb98acbf421165b10e025bb8ab6028e6e6de244985d6436a23ec92e099e4b1e4586da05aa0e3a62e6b2c9f35ae521261557ac07a07034855edc40abd69e4f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78d5c90563e8cd438f9d1b99e20cc298

SHA1
a000814319be38173e3bac7351e481e56a67e2e9

SHA256
e8202f4f001eb26a0768c597804ee51544f6ace2c5f2d67bb2bcb14afa489eeb

SHA512
66136ef07b28c0685645dbc1f349a6570a6aae1f6138d0d62b407922c8f3e0012083d7f2b1a1a88e8c3df34853fb06c4a7b5fa44d4cbda57ab876b8c48a8074b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f86af86f7404ae7d953cc6e9ce80b60e

SHA1
a2d94aa643b6512b6a1729ac2945ebe783da29ad

SHA256
2c3821b635d5a252a03268efe7164c994f609c7f8a989475a7ebbc74d1f060ce

SHA512
ff98dc763f6b30e2040e752de01a4c09ede3adf6d8079a8d5af9b5857081ca4f09fa39e054eecf071667220a05098d60940a8d9218e859233b16a23dbc431c61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a93fdda96140d1ab39e793864a8f8b4d

SHA1
9a9cbc9e0c1e4084122a1bcde5e36f3fb396e21d

SHA256
dff85f754f284a088a0a6e2b30d2be2d69aa213543b7437f680c24b951a76a09

SHA512
cf71687f65c07bfb064d399342b890eef8aa242fc1f564e4067ae2b3ad273c0b754aac069cb111f8e59b411ed20d583c0d6cecb4d2bb9dcb62a3fb56380a3dbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43842c53397cb7c3d5c393046df8b994

SHA1
f81afb8f9e6e681a303be95b976a2725a2a1297a

SHA256
4af436dc6313ef479de27c2658ea09930acf65fb0fa94bdc530d5dfab8c31aa3

SHA512
3d54e56d36aa6a9df5487b89ffb77bc87c841dcd70e3d1abac61721215c1b94c2243a92af15ba33297d9b39d55786a9ee88c649defb3627aa954846ae7b85c3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F0D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3049.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar305E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit