e393ef21f5eb81b898f79f4c53c58396fa161a425ea9a07cefb5a3fd55c1aa7b

Analysis

max time kernel
359s
max time network
360s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-12-2024 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

43KB
MD5

e77fe874263674ab8f5b85326b8ec851
SHA1

320b8aa1d7b0320eba19cb721ef4240c39a6d2c8
SHA256

e393ef21f5eb81b898f79f4c53c58396fa161a425ea9a07cefb5a3fd55c1aa7b
SHA512

3b2fc00a330a5b4d4c049f4b55f033f81263aa8d07b0d84b418a0e7115f882ac3cd9bcfe7312ee8ef82f33c0b4821570280e8671d84865ca04815d0bb7cc4b9f
SSDEEP

768:D3BpqhYGM4evT3x8gAts0s719TFXWt7aXfsW9l+X9hJYFnzOMD5QBdxaXfsW9l+d:jB8hYGM4evT3x8gAts0s719RC7aXfsWq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "441572230"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d96f4f6585c6ac48812bb8bcea23e55a00000000020000000000106600000001000020000000efe83bff878bc691ff495de632078c458cc915dbef7aed6bf01a51a84975145d000000000e80000000020000200000007cbc8e3c5e85f4650641be098f3b87094661b8dc64f65e69b150d5accbd0a03d20000000b36e553dd464a46934363d3012e3d6df8a9669eea0123da1efc77e70afb1d617400000006969cc1c2b6238a3628490cd861db5b2e2d082161855604d4f3a54c3ed4cf3fd43d0006a6dee55b9726fdbaa49a314d9a413e51afc685a6f5ecb3f8d858748ad	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d96f4f6585c6ac48812bb8bcea23e55a00000000020000000000106600000001000020000000454c55feba67ca88c2615c74c65068dd26e857801bc7dd5795c99d02777de299000000000e8000000002000020000000420350806ecadd711024d01c5f1997acef86f6e9f709c7f1c82389903da3a14990000000d71887b57006ff4673b4b088d49d5b6ea9856d50396435c274387883e1971fd62e3109079527d180bf59019803ac52242848040fc074897049f723091279b2e4a2fc333554cb73280c49bb888b51d2457aae2ffd8d4e51ce034c28f6b0338b1b30aa5e5ae8b630dd0a8308883af379c5ee5b0f2b8de26f5dbf459df9cd73f644dd7203273462bf5af7083a0c1c2352b140000000beeea9ddeb3eb1fd6f7128abf7d004e543453e32bc00c8b67211491bf84514516626b30574ea47a3c23491c19d0e7e7c27788789b52b614fa1a29415dac4c90e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00395b075659db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31F46F11-C549-11EF-8DAE-C28ADB222BBA} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2764	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2764	iexplore.exe
2764	iexplore.exe
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2384	2764	iexplore.exe	30
PID 2764 wrote to memory of 2384	2764	iexplore.exe	30
PID 2764 wrote to memory of 2384	2764	iexplore.exe	30
PID 2764 wrote to memory of 2384	2764	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2aba6329cc84ea6feb62bc00021f39d

SHA1
c2d94bed807ef69224fd4aefee8aab325c264126

SHA256
703e063a566e15bc66ca545dafa4774504fd681614a22f8ec12aa36ae316238d

SHA512
9bebdd0e482bd6ebfd5b47fbdd377aab994a7c2233c0b2917236fc46195b316b3c17aac6a5fa00355f4b03aade9210b7d19a5afcaad9f3a689d857bb146032f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a917e27899b28c1a2a62c09a5b754786

SHA1
78c05508c3642f9432c257ac44d870d125686e69

SHA256
5d36c9fa38d0c03a816269a461229f1c54913c8dc29f9c8b5ca87b77135d1c98

SHA512
4a8646abc35e5aa6a8b752b70f05cc1788036c568c824c7efcf67af39d15eb4ec058cc70661983dff48ac90577566d7576dbafebfbb9b178e60026b8757c05af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcafda73b57d12dc53d1c0271a6fe0b7

SHA1
3038ba3f407ee60142a57569d9f88256b785584b

SHA256
54eb61c3ffff17b431861b31ed8bd5c53792c62d7da1f86d68119ad2b6ffd51a

SHA512
c46216f7627cf86c4ef093a99a7404e3912b59f47e73b1a0957f5c1af60448c04de1e680209585df63c666b6c042a9329c160d652572cdcf132b17cb76ae0b9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc330f4ae3349db26a5c604006d8822e

SHA1
22755583b12306c98bd687005db78adc7b5a9540

SHA256
bc6aa45f4d63a79e01d464278a7d6950fe44878e0fb542dcc611e4fcfcd8f25f

SHA512
7485f9cfca96199e95e3265b9fc8f954c607e3dc9d17d8f5e4d2c1ff02726763dd5275cd15d9be5dc74a8e78f1300131df8dcb43ecb54dfa2ef3deb5f5b7167d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8eb36364bb6b3c8e640a092c3e9c914

SHA1
4bfa8ac3635f7d44dc6efe595fc5a4490810ab10

SHA256
5274c51731939a99cc828986b06de003f70318f6dcf706539c434b58702b7af1

SHA512
ba3df126d4960d4f91f10e6bf695ed6783219e5856e5bfecae5ac802cf3741a918036c76767673918433ef2e9bb3550ca187f3fe9e4774c3c0cfb78a7f554c5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc634737fde78a71c42149d3b2367d78

SHA1
863421d83a9118544b9a67a54ebb94787686eb66

SHA256
f75aafa8e8aeaea518ff6e79e4aa16a46dd8272d6152dd4e6ef1a84bc3fef1c2

SHA512
b7c3d9192235db16339e15f615f07e465728f7441a1a6a52abce5acbb6dbf115324702891f0a03ae416954c7a4bb53b56bf814442b6d024859179b1257485384

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1f1bd40b3e90b79ce31687ab5345183

SHA1
cce9cc0ed7902b9848d23e89fde272020cf9b6ed

SHA256
cda7699a08838b497ea69e397751082993a6f57dc721bda36e7ffd1384228b07

SHA512
f82485d21d014b625be512a7a93ab9d569c42db3abe73b5c0bebdfd98be426ee683eb4a16ac57edb21a9c52d866b099251d4773f64ec855a2438be236b99f597

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d741daf4ac65d6115c5827a5273fc14

SHA1
0f89cb55a735c65c0fe234392a38f07b964d1702

SHA256
a141275a468efcbb202f1b300a9fce7f68d6891deaceea3c63f2157226af9bf7

SHA512
0826a8ff39e7452b34d3b7311ddc67c04bb6ba6c53e94188310e7c91361f77e6bf8292f50521bad5685eb577f0c63b884359913dbcda6c1b69f6c38ce2d773cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
387a571eaf6c5dce9eaf6e5da9fc757e

SHA1
0003b1ce991211c4ffcbf0ac18fc121e6c9635e8

SHA256
265705e5b235c233839c185a171f7da94c52affa785a3ea57b26f6ece0edbec2

SHA512
55af81696cc29388c6ad85a3fb5047e62aa56555c3f6206378ba52ba261b13f21fa4373bbcca9f66cf5b5310cb74bc184f9df68ed27379393841423583026dfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec15570eb444183e280a3443d429e7c7

SHA1
eae7f563a04ca89aea2ec828e07dcec2ac5cda43

SHA256
6e52db284846914582821e73ea90a8bf42bdb22342e6c7bd0f9f4df981f6b3d8

SHA512
89831e329e67c57682a7fae64eb3affef107c7f13b489d94a75532273de51e1f5c6e1e332251aee98c45ee3fb3018e0ced93fd347f470f73420acdf037610c6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edd172b3f6e46e2fe376a8ef8d2ea034

SHA1
94add195a8975bb89e253757b5abc2f8944b8cca

SHA256
5ad5166247a05674d1f2ca40ab1b93475bc96a92b1464a13de5647e12ab41836

SHA512
d74c5900f05edabe62e8f80de82f39fc6164dfc5893104d634535b69fc58a5e5824d9af40f9b13a758869285309a89d4fe78dbe0d89c16b57ad16f864a93c260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9f7008f78c149d6772660e8b6d7f7a8

SHA1
cdfe89f33907bf3971568f20d3bfef3d9dc0e313

SHA256
594d4595091f2e99bdbcc5e9e5f9187724a66d17516f4a26d89491ce1c225a7b

SHA512
78897faefd1bb58f7067b940e1d9c52cb232fa2fbe4547f0f099020c93ece439a0060cc70fd50efec72532a68595b98024313ed4abe75b2fa90c409bd70dd62e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fceffcae270b5a2d82e39d3977f020b

SHA1
6e2f64e96db3aa17d0dfa7a23283e7b3bbb9bea7

SHA256
a26428ec2549f6b8859285c3aa3c7ff2053e17092b45f023b183dd0db13b44c9

SHA512
e94e29d1a249c7006a87b3f646c75553ba0082c8bc1fc94766049f19b03ccf74faa56179096fd3f6d0de18b9d6c7c53715b0f6ba30db60e70d407c059b692807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ce8320677f9b9d099264ba6ecc95a93

SHA1
68ae43335b285a62e68936bf2d8210303fa59242

SHA256
887f378a0ddd0e46232429cc15a14d968862167db40db27b8b851a93f4b977e4

SHA512
91e83ab2db18d17082400dddf6bca3c766f553d69c85a4b9f7fc5b8e8bda6c6c21842571e1c1346f01ef77c0b3dc8750f93d0e8888b1fe9df8cc103ee88760d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75765d8f29969b401e2ea7acfd2026c6

SHA1
fbc60096f5136a6ccb0986be79070a2177de6e71

SHA256
ac3edfc99ffc38ab27ed48a69250238ee217bf0f3c8f496977cb3aaa125b0a05

SHA512
3a612a1c7171a842f4e85968f3b61cb94e9bd8b058fb44c3eb7a5c43e6c550a44879ef6748bffde5bde5d662d7cb320a38c1ccc8e535d00901f4f8af15c61da4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae904124a6fd71b2f1cb66f7aad5531d

SHA1
95e9725cb63e4f05dafa7375b923bc965d57cd41

SHA256
e4b71cd67ad09f558219e82e1885f85251b1f82da1a86c18305caf483b4be9e0

SHA512
4a436a2c25eb535945d4a60bfefc37fffcb835372f27410212ae436cf42dd18298fb9c5fc7e7f0d27783c06e2629b354a4c911c4669f4eaca7b183adf243c47d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
738695ae0d494b66d5ac06a64b9a8445

SHA1
685c0c4e70e61c8e93268d02e061a7f72fef4ce7

SHA256
968e8321c3553e18732cb50d741fd8b3b9d3af99c430dc45d627f7b18ae3f8db

SHA512
364f82ddf77a96a075ee330d600927a3cbb754e259d0dc32040b1bc55ccdfd49e2744048b1d0c09472a1c923014549a940f45153e6d2145b15f41f887c4a1419

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5FDF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar604F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit