hxxp://g | Triage

Analysis

max time kernel
1565s
max time network
1567s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://g

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421848357"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000008eff93b8b89c99a07bd8700fdde1adfd0a444908211902e404169affb3762882000000000e8000000002000020000000b0eeefd752b1cb6217453cada19c235aa851c967fa145f6c3166ed65d7d32fc190000000cb046b3fff3a7ced472caf5565255c3372fc4447b3130d1ad2ac8108817488fc6750c5478da581c0134329ea31600db980b45b9a13749de5236de8b9b5bf3e96fc776ad7e0f2bf376b52e61e4e29ebae9d231be3e4ad2fb6c5a3b6b8b858dd9f9c278c765b7c541d430fcab2215a2dd95af559991573b9c41d6473791d7b8efd1ce66019ea0a2fc88ba71e44b544e61740000000cea1033fe0dd98c9ca419da7c198ee168f4a12b839475e12ae7345d5b8977ab25bab7074fef21c927f282dc7a82d1592de121a7ae202f86ed89afd9011322550	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8F24A51-11E5-11EF-8E7B-D20227E6D795} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000005994b68c6653e4f3778beb12a0e1487a245ff22ee42c56e3f7e04e93a4966e5d000000000e8000000002000020000000f4130946128bf9bf575e75aa22dabcd254618050b791939c32e4e907d6979c392000000037cf0d74fe42f735d1a75da3bcc1724601093e09fff14a757d0f8e293a1b0b6c40000000a15af9605c95ae1d79424d4707147bbdcccdc41b38a17fe34996c1ae7f3267b30bddae73f10039ec386171bd005ab73fc501d5d5040ea42382045a7f9db10a3a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d069a3d0f2a5da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
776	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
776	iexplore.exe
776	iexplore.exe
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 2992	776	iexplore.exe	28
PID 776 wrote to memory of 2992	776	iexplore.exe	28
PID 776 wrote to memory of 2992	776	iexplore.exe	28
PID 776 wrote to memory of 2992	776	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://g
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:776
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:776 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4cb2e2169253636e2e6c26bfce6b7af

SHA1
888615c0a887142a6d03223c9c7e8c2161b17576

SHA256
8cc28356d20db1abea796620c72e29686c1b15ea5770d59fdeff9274c44d7c83

SHA512
040a81a9e57fe83e4baf961c259b624bd53bb5e0c0c552fab6418391b73769944522d6b1516a6c4239bc34f727719bc0ea91ac2dd5ebd50f0dad86b45cf4e79c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d1a77a466867468a6c8b2d95cac41b8

SHA1
7ee0af8738b668f29b05a8d94d871ab116ae8780

SHA256
e8b1f4eaa1b6d7a6437e21231eea4dca94c7230664be74683920b354b7889af5

SHA512
f638ed5f34817f39000b75e55bb5041139dc946f6495aad98080163fe5698da89124674991b32cb1fe35f7dfe7d71cefb0014f0a5980431ea55ee70974ae46af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de64f15bfe7a6e8287ba9c1011cddbf7

SHA1
8d943e0af6f688d092a90597fddaa2a789c4cbcb

SHA256
49f2070f52cb9552f1a5302d396feb2e3dc395695ba0aadca9c37c296d50de17

SHA512
30b41635eac37d3e75f98149f7b9b62c3634fd582c6327e618e71a9f094765ffeeb5973319dac92f815ef6830aa6160bd69d53df3b2faf54526752909644ae58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9106c16f2fe0de0ed98271b077d22ae2

SHA1
93a3859db86bfc30d7d0d43c2ea42c477a6999db

SHA256
11022aa6f41113e53f04743fded7d8e6964f84c40bc0efa1df5783030b1f7cfb

SHA512
6012d3b17f352442408774ab6ee38880da8dcaed7c357303c89de22510d55cd26b061da4757bb1d1e808993d5e33f00d379b1193902cee62d7c6fbbf2d98eb5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c0ebee301e0f38c12949a1f16fb42d4

SHA1
59c23e67a773098ea2091d964e3df620c7899641

SHA256
83f61874530971b182102372daf6e63181570e909056bf8a3acf8aa939286d7e

SHA512
54e567dba13733c08c70c13116ca6eabd61f9853a7c7dccf7d077661ffffa78ea0917e49a60fa92ab0b0e825ebcc664489ff719612511e1458d045d3dc35f48b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d902f01254b0df9a36a8b2e5691b141

SHA1
c9382d90d502290b996e8dd9d0372725a952d79e

SHA256
d8c8c39b6269e5c13a696829f69acc96b195d46435865a72d0cc577126bbef81

SHA512
0b2c28796b327258df519610c223217593e5b3667d2b549088e3072ae7b084d69e0a1684f09d0e28646d3395b6c799c39cf550b75f497897ae2cc2657fffcc5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddf9a3a51da5552222e7c283509995e7

SHA1
53e48feb07dfecc20710ea4d7d511a6d6cd5f2e3

SHA256
81cfedb9c142a8b81afd91c3a5a05b082ae6730488df8078981b5451c04519da

SHA512
30d77878d0fe356a076d172ce610248f3f0ebe25f17dfec73937b12b47171d7e2e9f3e854fda23e078451d3813c7a129d6816710661aa63531dd5c20c83942bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
036112868dec78aa32771bb841e02334

SHA1
6337b2156d2b639280d9f19701f4fc80248cb505

SHA256
02f438bd8ae2403a532ef6e3b90daeb1bd86ec5743520674a1c867ee6b79f110

SHA512
c16d676608cbdc930051cbaab164261b217b6df18ee3ac678aa2762c3afa62d1e480d219863d5390fe5e9a93911fe20ea443ab12b250d93e14142e1b76417e86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0792ad8dc2ccc3492ff4908e2760e69

SHA1
038d89b884a4b2453e0f314f5f1a3d31e82eedbc

SHA256
e56d0a2fef58873c8007566c72c2dba544b95ae9bda5650c028b6c55be2c2fa5

SHA512
9df88bef6d99849f1ee9a55baab647afd653838c84406a0ec310a05e13bb884b6edd42473fec76c6073897436a36e9ddeeec43469c86f6b1822020e316f1aacb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
454c153201cb15119084fc694f0fe220

SHA1
b2bd6f33f3e6ade7da7709bfcd0feacb61c0b5fe

SHA256
84dd567612b8e0ff86a17c7c52f0e8f3092a80e1730d6415e6272473e221bb4d

SHA512
9c72e33666798e13512c720c2e80910aaa841da1e0dafc504f971c94741e730bab978f2b6012ab27438bc929a0ed654e9206c4f4382e4e0d0fff06f91f48ff3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c4915eda264b4eb863c0066f4888ea5

SHA1
8256472586d25011b9c87b8c9f018dd2412aaf7c

SHA256
b6623079e7f78a6d81cfc3f38941c47ec07f89e5330fd94a7c281fea64dd210a

SHA512
e1fea8b1f9271082585f3fd97216f7944707828062204c45967b8f4aac639f78ac62d8a713517de154d7da2bcc31aafb000e3e5ec56d3109a2f32a0b7480399f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8990d9049b382fb288faa4f3e50d62af

SHA1
027546308fd87102cfc409174ac266bfe7408c0c

SHA256
b60020fd1a089197c3c70625f025a8ac966ee854754df443cc1309930eab376c

SHA512
0762afc089d06fb2e7a331f9357312c64d4c803dcac8f5c66b3ebaf6bced1de04f9839456a02cdec0f64cec821bf3fe223066a2360f9521fdf0930c63ec4eb65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
650f89456198c8d319318d9c0c3ac251

SHA1
2aa64befa64c1d226992142c749e5036c886eace

SHA256
c6a99ee9fae0fbac1ffe6abfeb5b9f11ba8a250e5f17baec246689601b6be31c

SHA512
770feb985580d34c9f0b248cc02145af46a76421a4b0382879326d43e03ad13512220cff75e2489b4b764d3b84caac65a648270cd4aeaf722bd3c32edbf6a013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4f06409fd275421315020a30805c175

SHA1
bd18302614b9295e8faaf7767fca6fb332eaedab

SHA256
4373b42785f5056498f85127c97fb09d9a2ea379ce4af018e63fca74db251b4d

SHA512
b23e11fd744a4c053c3293118abed2cc97e6dc70b2bbebc41e24dbdc032a8007b14dbd4adef939ad642e70467341e5eb70dfd01bb34cd4232cac9ce6bbd636d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42ee526acd88260b8d49cf229332225b

SHA1
64fa27b4de90c61397e130433da5b7814f5cc471

SHA256
f69d40535c75441bf419db6ceb204080e7e8dbf42adfdf676e9f37c7fda12af4

SHA512
fe25867493b92c56b4f1b2a243eb25f137042645be2c8f0e6818976effd6d5185c49102143fefc2d562c2ac4f0a7426d5d6a4578cf155d77de9fbb7ee0dc819e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f23d56f67b9767c1aeaabacf21c8f9c0

SHA1
0b51d30b6142dd0855bf3d634254fabb106a26d1

SHA256
27f67504627ef48e684d43db52ab58e57f065d8506b8f90b095afb9ddccbd5a9

SHA512
2334e874db5f606231ba98ebba3a3fcd6571f22c2d3eef20fd45e7881ecf735a9e8133a236b3c1b78931e7665c9c46c097b2031a2e45b3ff00af1ffb0a2e1aec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98a9349d337cb4d2437ef0d628adb90a

SHA1
0c65c630c587898a1c42493a6a9adfec887c738d

SHA256
42a7eabe5a4746e6348fcd54f62f0b1ca1625b825531f9617833b5025ae064bd

SHA512
0756363f114fb99755cdc7a9e5c671d452f5aa2e449de6b1aca587af1c9f329f1be71baf417a6e1cb6e2dafd22c77afe0e64dcd1fce576a8110793e03e3856e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5b5ed494bf759e3d46006f5f773116e

SHA1
803ec7504577e4479c46cc43e3d844ac4023852a

SHA256
ce266da1e5d663caf57974476fa699bb088a33c1f06803ec8d51395f1e494c2a

SHA512
24411d2e27237fb66bcd177d5af417182fda645ba8f0135288ff490281498e849a8251a816de2e8099e1b5e6cefe7605a0fba747af23606b7058111e4a5f34ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
264bfbeada5ff174bbd2eb3597c7c702

SHA1
1a2671f27a9fe82e625e9994b45d48b0b85c2530

SHA256
d17adb6ba61099953b4fc26b78e66a1f03c23d1be0c80702726fb5e75dfb2bfb

SHA512
421258caa7a29877b3f956d0b357ff50eeef5aff29ae7f86cbc4d624fad4866b0e6fcbb9c1e88341f9765afe167813196aa3ee5edad75f9f2e6c4de35114b999

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4175.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4286.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit