dc9704b9cfa0e1faec01e42b5061510ae21663dfd3497fb5144d671b940109b8

Analysis

max time kernel
140s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b409707fb61df10966a551f88b7eeaf0.html
Size

16KB
MD5

b409707fb61df10966a551f88b7eeaf0
SHA1

0ef17abe06c74ff99699a04dae666fe6210a2480
SHA256

dc9704b9cfa0e1faec01e42b5061510ae21663dfd3497fb5144d671b940109b8
SHA512

0ca3d10cc4f501394f55b8ea43fa1b8f76eb56302c1d520e1172471adb8c8a3b0ee3b7019897d429179634446478053da72f9014400bea4994821b47476a265c
SSDEEP

384:SIu+vHWkC2GydecWTDVhwSTESs2QlsLhqHGKefK8P:SzsHWkC2GyUcCDV2VSs2QlsLoHGKeSs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415782616"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000d23fa0ef74826c6aaf3863b1e77ee78b496e229537713683efe854f9964d0d96000000000e80000000020000200000004e27e12efcd3e59eb98e8d084a5ee52eefbd8a9f2f714adb5013f927ba8de45d90000000c856615009388cfadab5a0c01e85eb189ce3e2e529693408e19e4c6d4fb412f76f0f1be7ca94f46c1cbf45a2a817433ee0e13117af86ac07fd41f52940c5dc5fe508968aaaf694dae39f6a206fff16bc4c89c8c6a9ffa05bbee5b98e08eebec74ad09fa9e366c67a543be7ee8566d4a9ec5988b478b6f6a8424bf32f00eaf13cc162438801e68450e5fa7b67d4527c3c4000000072dc6d78a26dbc8af46d6672bbac86cc7f9037dab21a952e081f2fcde54828888e88279a4528cad3cbaa8f94503eb5f635f9081be33c814e908d3a538d1af889	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F935771-DABB-11EE-B9D8-EA263619F6CB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ac5e00c86eda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000f5fa20dbaab326959ed5a3998ccfdecf092fce23bfd8d5730f484f288d98f007000000000e8000000002000020000000d3af96203254214d75109ca0b9e2cac2c492dfd51b8d01c3c1e5f046a22407f720000000d798263bac6167513fa1e24aae00c25631d5d1421d85e1fdfc989eb83a179552400000009114f9f6655b83be1f123be660192afb250a05ae7c87264d76a375819f71b08504ce293d5a7fc399ce7dfeb9cb2265312b79efa0285da82d8a41939fb6ee8a2f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2092	iexplore.exe
2092	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 3044	2092	iexplore.exe	28
PID 2092 wrote to memory of 3044	2092	iexplore.exe	28
PID 2092 wrote to memory of 3044	2092	iexplore.exe	28
PID 2092 wrote to memory of 3044	2092	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b409707fb61df10966a551f88b7eeaf0.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8487a9392673eabb23625d25bbd6db88

SHA1
c17c58ddc7b0703c256b4dd39e85f5dc6e67ea7e

SHA256
edaf889c7ab79e0f16c19709f87673859a867f0391f82f89fcba06e4bca79a5f

SHA512
a56400727c592a27ef28fe2f30207599fe641df8ff8ffcfc11ee2aed06e77aa64a6f030af7de837a1510a3ec503adc4358730f532fc33a970af9328016023434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98d8d8a59fd8ecce55bd44fc9aef0ff8

SHA1
9ba1044eedae8fedd5b3e566f88a41fecb02a015

SHA256
c542d36cdc2f44eee90b52e31a73baa2d7ca303bee1463e13653970418ab14ce

SHA512
32d4a564f79612689487dd87a6cb3c5ce181c8491ec74226fb9a61a4aecea1444a45fc3ee3ffba025a9b2989ec400d32a79a429d7a4a33fac718958e2c002603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93d1138f9feb5046f45a065bcddcd5ad

SHA1
00bb8e974b83c116185d15a09cedbac28f1fd0fa

SHA256
9966c03c02addcf10b064f79c77773a8703489f21c6017461180588982f272cc

SHA512
343bd3af324ae5cc7f386709e79aaf9d4e2ebd1ecfdff8a43dd7784a4f2e0c543abaf86ba5a989f04bd0af6f5aa0115f0e16d9b11a2c20d08df8280fe67909e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f06b7925b137ffc50b19da5ea85ed622

SHA1
51851e96c5c2993df67629d99b00821d61d5f7c9

SHA256
a7fa893eb4d17b385554ea13cf92c5ba1dbcf627b8bff9de53dc66e3a69cc278

SHA512
09c30ac4c6c10980875a2d3ad71768d3a6692c316f048a342e5c9c7f4d67ddf18233bafd07b71d932a4da18ffe7e6c9f3d7b92afb0e1d221ec049fc7d1a6ac3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe8a08d3257f455e7ba4b075d430a549

SHA1
8e45fe5661566d81a8646d7dcdc391ab686e4c57

SHA256
30fbacd58aaf202a8062585b5a8b9f8d558a31f56754ea418f2c1a0dbba3dc7e

SHA512
5fc436ff9fd4235fe3dcf526aca50b1b8e536b9b4dd35c632e07636c3c6a4523c8498cc8fc034e4c703c106f41863412061d027c5cf37054a6e6a2ef22b006e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08d88905f1ed5ab7b998bfebcb109b0e

SHA1
8c3789bf603916c035a2a793a9989ea96a06388a

SHA256
aa18e6be3fd414de31da968a480027edac538a9927de6ce6fac67262abbc9848

SHA512
3240d5633d9dede4e85a5b7045bf8802a3fe59cfdf20d7d312c776596e2a35f47a4c6d73fd1586ae2e4cb33418c2dd432ac7d8a7a4875adb17fc03c874a8e3fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e78ce032c9050bd1a9bf31988b45c6f

SHA1
f25ea25f6f49308d589765e76ce83099652522bc

SHA256
e9ac3f63c1448dae720ea406f44f1cff4fb7f3cdb7ec8d45b60802633c534af7

SHA512
11d362affd23fa8610549ac471feac7f091d2e8c9441db4dac67b9c13b6743c0e79d5e77adf83099321ef1ac9e89a8d4d4b568334ff6a99a0f91f92a7561a760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77da0560d7599eec70537638ff3dc7e5

SHA1
06d7e63d4faa6f92d56d60706ee11358ee6488e6

SHA256
e9e84bce77f2bac1b0e5d14299e85ed4a36fd5f64476af81cedbb31f14cb23d2

SHA512
6906c3843919d48a49d5db5a0057d2046744f57cc742b161720ace4617b53d59a3ca5e902a034f9f747d6b70237546b60fb05f57f14ee090a32ef7ab03395486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a93732a0ce02ec3ce24d8bc89fd0e88

SHA1
d31e3632799e774fa1511f700e0fef7f88a3d19f

SHA256
a160b14353fb4d13e90c6ede59fabd815f6e1ea1421cde3bfff694abded191ce

SHA512
8c5430697a216ddbdde67155bec5cf8d1f231fe0fd4657c4006c7051ee2cc4fd1b2669265b596e46681d94747c82d38d9c4e0106b19be4cc55387d142cebcda2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6dc7ecc941f945e076d1ca4a2292d36

SHA1
b12c7c036b6dd34cbf6a71e8c6197383357a9a17

SHA256
0b77a11058e9aafb16b6e515c08787365e74380431f0476064d9a2d59829b2bb

SHA512
c0518e1335bb3853f799674e80d54f1265fc9130f6d17d919e46061ac4fc5ebdff7ae5c4a124b78a5b1d9c9f1ac682f88af0d41b3de6ab1b07f529eec1feb150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
988ee858e112f24b87185ef76af372fa

SHA1
bd7ec97f0e613f6e3d5fc6f9d56906e9da728f1b

SHA256
874512de57e6de6d9883ef26f0cf341f7fa5ed13fe73c7d252a6aa81a4ad1967

SHA512
849f421ffd5207634983aca6caa5fd727cccb3f60725389c5266887e7b7207ad0765b4d2355a5c1cfabec2c075838ff576797707ea0f7b173b0d0b5af030bc7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8e1c0cca7c48fdbee960b6c76511433

SHA1
249daa2582ec639ae633352020aa8d44aad97719

SHA256
1d2f896a10aef8b37a3401e00791e70ae32e7f6fc0fd9e87ae090479c1be185f

SHA512
56ac42664752b8f7763e8469c84c651c4059a29bbe17f63f728718593a0c99c228068b4432a8e69ad9a49d9e7cc6ef8ae07fe30a0cbf4cfc967e11ff55835d96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc03b1063227d4b86bb7b2793ee85ef6

SHA1
b0f49af453b963bf7ba9610006b4da6b0e75e255

SHA256
c33cb7306b7151d4aa9b07442e1084b13bacf3695a6f61f3ac2815eae5007183

SHA512
aed0bb323ce4d65ecc7146c9e36c8b7d002d9442455b06bcbb404e10ba76e718347f230a4ae68550560c777b00386c9a0b375386c386ff28933e1d304c724b20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
492cdb0b28ec639fa4c1e2cae633631b

SHA1
cc2ebbaca135b837158c971141afd81643e319ca

SHA256
4d4564fc630497fc2b333a7aea33a69b40b8e1c6edbab46e8ddde7a556766c51

SHA512
036b9b665fdb065199eccfc26c8ea3569ccebfdec1ee6d05ce7720f7bb5c7de2e26290dbbc7712e0a7d895a8b40e7c70ee052da7b58d4ea7184026bcc74c4d81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2DF4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E16.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar309C.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit