ac6d3f36922917f8ac7873fbc4a0a06334daf12c04bd6e4809ff56d7c2283a84

Analysis

max time kernel
117s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

联通宽带拨号客户端/DefaultAD.html
Size

94B
MD5

4f16ec7eea9de819080f1f377c728b87
SHA1

6b303efeb998e4d700ab981256d093aa68eb1b45
SHA256

a94a2e88474a43b2812f017bf35b2c978e5203f225110e1fb52ee2557501b898
SHA512

bff4782d8c914477ac1e87127544a66e48adbeb32d8a4ba4f7cbc6c855dd28546315aba7e7468834d11b160aa516b1535a9bbf7c5e2db7af9ba9adf1abada55c

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ed41fac1d5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000b3dad068a7e16c3dc0a5ea2daec522e5ae59a8c4b1c60025f6bf301008a3de36000000000e800000000200002000000009f4b48570b6bbd3234380c3706ffdf0531a6d788fe8a543f0b1d7ca9fcc16c62000000048c7ebbd34be3fa2d0f9d65c2f15f5d2413936f891d78e6eec9228286ecd9b5c40000000912e60bebb3c2ffd0f1451398cbdd17dcb65df9007871084243d94cb44c585329ef509256d236418438d42ef137205463d4c65cac507034887648343a1ff71cf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000ca991e8787583bde452f99db8e54315b84cc73a37a72f585db59cd9f3d56b7de000000000e8000000002000020000000cb072ad466244822fa9897e8adc27a8467ff53cdecae50454f3f563503c0c78d90000000fd4e1115578267c7aa521def0cc750e20c66782ed9dcc9abe90677dda640df55b4e970a08279a8833a8df2ffd0b57582c76b93ab1c74eabd7dfe01c42032c30796a291b83acaa33c511d355c0ffd1acff4abd02e0d026ad24dcf6b7730f470db1c6e98bb3cb57837d08662f5538b22ab6eb555f572488874b692f2a1e42ecd08072206c89b03dd30a2a635b9cf0d836240000000940a5baa676ab7cee30a66b2a14df4d9e87e3c590604993d08e0612b1fdb68f802d72c364e92eed57d632edad9460c30c52ccd2e166e3bd92cf70feaa0c61405	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427105044"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25668B11-41B5-11EF-A69A-C2666C5B6023} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2112	2072	iexplore.exe	30
PID 2072 wrote to memory of 2112	2072	iexplore.exe	30
PID 2072 wrote to memory of 2112	2072	iexplore.exe	30
PID 2072 wrote to memory of 2112	2072	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\联通宽带拨号客户端\DefaultAD.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a1804386010a48e0da284b305c4c9b1

SHA1
2e52cf3ce1149462d0c5b6a6385c6b0549762bf5

SHA256
584c31e1d65e59c79fa5a6514f77fbcf19cde8a5291885307a23fede96238cea

SHA512
d302aa3f67179dda740a4208e3f7c3e2fe84fba4b873eb4d89b175b72b75bb7343ae6c73b6053bce673444cf22b7a47d65cfd7dec9ef8420aebd9fca1f624587

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79c0d82f7439a3f02f37c6be62aec20e

SHA1
7292546d1aaf524827f71f34bdcf63014fdb93ea

SHA256
774e18baece402270462a26a18777525d7dd3f7f9821fddd87a2b4172667313f

SHA512
70d4e71c373c6a1b2df45bc15df8799f79c78946d9aa3b3ec22e8f22def7e94645fe2bcee19dcd176b0548c56f5b9a742994f4b9df7a635af1aaace3aabc8af4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ebe3db87d78b9f85bb71fffe1bac004

SHA1
fa8969ace6ca72c4deb9d4a458679bbbc4fd0f69

SHA256
24cc67cd5fe2446f19f4c3b16c54ab1ef3a008bbe4c1ad07ddbafe2d3c3dd582

SHA512
68ec14f50fbf60a410426fd5fb4f0bfd6158ec941c7042a999f64ee4d52299783e371c60dd5c093e474d36367cd81758882ad7a9c15d42d6caa6e2574145a66c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e11f9257abad98d93a8a630c6b569746

SHA1
08db4e16928dbbd0104d85fff487574088806280

SHA256
8cfdb3d7024b9b6ca11cb42efdf5923aa6ab065d852b7a3926cafde83bf39522

SHA512
9450b081971414d9f353eeef6871e40f4acb46d89e92e119e44c17318295db2e9bb977e5c3b5dafbb2b04a76a0d7dfbeb49f65edc6359102e0d79bbdd62e8dca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eca2329ba11a5acb1f3a8d4fe44b6c80

SHA1
0718f5868f7f791c1e81b80cb6de0ab74600dafb

SHA256
aca1d200353995f63f44b397f32fc38d6b54ba1ef6630ac85e59f6e4e73d2fed

SHA512
52e4deaedf3368428e8e3054ddbb67e633a504848c6cb52fba7f4761216f4ba8a5bb869916642ca536ae5c1db96605e8a24a7be9997455b50547df0720ac9fb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56685974a76e05b7060f82e4bc0a3c3c

SHA1
949a61382e943219c78e811109d99ed71f66674b

SHA256
45732833d960086e5dcc58507436bb3cc115b1828eda5d4944981f2fe6b82c2f

SHA512
b5063b3f17d6ce3f99067b8bc137a799d94eeb6acbda894076fc1615491961e576b9d796bb10005a21a2dd75941032e206224b3baafc33fc32bade476484f0f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcd50fe3928e7be237d191d25be87621

SHA1
c05a859426deb26fdcfd12e79de0537a770d6a0f

SHA256
757ec6198596754c25865457b6bf9de779115261d41043bf46ecf577a07cfa62

SHA512
fda593b8d4cfbef183e5ebc63d96b26337652de8ef6f3647e95e89500868bfc60715e8e989b85591f2c887f15e796db9b877303274eac265c8b084938be15b56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f0bde2a601966d676e22fa3dcdd55b6

SHA1
0ea87ff7e99218d4a4e4488ce7ccdbb4f75c80a4

SHA256
4cd1e17a6ed235db8a76cbef9ef94190710d93ea5b7ad1623df26ee63b4784e8

SHA512
74854e2298d2be2f378a6609921cfcd4af7203224cff0c2b9fdaa93a736247291717cd75e1b2b9e2a9759fa974d77ef94aef9c75515fa47e0c586545a1267fd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3219187d1a670dff09dd343dc709062

SHA1
94c67e1d708f544dbdb44f06a150cf3d5aaaf89c

SHA256
4c13286c072f57d68876fb2fd84e131d7041090eb9c6534d3e09563db8f47909

SHA512
8e184796f3c68444772972757973cdb5e4a0a3ad36fb80f482b8475863214166c3ed4f483a1d88b20b0e7b6d057a75cd3d31c408f02dec6610c760f149a56652

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f0c78e57cbbc1f427aab9bbf96bc73d

SHA1
d7d9ef1d82afd7694d9f869860cb6b1707c8904a

SHA256
5afb8c29fdf7dfedb750da7c916cfdfb5f0a641bcbbc5b13adeea8c816b10a91

SHA512
0a8c001a4bb7545be0d137ddfd3bc1e36689654c0695c91931dbc4a0b576e97cfbe8c9fa78245bbbad0038399bfb07e7f1a9ddf27ee38856cf5be2a85e8655a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68d29cb4f30a12757c02d8cc9a80114e

SHA1
b889ac50ad93ac456e785eb68f5c515b1a0a77d2

SHA256
0df25ba849358c8ed8f12c57469cc1377e5fc981e5dc65b3dd7cd035d3639316

SHA512
a13e5f4fa90687052d607c5394220e7fd5d077b3a6e5b0359a4ad33dd34a5a0ab18df19dac8f41b3a0c3bcb7d21a4f6cf69e5c26962f6c56ff675f62b5565e5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cbd68aec0d44812b639154b41cf3d7e

SHA1
8a9aa339b732a3928a828687a2a6fbebc9328eec

SHA256
d4511757957f01bb07b73bf3628b5176a9c5395a99da84e92aa820d7c31bbbc0

SHA512
8895b2be7e3800973ea787e468ae98dae8f394cff19d32fe3809ed31e9c02bedb89ea5ced0bb843077b3bc39d25f115151078429a2771a521fc2477ed781ffff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0af819bc612f3ab06014e45842da5c34

SHA1
2d2f8fa8160aedde88b0dec8abaab0483d79bb2f

SHA256
33aa2eea11f8de3f3be4221df704c26b729d4930573c41aeb271cb68d65afea3

SHA512
4d2c7ddd23935597707250f6f8af5820292151909200775f2352ed3cbf2317480aa93c8f126d8064f3240bf7e549bad714eb197feb22a45fa9dc70b1971fd34e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
871fba982a7c8683785c5031d09abd96

SHA1
7d18bef45358068089dd748f54e590664ab7467f

SHA256
be83e2af8eeb0e29a00b7817d58c95999e31065eccd891f32f37f1f25290446b

SHA512
578be305e35160a39ef68071754d795f07a10625ab9fcef490675123789d1888ca3823825c06c443909a404205a488dee4acd83f6eb009cf39c37de00f9bd547

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb321cde517614a8debd1eab77c389a3

SHA1
5fd1608278d3e2f6b1ce23f320df8b89fc79917b

SHA256
d27023cdbf86e668eff3cfac260bd44c21a3d622318f7f560b51a8e18a778551

SHA512
aa351de2751283d1263a825a95e04f3186beeb6ee54ba316f145e299738fda513ecfd87cfa66fde7efd87bcb89253681a6229103ae16921a0e1554611559c943

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3df80bd6ace501823d2f8b13fc10d981

SHA1
616abd4205523538aea19c63cb92f694a4282be8

SHA256
324291eb8cb41d6bf06a5e5df61fa12578d1fabdef3088856efc23571bcdb33a

SHA512
c1bfd2fde6cb958a5e70b8f04da93e8a804ad9df6e0043d34f52e89d2c2bda3763073a53fdd849136bac02284b8816d27305fa3fd7e0760928cece6276504373

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81b2f58015dd243c9f8e21b401ac6a57

SHA1
2580d22b53f55eb8ed8ed297dae8a2aab8b0f4e7

SHA256
9890c63488d016761053c785817dcb5f311efa9651af02bf33def8417682e096

SHA512
49c588a0f07b101f20e7703b072b85c66fd96b9199ea0dc3ff40ffec6455d586e7ccb96b5493cf7b81be90f4f6dd48076b0db3ebf72453771d07f472f54e2f27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88bd6c6235c38ce54060e63bfae613ed

SHA1
058f7d62f2f2229fe33349984cd8136e135b3e5c

SHA256
2a59d53452a65cd0f06c098ab681ccda5855888f5263ae9a4092376324f1d5ff

SHA512
535e12e35593ca104502e331867f82c0c6ef1a565ef0e125c0a7a58f017f57916c57dca7b3b8f38959efa2b64cb91eaaeb82b785998dfc197a1e9c2fabdd1706

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab98C7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9978.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit