b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Analysis

max time kernel
133s
max time network
129s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

YMKAXG.gif
Size

43B
MD5

325472601571f31e1bf00674c368d335
SHA1

2daeaa8b5f19f0bc209d976c02bd6acb51b00b0a
SHA256

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
SHA512

717ea0ff7f3f624c268eccb244e24ec1305ab21557abb3d6f1a7e183ff68a2d28f13d1d2af926c9ef6d1fb16dd8cbe34cd98cacf79091dddc7874dcee21ecfdc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000001736bdbced01f9f5154190bd16e8b8477ec35dff2a386345a79a853484ee1d86000000000e8000000002000020000000a706649b4351f6ede49f787654e946eb3cd9fb8dd825f4531511d4f4bc75e8a190000000ede7074b3774861a71232fa80b02b77a7377e9bf5e944559e4b63ea9ee7cba2b35d45f08005a5ffc81d9324fcc1ab2a0adadc76f7f00c03957f95d4422ffc1fe8e16b3817cb82837e7d7e9775e2da4960904b40f9192da291af8ba983463eba8746b01252c252924a5a4d6f168bb998aad09ab36c110cfaa535047a1642afd4bb5e72c4db60a36bf0c72f5d51ac743284000000064c2a711bcd4e419657d2bce5d4e577de581f5439fc45a74cda0102c6c1aaafef594f87af073e0742fe25d397a04aa426bf7a1298cded3c2a4be555e216c3a96	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423374493"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f030801dd4b3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48E88E41-1FC7-11EF-9A67-52FD63057C4C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000095e792feb8508dbcbac43a41bb054772bc5c417f5950cd56a41bb32358b01fdb000000000e8000000002000020000000f1355af246a28f3f78806b4de6ef9f0bcf0777ae1dea8f7735bd69ccb07e4e0a200000006bf9553864aebdfaa0c625dd600b9d33dda459d7c689b486c017cb8bd94988a140000000044eb3eb8a8af59df87f85bdf62db8144b2ba803c954773e3ecfb8ef02b3861204016c9d6087efc295d53300393ad0ca7b34b8265354c30880f7ef531a5f3ca3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1712	2976	iexplore.exe	28
PID 2976 wrote to memory of 1712	2976	iexplore.exe	28
PID 2976 wrote to memory of 1712	2976	iexplore.exe	28
PID 2976 wrote to memory of 1712	2976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\YMKAXG.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff73664f03779b156bda07aa917948bd

SHA1
f639419e89ea19b6b2edeea0674f9dc548a20cf5

SHA256
b9e10fd91270e5b68b1be013e28439c8adb8098a1b2a94bb0040fd0948e35fd9

SHA512
8060f8e7627e631f7df31bba07404753007f7f42bcce3f9fbc99ee3a09010f99f1c3c31f8fbdb392b334a4837c62910d05e3d21b36bb7d882a3cc08d0292a065

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2638d4a496c00db3f5c185090935e554

SHA1
b34e675965bf663bfd8962d143f31b16686bb3c2

SHA256
3ee92d3a50e17f318afbeadc384b64f9f9732438435d9579f1759b0907129890

SHA512
a9351c7029118fb18bbf6dcf3d91c45591c96b4c17dfcb2f2a5655ecfcce437d9515c129da231d0d34c18d3d1e2fa9ad36b8f70a5f1cf83abc9d174a7edc991d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45e4e467c4ef6ae6c88b1eca63a0ec2b

SHA1
693b711105a744a136ef2b6d61cde62d2868a81f

SHA256
cf3c66ecedee242bd2b11c581304f390b1003a916ffd5584cc16b9ef64d56188

SHA512
8154d1a9c7de4ca9cda2fde00f038d4806f72bfebf82c1189a36a49275314ce9b0220fde24cfe3e051e46956a04647de04c71492b5598fb32d5493e75e5cbbac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad1bf2d8c52e3e764a95dc8520db3744

SHA1
b7aa2b3d2db530239df6b36169c6ce14252a0305

SHA256
e339c18d064a8a3d44b3f50595725f48241c1b11e833be8d3118f6e48a87b105

SHA512
553b53875ae4f209c98fb8bee6a70fdee38c7208b6635c14a5fe0fc1e03bf3b232bd9da8fd6c200cfb05b4ec9c1eca68de395fb7d13359109b5843774d4799a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adf7973d3f6e929f3516f6ad4ea76843

SHA1
151390c7b0613d11865948f8b9b30b3ef18d6515

SHA256
9430b1246bdf81d8be9988674ca08cedb360e1e54d9641c6122b56d1ce324a36

SHA512
6a8aebdf0c429b9a958c27895e309f2f56a97775a84dc011797d062504027f785de3aa478e4f67f5a1fb790d5250de85a330c62edfb7160f1ba763c68cc9460a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a227779037e0d85eefa43f4c22e72e09

SHA1
c4155f6ad800cf3254a2586056f30996c630ef77

SHA256
e2addaf3c0e2db4dae350f2fc81e3814f63777869df9476cca0528128eb38a7f

SHA512
8f84aa8a40f5c73b4e452f4f44543c9196ef217e79bdebf47cf8394c8d8c1e75ff201860d2c415cb01f584310b46f1ee9b1b979e510dc3cd9d239681f4e22c3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5717da210ddab916c552b11f5d07c5c2

SHA1
db956affc9a16dc141875fc13b63ddea759bed5f

SHA256
4e45f6399ada3c39990f3e6bdafbc467a8c260e5288390302fb25284bd82b16b

SHA512
3afec46fcfbc6a01bf9bfb72167d46565addf78d245f7b7adb4f846a7191ee8ee27bc08f5b5cd99d90b8b56181020f6772c836a4c34728069cdb379a3102ac3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cd510c999652325412b3c0d4f09ffed

SHA1
e69e5eb4639e30d5d2c1a7d733f3ed0e61d6f563

SHA256
e441a66c860687307ca75be063e9327c4fd9c2c95c85278074f36c1c9b0ddd97

SHA512
d60af4e4bab8e58f0aaed0c27a4016e5087b66b2918279f3076cf5e3a9f4f7b4a2656a6a5f750ea4076207640abbc79e2546776be467645a7257700c9e7c1c52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
606cd0dabbb04977493ee4939512a11f

SHA1
a82ffdb1c0cef98d42cb399cb1ade4ee57964a49

SHA256
48f069537c6edfb1e582786584c354ccf696746694943998d30a139c1937ce76

SHA512
5a83125ec98d68061d9d07c75afbbdb9ae7f2529f30c274ed5a390570b21cff8a9e241df691e5591cd774e41f21092968857b3518d67ce93014e0ceca6e609b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b5892eed4d19bd2ecec7d4fc4ff6ef4

SHA1
f556d48a12c079dcd9f7e83ef3f8673030d007e7

SHA256
8b934ba91bf87def0912dd0ca5fe27d60c8dfa3194c87e15bf2ca46cd32438b8

SHA512
295c88804472f69f13ae63b9771b461c09505141065715aa359b2f64ebfeed96405dac82469c98204b53b783b9156f2e2e2a1d2c226f5b956680add41f5254cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56cad3c1aab29c0a09cdef8dd117f245

SHA1
731e718970c8b359acf9fb2d839d6919792056d7

SHA256
0225493b3665a7b7c5888ddeb8fb872483e1f8019325a2a8d4266d2b3c269497

SHA512
ec41223fa54fea0f1531b5b4a48e1c2850b2aaf9d2439ca24c5a08645406f426743f4571c8acbf7b27199792633eb39be364565a9d44639e2d1fd8518ed56161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baa2124ab6b486c9ac96c268fa3b6955

SHA1
c4da5d750ce99796694a183b50de318ac1cacade

SHA256
2b44901fcec0ebe9d65f08d88a62b74897562e01c38d164654e6dc3d5ad5dde9

SHA512
91e94c9946b8f6153b257d2ab14f6bc66452c11f82523679e44dbd7dc2dc760964bcc49cc63194dc2edcc535de774f08d58c21a3e8d894a1b1c5ce8e130e9129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a17a3c521448ef16d09e39c2be190e72

SHA1
df77ceb56d02e99a1c49edeb22be53d659a3546c

SHA256
389ded71da7f2a12b14ec08153d39aa58032e80b7f2ab4fcf43aab001e98ee28

SHA512
90dcf9526ceba04fb107b0d1269ed228a3fd093c136633f4f2530a5d2784a1dcb49a51d894f170ad4e677c1fc9841430206860d351333aa0c7724124aa09c778

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69cf33c42a50c7196395797950ab4605

SHA1
63c5186bd4657f45a5963092e50bacbfa557bb2c

SHA256
74cc3d91c6c05fb823d49bd35c8f483f2f45e0cc863c83fdb49d2e67bdb5029e

SHA512
1db23b0f1389b53ee42d6ce5825e8822d6c5d0fc19985f9450e814aa427acc7aea71ee21a5b53557a123188919e0e99e456aa243020660f44717847ce428de01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5786719d400f29b2640350d40d5b2f52

SHA1
e5dc8a00bb330b6bbd25c3416d03552c0f086a80

SHA256
8029bdfeb03cb10fd2fbc62f5e5565d18d6673a06ad3e306f9ecdbfe45d6e418

SHA512
d70509f56ad943a6637e6edac227b956ecae2d86b7c6e65f09b655092c5e1d4dd544f0290e5892ad18bffeecffe568938e6d590049e579251b65065a5c1c6b99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f187b7871dfa99784c4d0a8b233cd458

SHA1
758d5321196bec208893ff50f7b2804f5e86e069

SHA256
d5c3c82ec4601b76d3392214423c0da957b47b4ec8238fd4515c90d9f6b4c3ca

SHA512
116396bcf761ab75979a1f4453bc0eb60fa202d9db3de05741ded5aa565a902d3411ef94ac20bba76d8a5b3ce26f7a71bb39da32f900bd420bdc7dafdd03fb67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e09d2a2d2bdcd4a5375b96febec92675

SHA1
adad3bbbcdd0f235c41e484df9a4afff8264f083

SHA256
a3f600f8a5f6bf2a4943896c482b63e9074f58298e1726165434bcf446a101de

SHA512
94f01db75b2ae9766b4489a2449c7928a25a2f8eba3d838c85abf3315f611020d0616101b79b3231288362e6a2af7993dc03d38bb6a0ecc32bf5531746c8d93d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1BCC.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1C70.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit