e71ece90cfd03238df37bdc0437207ed79340f38725f106cd8182adc0ffc148c

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be218b8c3f0fc5be65cc3398a09881ed.html
Size

3KB
MD5

be218b8c3f0fc5be65cc3398a09881ed
SHA1

f6668120bfe0294d7f2b31805d1161790218ff2f
SHA256

e71ece90cfd03238df37bdc0437207ed79340f38725f106cd8182adc0ffc148c
SHA512

3ffbb7f44c0695d10653b0663252a7708f6dcff975fb4703f6b60ec7f0c1d079344675166b42226ea098ce9134972c5c01acf7dd60e0dfb18005695336ad12e5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA27C381-DEB7-11EE-B238-4AE872E97954} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000096e3798a60c322609a37c5f9ffda594e7576287198d8166c1efed2ce334aa732000000000e80000000020000200000009064b3fd44f425ba8542aa46cf45970eb5391d51e4e654d1440e5765cb4418c7900000007740b13f9b4e266bdd44076726bf7ab972cd2704489d9d08d0efd3ef446733d26d605c93a58a85e95a36d44d4445f8319cba8b6b1e6a3fb79aeb12ba78148b563780ee5a424aaf9aeefd1f3c6ce911a9d21c0fc3b060f9e7017acb29380552818185df6932e5e9511e70faedacfb2fef6cd1dc2073850f7b5b1e0ab179ec220097a8d318d242e524bb2b77b019026403400000007d73cfde7b0662e1a277acafac0182b7ca08537c8ff765e23e47a20be23b9347fd6e7d79fe3ce81938bb8e5c9629a43622e60861d8b5adc5085a51e7cc9f9c2b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416221067"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 503ea9bec472da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000029bbc8a7dad225cfb33e9053729af450bc848fd2f4bfddae83f744aa757e40d4000000000e8000000002000020000000db6e1b24655a322ff3327f57aef8350dd00e8a39abf60548cbfcd7a1c735300420000000a0a8d3096545885517ac1d12fb2587c2c382ee2f87d8499aa457a1b994bfe1c840000000c0d107ae6fc9317d53d72ae0c39bee9ee7935a14860ef45157a61c6ad155436bd68ce6141fd871e089445b96535d13e61b8e3c5ee8cb63c7c41f8f0472da5e3d	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2936	1640	iexplore.exe	28
PID 1640 wrote to memory of 2936	1640	iexplore.exe	28
PID 1640 wrote to memory of 2936	1640	iexplore.exe	28
PID 1640 wrote to memory of 2936	1640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be218b8c3f0fc5be65cc3398a09881ed.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d12ee5696790c7fdb469961d1837995

SHA1
c58341783d1b5303efcb9eb68abf1a5f40655521

SHA256
ca867f81bf32cdb878a17e5f56f25ea22f3b529cdc2afdf944139201f09c3b66

SHA512
240fd16259c327814ce5fa3041f7be45c1026c76b0a9ae33b83ef7fdf028906b38d47345d143463bd165ca3dfc0f0053b78279c2587c44284bd49609f0d6b765

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
854fc15dad1cb287a8e2564ac4076bd8

SHA1
69b9ee65231aa7993e124332758162ad7afb95f0

SHA256
a653e35c25d9eaa4688c3b8eadd0af1f3f99a6dd47211807eb78b88ff43449b4

SHA512
ae1215e3c9df3cd37d683e39e49c44b7809fc3e1ff6c581b4707f4323210717808b7b06fc4c875a801aa183dea3c0cd3a95d88861ce3aa9cb30c2a58df03d94f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fdd909963a83f7dadb01b56a47ec4ea

SHA1
f45192ee98770e61785375d339a4d13cdba9f20e

SHA256
77dc380ce051f9f225da43cf10fa68b1173dd3610ff1cd82d6b12325962eac5f

SHA512
63b98ceb4a8fdf80eaca4e6118f72e442532a322250e605fb2c133b31085b1e9779e83cc7a15fac7bebd6e0c7994989a1dcb50429df160a8561db226be9932db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a08b28dda94b30f9cdee2ca66be66ab

SHA1
c1f9f9b4f992f7350e07b6c6a5099175c88543f8

SHA256
29cb5b72b29c82aa57aff0372e34a82ea2a68017a6e40933e2923ec9c048d38b

SHA512
6cef7413d207e3b60c038a0afa049c1264713205e42a6d4c572306beb0919e78dcf9d804fe7f1aa438f18211cf87c76b44163ee1a94730bb7757d3339141886f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
073eeda3b17893db60ea472634ecd639

SHA1
c0cdee82e85914b67d0c715a4c7b61e6ca1cd901

SHA256
a0eb6a09cf08e747b4a19deed1f4be6fb4d9dd7a55f0e9c4630269288adbac4d

SHA512
2873057e769eb887dda22292eed80a73270d5d6960b893317054a4be1fbfa504e2c33ed7d282312985658dfc3a29d12251dc67784a2eaa4540c5288a27a84dd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b418dbc13c065fd39cbe0d430d67053

SHA1
451bca041d96f7bc33a67f9220140cc9d915cc88

SHA256
94886c641cf9bf080739420a712225915174fd3f14910a83d2acff963aaf19dd

SHA512
9270293926066a721d91015dc18ec3ca6f812e8eb37bf0233ce19e95e5917ca43d64530f4d05c50a47c0c82403f857c5b7149221262f95ad23b1ae12b24cd845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
338914b7eeaa9f0ebaa42a0b15800068

SHA1
e6e1575c2489a0674551a4c02879d8fa3e381877

SHA256
08cb598595840c8040be7521963b846745420c805d0ce722057ece4b76cfa478

SHA512
0cd18c68a5e96562d4cd3e31e599ded874f9639cdf63cd338ae38cbf49c7719d03c53e5aace0f64370dfc17141f40675e3d16e572ce44f1c853b6adef4030f04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcb0f0756030896b5642ec1e16288599

SHA1
57061b8c7f439fc032e7f1d19163fd3a1e4c0767

SHA256
d6491ecda72ea330adde546919eaa7d2a201038121953a3effdd6768731d1a3f

SHA512
a76bf859945bbf42f9a42677d57d89f4feaa5af2799ba4af5f9cdf8f8df2e1a03bf76f8a00145411bad531b3ae639611958d23313205bbc330c9cd416693e67e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fb60d8f7c6d1732fb7108edf2fbca7f

SHA1
7f058346cbfd70a1bfc11a069332da0f93eadba0

SHA256
3732c5fde68254805897666cb2279284a2f0a4c704a3ef97990ea34368a572ee

SHA512
5f5f285dbd9afff441e530cd7f3cda7081caf1a63aa42bf7fbfa1a5a867efbc980a6cff3b35d43bdccf31f3361dcd3a2c6bbd66c58b89d32e03c30a54bafc25b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3da91d68921c3bce1669fa16409e9121

SHA1
51ec2e4208546f0d18cf83efd1dec22c50febf55

SHA256
9aed820c722bdbdac6286b50422e9b3e4a4ce3813eaa240a4f05360ee3e4e11b

SHA512
3bc82408061b078b15846a6bb0a0a8b695fa73d6ecdb0df96d82a9a353a745347d5e807027a63607d54c366564c3f37fa7fd8211f8b711ccc4fa97db832ef5b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d75a33a917f2855a3031313ca4909b2c

SHA1
f501df8665e738fb9e9cee5005489b0c71da486b

SHA256
8004c5a0df33588528d027b81dbe71c228deff409f54a92b1a6323962297f3d0

SHA512
b055688f2d0f956ea3b3b2bc95c805f800071b753f6e95ab093f4b612b7ca6de7cdd8ff3b02eb5b15776c7764b70fb165e45a5b61366c90d30953e48809f65e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2620ab981cc53692405bbdce465e1c9

SHA1
0b01468a2b12b3c90c7f378edc953f03391c6bf4

SHA256
681ae19331909e8f48042798d8733aae908451265960ed7d638a72cf553a44c5

SHA512
28189a3b0db2c280d8a068ba181bb7f619e35a65073f05486102ff54ba5d4d5c993850968e61db10f97b4f336db226d8dcae6fad5bb1876bd9eb75c30df8c4dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17b5e1f7938b9295623b9bc7925de490

SHA1
7172e8b6e0ff2b8df4eced1bf0a3429a8babc56a

SHA256
85e6d133356f3faeb25aa096607b5173929dfcec4defb7349cb7d070a1ca3fc1

SHA512
1cc8cc9db42f4e7acb5021a9931df38b9811f03d98ef4a175c7d108f8825e93c741d6f2a867d089759ca303bd3ea8f3cf4343cf6c050c655cdc92778b571599e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7165b66c294d4e87148cf564cb3d2775

SHA1
879b6b0add6fd8a63cca00828afbefece1852b1b

SHA256
71de20d6411f79a72adf36eeb964c283214ecb43f2e5f5d5b22b7b7189df4ee3

SHA512
6ca601cee7946c880683114723b5d12be2df46c1c774f9ae6821ba88cfe09bff4f413998bbc2223f114431b825bdc4a284ad6159a4fdc036f7e7f7e7062487d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8641e05e5ab280c9c2c1a68612002302

SHA1
95b34e465ffc05efc639e2ea504781bd0eb5dbad

SHA256
9fd61c2b4404250340b1719d74388a19a86e075041a09f6c20551e97ee0d5a57

SHA512
b9967ba4b6650c895b7c8672871e69d1b61ed5b6a72541348cddba00294cca754db8e34ff372791f35bd4e7bf2d16279601f289594d35ef2f9b864da39d633a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f72250e0539e868373f49303b19ae94

SHA1
b41acfa08fce67168732f57019a26727bbb46fee

SHA256
f1204c1c671efbc4d15e6940841fdcd67bea024b6d1b8bc9e0e3e879e1fdb090

SHA512
c4e37363589b9a04463062ce7fc23c7227035f70c85b66f385139521237138aa58fbafd1256ddd4b3e03ad4a56fb11928f57321c4f25ff0fdefff5dc67df7a33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba87d3fd52fba0acdf6f74540d966b04

SHA1
2eec58f285ed16aaa536b63f0c16cbfa9b90bce2

SHA256
e23a210512f8923b97bbaeb59816a290de271517b382aeea7938f5a4aedbd966

SHA512
e83e7a0441d6ebd79fe2175e8ce32b2a6dc5520c2214194328bdc2e4a93a6e5e860b3219408f3499666fe6bee5b922dfcb8ea4ec04df73d899e94e7b7150a85b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3B7D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C40.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit