fbae86bca9d89aebd8ec60dda34f04f90ade8bc4c799d9ef85a431d8d00cac60

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f892426917976f16fc0dfaf6d539a0d1_JaffaCakes118.html
Size

1KB
MD5

f892426917976f16fc0dfaf6d539a0d1
SHA1

0c51fcfd8ad5103b71d935413087915595416e15
SHA256

fbae86bca9d89aebd8ec60dda34f04f90ade8bc4c799d9ef85a431d8d00cac60
SHA512

95aba152dd02d97f294046ba1080f9bbbc4c744cb3f2e3c4031833c44138fb0987b1f798bf8bf35eeb271ab56ab88413f9bb58dc33c6e605bfbe01dab278f1ee

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB5F8C81-FDB6-11EE-9680-DA96D1126947} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b8f19fc391da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419629071"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000508646f5c0ec5e5cad02b9c16c8053b0c8dc89adc79d7b83e775ee164f24e781000000000e80000000020000200000009c93f1f9bc683777f1ee067887ca5997bc04fecb1f7144bba4e42676ef906dca200000003a796ba7501ff718a6041d453010828330107e8d5ce046e64abaf1de5b16edba40000000bc764320a0b872aa08011677c01a24e84713e0e4d546644d4bc2aafa59705da905df1605b8ceb200648a275b49b20184d386a900c6a78285b79928c53d9be6f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000003006e8e770cbeb7b83eb63afba75d3f89bc3c8832007538619103d8f24f42078000000000e80000000020000200000009aa43322e7c390151a8c0379d40240bf3a6885c65e1e5811301093db93a82ab59000000093bb021236e38105674c2d36ae92a335068c7da94e2ffce741aa97dbbfa940c2fb7afeb9be321ee3484f57825cc061fa5cabafd0e33ad1f4736b7034653c15e2fdd80b12efefb7658df14fcd180ddcd94e8142b3d93d62859d32e85a55d3e09cd420831acbfc0d6c254c4c568b752e99144310a688f8d5110c43bde66de362faa84c4da835f8d337b0a49b23528f45e440000000ef867397871990bb789ed51d76ac08da2b640d9599470fa376a9160237d2eeada74be196a0a46de469ac84014a15dd422d91635d734c50b46e6a4427ac82d43b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2872	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2872	iexplore.exe
2872	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2556	2872	iexplore.exe	28
PID 2872 wrote to memory of 2556	2872	iexplore.exe	28
PID 2872 wrote to memory of 2556	2872	iexplore.exe	28
PID 2872 wrote to memory of 2556	2872	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f892426917976f16fc0dfaf6d539a0d1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62e003f47c79779f3e92ce3e28445ef8

SHA1
040f38f6827a8e65d839bdef7ccc236a05e3b5f3

SHA256
d5764988d732b70926d175dea6527801cc5231004283a12c916cd83082f39c56

SHA512
1b6311c1ed21a807e88ae892282fa37190a65b202df45d1a5529e7de108d64681784ce7dd6f59a489ba15441991ef39138f4eabbe54e541b71f1cf0ec228efca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bff7b3baefa8e4b565dc515894bba8a5

SHA1
75e6782921719c8e911aa31496a9ddd4c42b3d15

SHA256
09210af20a521fe7033e581f1f95d19229d8d1314f2259a5fa46c9b27809d634

SHA512
77eb0263c915410d5727595856921f5f80fe3489758884f084ead269842ea2449c995c8302974f70bf7fab630ea7b661ed128f24f09811594b4ae3e99d1aa3f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2418110726b6c94e588203d77e51f02

SHA1
697ae905c0de5b5ebdc84228c161fcd082319b1c

SHA256
776150529098164c62ec1e648b8161ea8680b258fb9a95250b56ef5588a3571c

SHA512
bcbad1595e18e91766537057d9909d9287ec5be52ec6ab458a3abe0ca6cdd515d44f22964dda9dd88db79a1934de60ee6c19369c1bc351d3e90592adb932f8c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4784fc5b1803f09211727696d3ddd70f

SHA1
76a4db0d4cdd3742ce053b380e6025ccdedd8ee4

SHA256
dd7a476569488092b5f7070eb0560ea71928e9e7a98172c9ce0567d13d0bfb1f

SHA512
3ae90e275b86cb922fe59b17e74a454498dfe632a9c55558ecccc28ab737afa39105a259be53fe626aac680b072e573d4a80aa254567e3f359e13072a91d9411

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d53e79b55742932d86937506fc3a2bb5

SHA1
9dbf23d6d73c83aaba2787c6c857fac83f7b6b9b

SHA256
293f7d34c225a27938b1ecd6cae4cd275dcc822af0a0ae823c1a5e208da0b6e1

SHA512
6166863c45a92a1fd433d0e7b9694b1c2ddfe2a9fe84648b8ac788bd8c9a8106cd81714e08dcfa1b6d7985482279de11c8ac3aaf10a2e6f6b51bdf963cb28869

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4630c4e17e919f8ddf0be6d94eab01d

SHA1
7281a3bf7bb534e2498d199fe7802d237837777d

SHA256
4d19c356e0b6b7f0324ef8b551c3a3fb130cae1863c4cbbc9e8f1359ec3a9375

SHA512
db914a8479e8bae8911ebac2c5139390ad9ca76560b8802c8c63ea4d3a1d9c96936c6b30fbbd98f09a075cf95adc9fbeb5c1ca35b7c5a7c0af6ecf8727521d09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7f037d449c3cef0526cb99d1428078e

SHA1
a575a8f8bd8158da48bce4ce72282eec819997c1

SHA256
01b54164d5284d1a1e803fc66db3573e46e2126b7c1e620452ab8b17c9a97136

SHA512
7f155a85f4df98ccc4d16d15e9e580b7662573a011ec7650c1a2ddc06792094f1a27eb5ca720569437e5427b6c6a13e69fafb2dd6c86c747c1ca849be28ec814

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1db224ecd9768f5a389c98bcf0cf48c8

SHA1
0707f25c91cb6cacddc9501d19e6c143f58d9245

SHA256
08281938a14a9a0be2f0f63b9a544e7e31885623a43cb8bfa48abf8a9c90f769

SHA512
a1bcb8563f6dd1355c5e88a2e1d24a9daa588a5d8926aab7215ee87cd4b3c827cc720580fb26b7d9542719bb142c8f1efcd8f9e91b36a50a6223dad755d13464

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8cc05d0542e99a4443b6cb4c35785f7

SHA1
b7b6e5acd2f56a78fa236b209b804dd288ff18f6

SHA256
2af07045ccc33d96f1b6159f02ba1f899fe085b73498df3350faac7df4528b9f

SHA512
5c3b8977226b129133647c0ac48a9c615ff7f0d220ba412c4aef1e44025b6d33b70036db3d8999948ca0cb71245901a47c639d793cedfed580f7069d2b3c1c02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b2b0c2ac901aa262ff5581dcc0060c5

SHA1
7cd3544e2682df332dfacd8525f5571df89a4f51

SHA256
e653bee4879d89a1395fec565c5b51712879c7e154eef5759b9c00d6b80f1222

SHA512
1d5be0ccffbe84e68584bf49bac5518e5174638def8be6d8549bf8ab495f49c72b76e401ef6b7cdd1a360aa42823c76762414884b44a9952987c95021fe23d3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a73e8a4f51d530c0139ad533f6c86220

SHA1
3d2d9888087fb5c2601fba87016f4ac68b2f1dcf

SHA256
faf45aa1ae025559ba667710cec9176e92746efd77b80ec2316d47cce31e4169

SHA512
5325a09e584bddf597425a3a8a545ea813466ca6b28a81c3d82f5facaad776636e03f30a89ea276ba4e9eb5d8df2d85e13f74df3c892265300c56369903d68e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cc91955dcd1566247810e18c0ccc616

SHA1
b0b87edc866ee0f84cf49434b9d0d906e725cb69

SHA256
332c8d237d1cbc5b5bb8d00bb88c455da20d06d829dfc9f505299fc9a1e756b3

SHA512
27a4a6adfafa8ae8080d0e9fd127644b1b1d332abc6d7dca29cb131b8696f017febb9430f85ffd38cf6204ff541067224c386e984d351efaeae7ca6f01cc0900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a023b7630b4d8741184722f72eea4aef

SHA1
0c730f6a384f2c1dfa52c1720f30b5cfda1e5d16

SHA256
1bb778911075678608fd5fab5c9088c7a706a84eeb2cba020543ed8f591d9470

SHA512
b82dc54aaa144e932bbc2a88dfc1c882f03f185429f408b082c0e231e8383eeccaed45b867925a41f5db8035cea508819a6e0bb199af787d1d807ec4f0297145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5539d2b757191ebebf6dfbb009ace7ad

SHA1
ae7b2955c1a9d99c8f05f222963bd55297eac747

SHA256
c9f1515b1b0ea61553a089b39527ac32df222cef723cf6d0245a583d05f124f6

SHA512
4a6f4f0e4eabdf2949ce563a8e8c8858b0db4988a22f4e8473a0b61dea041cf3176947bbfd6b1be71c45cd7d0f6457449f6b45e83976a252898b7982572b0517

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc3f60e6eaf74e1d1d5574d3b5d7eb14

SHA1
03e7599e330b764a436d199c504ad36ee6ac6d01

SHA256
55550ecf57c0a01e5854cbf6cf0da31544b75b838b2189c40e7fd042501478da

SHA512
753cda71d0e0a60bdb1249b70909fad4ef07dbd9e5404b103af6fdd842ab074c744d7b584a187358a7c36a80c80130634913c87780c76a546853fb3e3a2e55c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0a7d1cea648393da8cd4a6ab1adaee7

SHA1
0b11e4219a56daeca68451cdbaaae14c4f467cf1

SHA256
b5612326c6d04faf0fda98df7432684e8a7cdbf07fa69b9cd17a1f2444791673

SHA512
a1ed6a641d8a01e6211d10555730788d4ff7475fdaf2a716a7a0ee90c534dd7e37157cf0402c49d19fa5fb5dade7c9539547334cd4131b8ec48234fd67fb278b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5b29ae96ac82fa4640c9e5b77776e7c

SHA1
a4c20de1fed246f5d4aa8c6b6d33dbe99715528b

SHA256
715d87a0828c6142e148dd4eeff9021f7a3ca5a78d06cd7edf8de26eb97c17bf

SHA512
0b4051476ea95930f1c871d998ad5a3a806ffb3e3118055ba9d41a481138bf815053127d16e2f4b8c786da380a311f8056286ceb3420fb47fe0ea4f1ae4c1da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3F25.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4007.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit