563d0e670d8ff0fb4cdf870452b30e945ef34c01f9c4d41a52d44e0066d2ce6b

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Archivarius 3000/Help/Dutch/About.htm
Size

2KB
MD5

337ccc4d4905e1d6ff306ce861383bbb
SHA1

6eeaaceee4c611b574b7af6f3617682f9353a899
SHA256

b5ac62f07c6b4ac5b80eef402b854b985c317641a8e4c7b71b9bd1fe0a130d5f
SHA512

0ac03fe6ba7cdf47c146be24ed51f839ad584eb38858332387fa4ada894c4fd476619beefae2a54e55bd6356fcef7fe61aa0f81596eedfba109b80cb136a12f2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d00443451dc7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000074272f826775f5b2ba9d0c7534d8d77636f6e8a1416ee9257acd81f9efe87e2b000000000e800000000200002000000049aee56c1d8925367d6ece47f60ac27bef5874a61aa4f35b3c2646310fb303f4900000008dc0e6ec8f7d7e430ba6d20054d0b28bddb564a78e30a8f7315cf0a9403755d6710c28aeaccbacfed1404a1f1ca4067100dcd39a2d254169f64cb9d1480b1d220d0037f831123de89ba5bfd44b3197b48c693bfa4faf3c0545bedf4787564b94dbbe2d9d00bf1bf46edb450cee1a76c46719f9e0513a533f081c9c2e763c0a120ce439344b396c1016d99799825b4c2a40000000e7d7d49b57dfa7a1c18a0c3728861afa2a66c6ba689256e8ea42bb30286a7ce1d71b06aa676ad57f479fc34b365edd9b9dcd4168095dbe0a7a70849df6e5f097	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000c569fcfe408ec800181a06f19e23c905f7cf545393443d4fc9a9a0df91e8d8dd000000000e8000000002000020000000edfee814260b746db707d0073ae144df25ef8fdbb4cc375588ba49853f74a85b200000002d89e82bf817e38ceb508f3c05058c4f5b3c499f1470ac9ad267fa1ac61eb49540000000482a516f02b1fb71e5a103a782b09f31e8984d52428479c971e6cb82029e33893b99cb15ce50644410aedc26326ceb372d9b3831d3253118d948db143797af9a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425494984"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{70BE6D21-3310-11EF-A649-4E87F544447C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2420	iexplore.exe
2420	iexplore.exe
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2820	2420	iexplore.exe	28
PID 2420 wrote to memory of 2820	2420	iexplore.exe	28
PID 2420 wrote to memory of 2820	2420	iexplore.exe	28
PID 2420 wrote to memory of 2820	2420	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Archivarius 3000\Help\Dutch\About.htm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97e467cea0ebf300f14cc5d828b1577c

SHA1
4f0031cc19678d791a4163f506d6285d48ca9a94

SHA256
a56c1e05992c7b76c6593d484cc87f389fa9454ffdc0fac431c058740aee18a4

SHA512
274788e63998ddce646f20cfb113b68159264156d32eb91b81ef24e8424f8fea414010d3abba2e027ab2b6a5d60e2de8087080fdb7d3460787b384eea597d460

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88e88afd777d77869add4942596122ec

SHA1
098afc8392a46bee38b6d7043f16ac2633f3cbb4

SHA256
789f28ab17beb2b0719b204c2c92489ba709144626ec339d1401a69d5b965864

SHA512
06872082904e80a9a0679ab64b78dacc18bc14be1cd2150ebabe49a027e1a0c5493423a78846a00c4441b76f7db0e1f00d44a16941a5b426e08469a2639ca1be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b287d13eaeb46e7a976456fa3ad8775

SHA1
b7bc4eca082d157aeb9057411b2bcf6781499c09

SHA256
36b023f9f0545945b35d2ed40a4207e3c51d6b0be92a47dc8ec902634a8a2aa2

SHA512
98dc58a1a60fee759691ea2fe64e8ae72a039a10c872c5929796666843c8a05a66f3730038dacf606e8d377075f3608b214b461f0683324dc42ef8e31b6ba58d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
582c8b8654227ab25030bca0d2d54031

SHA1
6ce0f6f52a86888d8405b6ee523f47997e38dd81

SHA256
aa3d1fc42bdbc0c6bde709ffa6770ed3ac6ae7151f4143ebfc0ef77cef79d17f

SHA512
f39864a55ce4bff47c34fa476303648aa5a6d9c37dfae49556a144c22b0b16c2767aeb2d13e4ea722ca7ebc5848118295502bbe2bf5bf06f54ebacfb9b7f379f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fccd4553eaf742a22a030e75e39091a

SHA1
aa6a1ba44bd2880a89cc4ae53778b7e53db1b676

SHA256
330fd015ba571007c73c721f894959f2d6d185d8a16970347b869c9a99cfd97a

SHA512
a3233ac6b14e3d046bdb736091922b36d61b1acd536a2b1071cc8db52ca7993548d7b997b18ff404d3947764acf44034a0f4bad750e2bc140790f4a76b486639

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ebdfc8fccb31fe40893467a53375d7d

SHA1
961922fcdfc12ddbd0c85e0c664eefb630b0cfa5

SHA256
da19ea487d12e58c24045fa6dc3c5064e74f95d838d7ae56b55be2f2c4fa7397

SHA512
f5e99d916c9ed5d1466a7af15cd4de16bc750ab42667a6dfc1231db54dba3a7193b25ab1eb503eb40162369ef7753b82e87a9c055ca8874f4342ac78a5645399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca86f56323b8d7824eebc4d1b3412c72

SHA1
979eea1d9e10cb319dc90e794fbd305224967b43

SHA256
a4fc7cd25e7d3d3b4123fd580a35bf35269ccec1fed84622a24ae6cabc7cdee1

SHA512
cac3f17631958cf257be4498e71e39101b543426f8d2fdf8235aa39f928e3ef53fb617a479a77252214bd26fe0b7744b4befa45ffbb77cba4be799af965d9984

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aa85b168e398b47023e5d114c8b62b8

SHA1
df5acfb722ef56bea32cb453c018833d094f02dd

SHA256
2899b994a86b7273e90c383671c1f2fcf0c3653f7d43de1f8cf04ffafb6dd403

SHA512
a5498f73a36c9474269d31e36fff25f18907b391eed3de84f0ad6ed56379a6ad2c062014407c2274310cd384f5ec61ddac1422fddb78cef99751a5e7161ea931

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
533566d1ff680a7783443366600726e7

SHA1
5b81911e1a9d567e993209252ebf73f30b74b3d4

SHA256
0585d3052a371469ea5561a14414c40169458502847fc6490cb9ce3f9a7852a9

SHA512
e9c0292993c4f5326c60b63a6ab5692190a4f2d388af91899549aaa1cad39989184169f3a4fc5c1cda6f4e2c332e43a4a8aa764188c0fedb87332fca881a70f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7865a55b1d6b8aaf20f51ffcf70227e4

SHA1
5524beb0383bffbeed1068a843fa23f2ec9929ae

SHA256
686bee0b7afbd5a38bcce03145e757ee8faa9cd16188d2948bec05fc06034dff

SHA512
504a20ff6909a36bae1b3918f6350786f35bdfa0134d39dd548064fd3010dc8ea72f0fbbb74d20500fc16dcd429b1a35117f030d18cf69b26177f8ec93c5e8a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e036ff60ad00d961dd4c6123f25d782

SHA1
0bd5d0bc519c695c266c493ac3ffeaee2fc75f63

SHA256
a6947e824c55fdbe84b13980a57de02c786f5e5867b8f99c810721fffd4eb384

SHA512
2e4682ffb3b371638ff3b8de2d8b5a3cb5f195eb3a2ab98148e851f812fb3eb716a456fb715ce7ee1aee1e48f95a223cdb23b4d3030965d6eb149433d862bacd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8637496d54eb8412ab838c4469f76e6c

SHA1
78809620a682430d59459e8c0c90489e692f0474

SHA256
cb978dc816fd31192793c7e21c460e8198bdb45a423b1776c7d22e7baae007da

SHA512
d955e57acec34901cef9b7911dca37ef8465f1cfdf00d214cf68b9433a4fbc170da20f9da3e699ae58bc172808a62b32a2d51afdbe084495b2e98a85b4db03b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c73329e3a5a87ab2083f109d4a11d62f

SHA1
5b07860321719df987a10c4e62e7a303313c183f

SHA256
4ebbd69be2859aaabe51852fc06ddaac4e70eca61544b36ed073348feb8c3389

SHA512
69ca2a7a161e3b1d7d49333488773fc3d39f30bfd6056200dcb70351202611e2291181705e43d0aae1275383dedeeb64ffea20d3fbf3315c680c4a1bd84e454d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19719f2383e63944863897c9542fabf3

SHA1
c4327ad50575ff7b918a751f4f6e2e3292d78879

SHA256
7ca2fe5d3184765a67417299a68429d04e1a0b2cd4467971fab5548b491eff42

SHA512
97d2ed2a6746c4ad0888543385c6f994e4f2f877b75f17134088d73d901c91369ea42a86f930c1f5b97813466a9c678d3668b2d5bbcfac642c1ed3ab3b90c451

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51e508f1129eacdc48bc05dcc41d4ab7

SHA1
310a8a918b9fc17ee61830eefedc7863d6144624

SHA256
38f5b4abfc6ae0dfdb540b93ee1e08e48380cdc997fa17787114af36eced30b0

SHA512
b066e57a09ed6b7b2f739fa842990c3d03618ea916acc1911e27a8d589cbc7b555a3c5a09e96310d5fd1a8c33707fc0005f1364e727e885330fd29e5b7cfb860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
715410a996d86b6f37f52c1ff0be18d7

SHA1
1858ae86228fc72aa06c697842f89248c2922177

SHA256
9716690fd4e27a3336c84e5827e17580c9d457a6ce68c997508cd5e543da73c0

SHA512
3fa04c629a5bf4a32164d5b2a25ee07a14684a531906a14746471011805f5728a871bbdf0341ab40eb833244535c8b2870fc1fa59a457579173ee7a26dc346c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f16a8fb99e7f82b16581432fe6ef9a0c

SHA1
aa5744e77c33426f2c734798747986b8569925ec

SHA256
5ee819b5585197d4f246c1e09ee0fdb620223110291c38a53ff10342f8491982

SHA512
45e60e8d1015dbf11456922e2529c1e008539e1632128d7ab9352133c8532764809dffb37c9afafd2cfa197b24b3aa35e7e306f1144f904472ab3ec809a73ecd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab368E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab371C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3731.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit