2896e1ebe90347a650c2ea28f23bb6818795d53a49adb7f746c6dbeb8fed1916

Analysis

max time kernel
361s
max time network
362s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

751B
MD5

6d6069a6adf3e607911a4da8841d450b
SHA1

4f1e90d8733a46942884a14f7663bec9f4cd2ea7
SHA256

2896e1ebe90347a650c2ea28f23bb6818795d53a49adb7f746c6dbeb8fed1916
SHA512

df1d0be59814c438afdffe4a167e296a03bef0661f51945538d9013a5b17815a1baef798df502332e520ac0dfe092c7b04840c3bdf44b39cc0d11d5c82669e77

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6086ebcbedabda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F76C26A1-17E0-11EF-83FC-5267BFD3BAD1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422505914"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000846d3cbbe833c343bd4be90f5b9c4bb90000000002000000000010660000000100002000000001cfd61a10fdfc1e4491f03b660b274fd1cd5da199a20909ea43441e52b68164000000000e800000000200002000000098e5743284f8941e6a021f2e12adf65a538e004aa0e7156854e75bae1d6ca4df9000000070841ec54449eee47a560cb0b345b13cc8d0c38df7e5f563322abc0e4fa1688fffbe9b26bd4524b855d2560fcd956c0cec285f38a8fbe71bf0c1a368263a93aaef2abde82c7a6713de353fe8a4ca03f51cca2fafc36bd03a9c34cde8a7cc52ac24c91e7607c1384bf8f42f7908c5192586a9555f6e3c2fa0701c64ca54e5db218fdd70a32e88ebe41bc4b07273e90ae74000000032431a9e079dbfb95d27415757fde45807a7a2745cea1608ca56c3879e614fb5db854852d7bf14f91d0e40e2ced7a6b7337756eacf5aaf24044ea3636de6e26c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000846d3cbbe833c343bd4be90f5b9c4bb900000000020000000000106600000001000020000000f635282bfe81d685e0307a86961252617657c72e77179abb28eeff55ff9b6326000000000e8000000002000020000000efabac218da98c3eb2ea1722536c07ad8c03e2b4c36220774bbf590deceadd25200000000bc661240f9ba0bf8cddf6081bf7910623e9b7c6a3af9b1f29b1a861ead88861400000005a71b4e8739b13469325329036a62284ad282e317ab595ca2b112fb45ea620a83fca9ee92e2214592216f6f0ed87101923265fda8fd82b7cb12ec2833d22f40f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1964	iexplore.exe
1964	iexplore.exe
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2224	1964	iexplore.exe	28
PID 1964 wrote to memory of 2224	1964	iexplore.exe	28
PID 1964 wrote to memory of 2224	1964	iexplore.exe	28
PID 1964 wrote to memory of 2224	1964	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58472f21f94ccbf5768fc6827bac39d1

SHA1
bf784e1e69f0450f48d1e635dd854301f0c62c35

SHA256
4629b957ce9acc02c065912e7a9185e2000c40c264487ac7d3729c3a6dc47115

SHA512
6e301b7a799dc4f58244c5dd83e7daba986b339cf49d973f23b006370b5ef1e2ea7ab6fc7b32a0865c3da8ccc514a7d0918414b4e8ac9bf73b08199d418df3c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecca2d1b5b18eaf1831e8a9e6552934a

SHA1
c0b78808741348f05df5adbf9e4568437e704468

SHA256
1ab797be1582e0b3edae9885241adc47c995d5f355e3311cda0794096c53e4c2

SHA512
ef8d07a372c87ca485076527cc8e03972bd54dc6225b2c3122a119f534328f22cbc4dba2e9e2817a8871bf2da7245ed30bc1837a02885015c834c52e3a8ec2a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dd728bfea4c95e93e6ae661bb2c5835

SHA1
83dc06bef7daa110f4e438a74e8150407580d351

SHA256
2078f6c2ec83e2a02d3bc23e9e14d04458d81fa431ff7113f93d5a6f124897b5

SHA512
1e9250a9958d0a20043a2d64da19d3ec15a7b4bd127eca032b2470a9534b5276bf863d4f6238f3f42c4b04a2bbd5ee70fa523531d1a81eb8b37b4fa3326f6871

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fdb994ed7788634f0f9d031f18a71f0

SHA1
afcad23b6e90c00078d25595648186c45488af51

SHA256
60ef697b856a75c4acca7a368fca4e7a95a2265316175c2969aa24ad11718da4

SHA512
e6aebb9a60cb43e0946626f493f1ae248a28d2d91aeb796af93177ead3b739568fe647eca8cf2d760fd9c751bc8b095715a75f18784dc85d651ff796074b5bc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1720fbbab5f8087f8248df0a776fcad7

SHA1
be6c9fc9729961ced6a68b51a34dc461b5803b15

SHA256
2339e3a1675141484da6abdc28b8b3d0741def45644b1e81e85eade6b8f08f4c

SHA512
2aec074c62ef09fd6883ace9b5f7cc0c15c8102d762936abff31771ecea2eb77b4a45eeeb00228e3481348af65f3d4d762c37bce59135a7608f85962187783a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ba9be31e2dc0c177a7e758040369bb7

SHA1
32b3498febe40dac614b94c66461073cee85797f

SHA256
865fc75f23a08ee7bd68602c4c47e9525b9458901cd42adc45b21e61a4a5129e

SHA512
61e0717da1dd9f46a0c779c06495c52602b19f39dc8e33b9acd4accc75a4abaab818a5096665703f3ceb48bdcb701293221b9e9aba5315b98c6f02c2cf9bfaa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d913a0630020faa7c2d07e9688dffc9

SHA1
2b2c5e29c816815d0c78737035411ff3379e7ec5

SHA256
5f0588a5a006c32286f3517050d8f26a9541fc5cd3b696d498fc447491b7b2b9

SHA512
1139a61e523ea1c6fab64e0d16a885bb5f507d8f6fbd963593b9d9affef62dae1eb8a4a9c04344139378c63e3840443bf6dec93fb8eaa4918701ce3c057ee5a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c1dc75a2d7cbc7c6cb083e87fc7c0af

SHA1
501c60a97c431c02d1eda2864a5d1fdd455a9e0c

SHA256
984bd8da0fad78aecbdec1efc3c18f4c5ffafe86e3ca7230bd40df03da27cfb0

SHA512
ad42d0b88369f81161b699ee4935a2c40fd779a49ebd59b8dd84073e6cda8e5d46a2dd7b541e11725d5b14678f05b2edb8897f79ce4dffd0e8f93c5ebd4181cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7a4f6e3eb83885f172b5223643058c3

SHA1
d040d8cf2628703acca2dbdd78701288712506f2

SHA256
e4d5faca49d22a6d8c0b8c1afc80598f114f5b219c44e96ab83e56e67cefcebf

SHA512
40b34815006c1d4a6775fe2d0cc689e1e52284a85eb4552decd504bba91351e4ab08eb6e8888bbd60286637265b213837482375a6ecc81fb84ecc618c8f63d1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9600de6ca25649d6b515f261a521d4d0

SHA1
7a4aa57734304477bcbeb92223428e7e167e0eb8

SHA256
43f94abc5f0f6272fc1e085666e21754eec34b2aaa24d6a1816f369b02ed0bb0

SHA512
a5afa4e386c44dbcd10a65e6ee1128870116e719ec3cdbf1a88b5f0f61229c982c91335b3685fe64eaa5c1aca3533b9d63114923d1fe9f955c1d8d0828da57e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
67fd0112ecd1def38a0775c6a5530965

SHA1
cf5652d44569578a4e60c6d396f79776abf851eb

SHA256
b6e3b7dffb01e1687fc9d3088d6264eece6bdfdb006d262f1a4975bf7d892e46

SHA512
75c2a0cd33255d7a741ae3348ff0ca358bc6e4ff36858f97e3531da358f0636185f444d7387e852baad92368c159a5da6248ea630b11b8b856e1ab60a8db204f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2b0cc9e717c0c7c801888a91d976867

SHA1
44dcd0d04427b1e9667671b5a4a9e6dda99178a7

SHA256
662e482043052fc233af39f6cd90794fdef2e1403114be1f4a365c55bd901e2e

SHA512
8a0ac84520ad6109ac240a1ba88a762e06ce3e9aca296084880e7cf77462eb078e4f547095be8b01772f4d3ca2e1ee25ec89ae89032fc0f7ada1b945756bbf35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
699c96bedda010a89aa47afe5808d8fc

SHA1
328f574e37a328998c1267137c8f76d2f70b02b9

SHA256
ce738577a153bddcecd29663eba51cb21b473fb2ce8e42bf40b6c15ebc377fb0

SHA512
70f77a1cd3f6f2c5c88dbf9dd4a5a071431dc4c3342eebb5025af10cca0c5b74f271669ad8ff77c5aba667dc46f85b4a557d4f36586ddf49460fa44da87c01a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2a9f1e424dd8f247d60807ee436120b

SHA1
d48d34676477cf24c443f8204dd4201fdcb57da4

SHA256
98ea751843fda4c4ccb1b8111b34b1ea7b4191f437d7b2da34e570da0c7b3305

SHA512
1b63ae81fdbafd1855bdb4276985b2bd2dcb1a5a8d0ba5fa57dbeaab8c750fc92edfe8afa3240be745a39b326348b67dbf29b36a9486dede4f73fd6727add52e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
103ca5e53296ffd322833bf7473dfad6

SHA1
36afc6244d16891f73d61fe7beeb189d23cfc512

SHA256
a2e309e0250ad6ae5555e23789cdbcf782b04e09a1485bed8b25b985ba8329a2

SHA512
35db3348bfa581e5dca89821dc7570d8184e04d5795e12cc886716fcf1420359e28814ca1ab5d9802212d5316b834d7aad9a87e1c4c5e157ec0457357b974758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dfdecba8c1df02dfb11b5d1b35a6eb3

SHA1
cbf16992ef630d0d40cd9182af599bb51817c2f7

SHA256
d9dea40e9d5ede5ae40af0c734b0d665f180c1149821bc515fa564e0e0d049aa

SHA512
97d40526203a089755b9f36e3dc4e99476502988579d63a65cf9e33907eb23598cb7ab1336789d0bb1d7bc50bc9c5b707323244133d033651c692a2a1a0e2d14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71b6d8d09549bedaaba62ff7172ddc10

SHA1
2004a4cb82a1d50433b625d85368484d32ada610

SHA256
b192907c3b2bda0c094d752658d34a92d4cc4ef281a85af11ae7ba8f32608130

SHA512
0c639edcb5145aaccde4bb8943691b3a89e847e8be784c324f121c1e48fdcf93b0035936ad4095cc0fa46c69b515d8ebb4e01db6de1f9d306ec810441b08811e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2EB0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F93.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit