81636601699a9e61c3acf71e8766207141c804a9f0832a65a8e8942e414f9068

Analysis

max time kernel
117s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 22:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b9dba7598868421022a4ca875895e82b.html
Size

895B
MD5

b9dba7598868421022a4ca875895e82b
SHA1

1369a01562827fc393c7a5183835f5692eda1c2a
SHA256

81636601699a9e61c3acf71e8766207141c804a9f0832a65a8e8942e414f9068
SHA512

fe6462e552880a6b8abccfbd24611868d86cd764ac2e306bf6a12428f8d30c1daf126293f7dcfac84b3cf0a11d1a6afd3b1d07884da66e273826d30aca62054a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BF26F961-DCD4-11EE-82E1-DE62917EBCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000a0f7c14d50a5374e2dcaa1611901241d903d5053766f71785bf8f65d865aacda000000000e80000000020000200000005e92900b642edad81137c104169695acb5d39eb23dfab378cdf4c0ffbed5c864900000001bbf52ed3217f27cad0fa31c815e32db9314f5a4901dc3eaf43b1dfaba6dfd9f7b79075538d67efc724b24abbbe3edf32b0a11e72dd5bbe36bb44de0b1ea2827c5742df0c1f1f3dc16799a1115b962565ba1b5817c8974b7af3fc5960d8a97cb5be5e20ea03957e2cd425519dd2713012b0da71e4b816991baf6cff0d6ec3b493fc05af78253886e3e3e267ab8b98f9440000000c10e02d5a75f0b9120251598524c55fffb2abaa6ec1330fd8ad75c34f1730a22b573f07b405caf8ea78e0165c8120eba55239169c0fce58ee2fe943d69283181	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000078020fddea50bb9e2940bc94708581c2144be6797a34b16d0cb0d63dc0737d64000000000e8000000002000020000000a7497c6a8a1c26562a38f4d01ac48ba60fd1a85ae524bbf735eaadb08695a1d820000000689db4a395ff7f9692e1f5e26d4c44853529bb59296bb5c86f275a3bc6beef0d40000000d512bc1ddb1d5055334d7abd68d2f97dc73cfcc650e8002a895bbb9b8a3f4a952454c243e1c6b3a156a3b20893cf74f3d5a547fb51248edbe1d008b5ab9305ea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4015b986e170da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416013559"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 3068	2188	iexplore.exe	28
PID 2188 wrote to memory of 3068	2188	iexplore.exe	28
PID 2188 wrote to memory of 3068	2188	iexplore.exe	28
PID 2188 wrote to memory of 3068	2188	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b9dba7598868421022a4ca875895e82b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d182d55e3f3bd019056c42b75b763deb

SHA1
13a841e3480bf365f8112888f4efa17bb536d927

SHA256
6b2dca658e2ab40db2d0856d7ec9b147334e4eae9bd58f6f473ed098bcf50233

SHA512
8d40ce13d9b19a00f76c1d90c4a5cfe5812e0808c9f50418193a7f8c521c628530f79578901a9f640670d6611b04c6323e8c50cf762c8b8b39ff57cd0a74526d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c6b693ea7b5e3bf7aae6408a20bc6e3

SHA1
90f3acbdf74d2e04e5c73006dd9b8944b1bf4568

SHA256
52b99cff0114d533c010ebb2eff9b37d01b262a39801c2931f8cb4c2203c309a

SHA512
271eecbb014e5ed5fb9800f3662fd6bfaeb0c29213b64f8f6eb22ebd157fa1f3b7c554beb021dca760d09bc157b2d4e7ba43915d9c996f2219effcec4784a289

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d637553b801304ef8c9ef276af661bb

SHA1
5d1a9afde2bec626513833600997f9075a56b8ef

SHA256
306d08e37ccf31c0c752726bdea312c9ba21a6ae54bd115fed96ed42b075c359

SHA512
bec9d21fd06ebaa4bd3e0949445cb67a63b074d2cb195ad3af24495208b5f516d6d05b3cd1308c4001adfc3e782256301113d76eda6eac897cc7e2f05f5d4dc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a195c9069ea4ce7b7436d0a27c94b3d

SHA1
ad4c6c37fbc1f9273b5f0de76704cc40882b1271

SHA256
4cd46e86a0734fd0aee3070079358226e4d55b208d09c7077b250bcdc7f0dbeb

SHA512
e3d2396576cd8a0be9893d6223d4ae2358b593ce0880e6b9a4d703df110ce3a56c3e7128ebfea4e04b6642c820f032a05d9208e5977585b7708beb30262ccfec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8cb242c10e5daf409f6253f3bdd4b74

SHA1
48fde68f66ccd56f345248059de52643954e3c75

SHA256
b26f9c80aefb54b4727ee5376bd6b84a7ac0c97984200a30c0b1b1e4d0f5760a

SHA512
b725624d9a4a56548a87467e7fc0ea31953f440124d3e976c02595d52367f717f11dceeedec2d7771b50ddf08e313ce48c1c82486bb6d6b9cf9596c507682835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4cf81e191005400ab9477df78096dfd

SHA1
646892e2a6dd41a4ff90df9e3b8f6d43de84629e

SHA256
f200d01196f70e08d765c69fdd1b8b99f2c7166de8672ebe62caf0e2b106f4e9

SHA512
fe16dd51386acd84392a1c764f32ea3e44349390337d450a55f75cd373983dec0c6f982b138065507cb1b9291797491e4ffc06981671fe7f66e18e018793ca17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3efe674f850df9a2ce9580382f7259e

SHA1
689c0e475f82aced089a180740eb5e9eb4e4e0f6

SHA256
76cfed25c124e0646540b41f51908f8d9125b7dd76b21c1fb5861aff25bc4757

SHA512
4b3ed68dd555c7d0e3616d42c41ddc120a67bad35963829a9eeb50df3a3a52b5d39e7acdd2b98ea8adc2e11676ce1222e0c1d88456cca1f0b2a3a6eb05be14af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
877caddae85611d67370a6f5db7c0461

SHA1
637607e205c9549c5aa0c78d77c0458d7a9ac871

SHA256
18a408c6b135c16f5efeca5809120cce76b57402d0bf1df0c021590f396c9ef4

SHA512
e952a06e4c92b657cf0448d3bf0ab6b09e9f3989e610e223fbc815932bd095a699075b260f5273e3b5af5a2830380bcb39558aeea94822d0c5d9dd51cff89d19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bde58e906622e6ee6708399218a72cc6

SHA1
24ee8543989e2ece49a3b4173e2a399d42f211b5

SHA256
864e16d0099abdd49e671e488b0fed7afbd4c71d50b506c44e4e7b7ab5d8402b

SHA512
98b62da13aab09f06f4ace0ef640ef83986fb13979ca20bff32290c1fd4b08421655df38742004a2e2842200d505a3b1eb2eabb329665701df7bbd511deaed13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b616bcf119a711801692e481309eca54

SHA1
6f69ecb83090f70a5da4633b995926ead7ab08eb

SHA256
0590ada0d5044d7e6fb65b7dd7d592760fda055d8fbc7e409f899637fdb9f0df

SHA512
aa42dc240d4342bcc17ad9c3a21cc40baf1924cd70a5ec85dfbb625a6b8f67b40dc56e38d4c4bb238e80264341bf51bfbf221716accb135ad3519d65b60c5213

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f8c4d096ee4e799daa956a4cdf5dd0f

SHA1
28fde084fdbea3a44ca1360768bc99e5f48da274

SHA256
7eec226ddaf797d1595c926de2156b00d5aaf6ac9ad4a719fa0777f7825c007b

SHA512
5fa9670d4c915b4e880ae296fd9764d7cc02b9ac8a405c141bb5871fa94e88405aa5f50d78ec7461a327e66e2b057dc1b141ce2a8edef8c706519e57a1d6fbbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00755226b4bf0aeabb599d9598fc3ebb

SHA1
fefe501dffa339d24ea967112de2077ad5429114

SHA256
aa9dffac2edc53eef5e80763ee7b219c2384e48b3fa4b39615c544a252f95d97

SHA512
b3651680207a4d2da18a07391d2b117014282e0806e2c6ca819ff285abe130202b867ed6d2eddfc198169027dedf2521ce891c7dfff899066a2c9628ce59330d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c2aba0cc5aa3d4fcef1c8af39ec9780

SHA1
41cb5bc3044660b4f5bf82b54b164fd60d08fe00

SHA256
4095526fb5aa314064b7249c0496fa2f0a43a55f7843bc8ae198747c8e9d367b

SHA512
ca1a0cde21d3b09eb7ff9e3557a0a94736ce3df615510dcccaf26ed70edfd9ea920a8f072e70c244d3a725f3c7293738598e13cdd0db8a94f6ad94097514ea15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2ee58efa98fe3d2d261585224fc5fca

SHA1
d22e60460b79ee9257e43c2841fd5ef9d313e098

SHA256
65ba7f1d7342496efccad52481a209a221c9b03859ab2fc4ded83643f105beae

SHA512
289df8c232888f4dadca6521ca72cee3cfe6fc88518658acb6f45b683416bab8ce3cbaff2c05b2ff0d35564dad8123218bb55fde8d771616db2c5d9d49cb4e38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcd9fcdd2f791aa45616a3dd0365e0fb

SHA1
add9ba6eca946e4b40f4d17f46de539d7a5cacd3

SHA256
9b051b0b6aad563e02c14638d86060f8a3f5fce5d3d0e1dab308a2907e0b6c9e

SHA512
a6189d67ee7aa8fb0a1c341263cb8ca9f41e29c2b69818ec6a53ee6bb1e688fc274486b24b2238f5356c0edba14ce69098373cc4439a972722bfaff0507b8381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\re26ad0\imagestore.dat

Filesize
1KB

MD5
cec4efbde0c2ed3537082c5d38824674

SHA1
dfb68e25740c48c764077177fd713548abe2906c

SHA256
227a369768771f819ee4ac27f8341bd69ce249ade9bdd8be11bb63cdf21374ce

SHA512
e28ca29d2e0284c29631c59f7a873861dcb2583e318efbe410ab253d642e8eabdd6ab1ab797bdae754ddd51752e56a51ed433462ab0d07bf3443914dfdb48f68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2453.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar265E.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit